@bridge_gpt/mcp-server 0.2.67 → 0.2.69

package/build/upgrade-cli.js

@@ -30,9 +30,41 @@
  *
  * Every launcher claim is verified by RE-READING the configs after the write.
  * The command never reports a transition it did not confirm on disk.
+ *
+ * ---------------------------------------------------------------------------
+ * BAPI-1445 — Codex's global config
+ * ---------------------------------------------------------------------------
+ * The three project JSON configs are not the only place a Bridge pin lives:
+ * Codex keeps its registration in one per-user TOML file
+ * (`~/.codex/config.toml`, or `$CODEX_HOME/config.toml` for an absolute
+ * override). A repin that skipped it left Codex on an old server for every
+ * project on the machine. Upgrade now inspects, repins, and verifies that file
+ * too, beside the JSON targets, with these boundaries:
+ *
+ *   - Preflight refusal guarantees NO writes. An unsafe Codex file (a range, tag,
+ *     or ahead pin, a duplicate or unlocatable registration, an unreadable file)
+ *     stops the run in Phase 2, before local-install removal, `runInit`, any
+ *     config write, or the permission write.
+ *   - A failure AFTER `runInit` can leave the JSON configs upgraded. It exits
+ *     through `did NOT converge` with exit code 1 — no rollback, no automatic
+ *     retry, no completion line, and no reload guidance.
+ *   - The Codex write is one surgical splice of the package specifier, written in
+ *     place only if the file is byte-identical to what Phase 2 read. That compare
+ *     is optimistic protection, not a lock.
+ *   - Install is unchanged: it keeps its existing-table detection, its
+ *     `manual-required` outcome, and its current guidance. Upgrade adds no install
+ *     handoff and makes no repair calls. `LAUNCHER_CONFIG_TARGETS`, `runInit`,
+ *     doctor, and Phases 1, 4, and 8 are untouched.
+ *   - Windsurf is excluded by its `manual-instructions` write strategy: upgrade
+ *     never inspects or writes its file, never prints its reload guidance, and
+ *     leaves its manual setup with the operator.
+ *   - Upgrade-notice delivery is a separate concern. The one thing this file does
+ *     for it (BAPI-1446) is Phase 8's advisory SessionStart hook request, for a
+ *     Claude Code installation only, pinned to the converged target version.
  */
 import { spawn } from "child_process";
-import { readFile, stat } from "fs/promises";
+import { mkdir, readFile, stat, writeFile } from "fs/promises";
+import os from "os";
 import path from "path";
 import { VERSION } from "./version.generated.js";
 import { runInit } from "./init.js";
@@ -40,11 +72,48 @@ import { InitPreflightError } from "./init.js";
 import { isNewerVersion } from "./update-check.js";
 import { fetchLatestVersion } from "./cli-release.js";
 import { CANONICAL_UPGRADE_COMMAND } from "./upgrade-advice.js";
-import { describeLauncherReason, inspectLauncherConfigs, isApplicableStandardLauncher, isPrerequisiteFailure, LAUNCHER_CONFIG_TARGETS, } from "./launcher-config-inspection.js";
+import { applyCodexRepin, inspectCodexLauncher } from "./codex-launcher-pin.js";
+import { describeLauncherReason, inspectGlobalLauncherConfigs, inspectLauncherConfigs, isApplicableStandardLauncher, isPrerequisiteFailure, LAUNCHER_CONFIG_TARGETS, resolveCodexConfigLocation, } from "./launcher-config-inspection.js";
+import { allHostTargets, HOST_PLATFORM_ORDER, MCP_HOST_TARGETS, } from "./mcp-host-targets.js";
 import { MCP_PACKAGE_NAME } from "./mcp-identity.js";
+import { applyProjectPermissions, BRIDGE_PERMISSIONS_MANIFEST_RELPATH, BRIDGE_PROJECT_SETTINGS_RELPATH, describeSessionStartHookOutcome, } from "./bridge-permissions.js";
+import { readMcpInstallState } from "./mcp-install-state.js";
+import { ensureGitignored } from "./git-ignore-utils.js";
 import { defaultNpmEntryFileExists, resolveNpmEntry } from "./windows-npm-entry.js";
 /** The sentinel this CLI passes to the child it re-execs from `@latest`. */
 const INTERNAL_REEXEC_FLAG = "--internal-reexec";
+/** Production binding of {@link UpgradeCliDeps.applyBridgePermissions}. */
+export async function defaultApplyBridgePermissions(cwd, env, sessionStartHook) {
+    const fsDeps = {
+        readFile: (filePath) => readFile(filePath, "utf-8"),
+        writeFile: (filePath, data) => writeFile(filePath, data, "utf-8"),
+        mkdir: (dirPath, options) => mkdir(dirPath, options),
+    };
+    for (const relPath of [BRIDGE_PERMISSIONS_MANIFEST_RELPATH, BRIDGE_PROJECT_SETTINGS_RELPATH]) {
+        try {
+            await ensureGitignored(cwd, relPath, fsDeps);
+        }
+        catch {
+            // Advisory: the files are still written, and doctor reads them either way.
+        }
+    }
+    return applyProjectPermissions({ cwd, env, sessionStartHook }, fsDeps);
+}
+/**
+ * Is this a Claude Code installation? Answered from the install state `install`
+ * recorded, not from a bare `.mcp.json`: that file is also written for other hosts
+ * and by hand, so its presence proves nothing about Claude Code. A missing,
+ * invalid, or unreadable state is "no", so the hook is never written on a guess.
+ */
+async function isClaudeCodeInstallation(deps) {
+    try {
+        const state = await readMcpInstallState(deps.cwd, { readFile: deps.readFile });
+        return state.status === "valid" && state.state.selectedPlatforms.includes("claude-code");
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * The fixed, secret-free message printed when, on Windows, the latest CLI could
  * not be STARTED. Upgrade stops here rather than continuing with the local copy.
@@ -179,6 +248,10 @@ export function createDefaultUpgradeCliDeps(cwd) {
         cwd,
         fetchLatestVersion,
         readFile: (filePath) => readFile(filePath, "utf-8"),
+        // In place on purpose: writing through the existing file keeps its mode, owner,
+        // and symlink behavior, none of which a rename-based write would preserve.
+        writeFile: (filePath, content) => writeFile(filePath, content, "utf-8"),
+        homedir: () => os.homedir(),
         hasCompetingLocalInstall: defaultHasCompetingLocalInstall,
         removeCompetingLocalInstall: (installCwd) => defaultRemoveCompetingLocalInstall(installCwd),
         runInit,
@@ -186,6 +259,7 @@ export function createDefaultUpgradeCliDeps(cwd) {
         stdout: (m) => console.log(m),
         stderr: (m) => console.error(m),
         env: process.env,
+        applyBridgePermissions: defaultApplyBridgePermissions,
     };
 }
 // ---------------------------------------------------------------------------
@@ -296,6 +370,177 @@ export function isEveryLauncherAlreadyCurrent(actions) {
     return applicable.every((a) => a.kind === "already-current");
 }
 // ---------------------------------------------------------------------------
+// Global (Codex) config — BAPI-1445
+// ---------------------------------------------------------------------------
+/** The label that tells a reader this config is machine-wide, not per-project. */
+const GLOBAL_SCOPE_LABEL = "global — applies to every project on this machine";
+/** The path-plus-scope label a global config line carries before its colon. */
+function globalConfigLabel(displayPath) {
+    return `${displayPath} (${GLOBAL_SCOPE_LABEL})`;
+}
+/**
+ * Project a global inspection onto the project-inspection shape so the report
+ * helpers reuse the existing transition, current, normalization, and shim wording
+ * rather than growing a second set that could drift.
+ */
+function asProjectInspection(found) {
+    return { ...found, relPath: globalConfigLabel(found.displayPath), topLevelKey: "mcp_servers" };
+}
+/** Render the dry-run preview line for the global Codex config, or null when inactive. */
+export function formatGlobalDryRunLine(found) {
+    return formatDryRunLine(asProjectInspection(found));
+}
+/**
+ * The real-run action for the global Codex config, in the form
+ * {@link formatResultLine} already renders. Called only after verification
+ * passed: a failed write is never advertised as a completed repin.
+ */
+function globalResultAction(initial, targetVersion) {
+    const relPath = globalConfigLabel(initial.displayPath);
+    const registrationKey = initial.registrationKey ?? undefined;
+    switch (initial.action) {
+        case "repin":
+            return {
+                relPath,
+                kind: "repinned",
+                registrationKey,
+                fromVersion: initial.currentVersion ?? undefined,
+                toVersion: targetVersion,
+            };
+        case "normalize-unpinned":
+            return {
+                relPath,
+                kind: "normalized",
+                registrationKey,
+                fromSpec: initial.spec ?? undefined,
+                toVersion: targetVersion,
+            };
+        case "already-current":
+            return { relPath, kind: "already-current", registrationKey, toVersion: targetVersion };
+        case "skip-worktree-shim":
+            return { relPath, kind: "skipped-worktree-shim", registrationKey };
+        default:
+            return null;
+    }
+}
+async function snapshotCodexConfig(deps, env, targetVersion) {
+    const home = deps.homedir();
+    const location = resolveCodexConfigLocation(env, home);
+    const captured = { source: null };
+    const inspection = await inspectGlobalLauncherConfigs({
+        env,
+        homedir: home,
+        targetVersion,
+        readFile: async (filePath) => {
+            const text = await deps.readFile(filePath);
+            captured.source = text;
+            return text;
+        },
+    });
+    return { ...location, inspection, source: captured.source };
+}
+/**
+ * The guarded Phase 5 Codex write. Computes the one-token splice from the Phase 2
+ * snapshot, re-reads the file, and writes ONLY if it is still byte-identical to
+ * that snapshot. The comparison is optimistic protection against a concurrent
+ * edit, not a lock. Every failure is a fixed, path-specific sentence — never the
+ * TOML, an argument, an environment value, or exception text.
+ */
+async function applyGuardedCodexWrite(deps, snapshot, targetVersion) {
+    const where = snapshot.displayPath;
+    let expected;
+    try {
+        if (snapshot.source === null)
+            throw new Error("no snapshot");
+        expected = applyCodexRepin(snapshot.source, inspectCodexLauncher(snapshot.source), targetVersion);
+    }
+    catch {
+        return { failure: `${where}: the Codex configuration could not be updated safely; it was left unchanged` };
+    }
+    let current;
+    try {
+        current = await deps.readFile(snapshot.filePath);
+    }
+    catch {
+        return { failure: `${where}: the Codex configuration could not be re-read before writing; it was left unchanged` };
+    }
+    if (current !== snapshot.source) {
+        return { failure: `${where}: the Codex configuration changed after it was inspected; it was left unchanged` };
+    }
+    try {
+        await deps.writeFile(snapshot.filePath, expected);
+    }
+    catch {
+        return { failure: `${where}: the Codex configuration could not be written` };
+    }
+    return { expected };
+}
+/**
+ * Phase 6 for Codex: re-inspect and prove the claim. A written config must be
+ * current at the exact target under its ORIGINAL registration name AND equal the
+ * expected spliced text exactly — a correct pin beside any other difference is
+ * still a failure. Initially inactive configs are nonparticipants and are never
+ * verified, created, or repaired.
+ */
+async function verifyCodexConfig(deps, env, snapshot, targetVersion, expected) {
+    const initial = snapshot.inspection;
+    if (initial.action === "skip-inactive")
+        return { inspection: null, failures: [] };
+    const where = snapshot.displayPath;
+    let after;
+    try {
+        after = await snapshotCodexConfig(deps, env, targetVersion);
+    }
+    catch {
+        return {
+            inspection: null,
+            failures: [`${where}: could not verify the Codex configuration after writing`],
+        };
+    }
+    const found = after.inspection;
+    const fail = (message) => ({ inspection: found, failures: [`${where}: ${message}`] });
+    if (!found.filePresent)
+        return fail("the Codex configuration disappeared after the write");
+    if (found.reason === "file-unreadable") {
+        return fail("the Codex configuration could not be read back after the write");
+    }
+    if (found.action === "duplicate-registration") {
+        return fail("the Codex configuration now carries two Bridge registrations");
+    }
+    if (found.reason === "unlocatable" || found.action === "skip-inactive") {
+        return fail("the Codex Bridge launcher can no longer be located after the write");
+    }
+    if (found.registrationKey !== initial.registrationKey) {
+        return fail("the Codex Bridge entry no longer lives under its original registration name");
+    }
+    if (initial.action === "skip-worktree-shim") {
+        return found.action === "skip-worktree-shim"
+            ? { inspection: found, failures: [] }
+            : fail("a worktree shim was expected to be preserved but no longer looks like one");
+    }
+    if (found.action !== "already-current" || found.currentVersion !== targetVersion) {
+        return fail(`expected ${MCP_PACKAGE_NAME}@${targetVersion} after the write`);
+    }
+    if (expected !== null && after.source !== expected) {
+        return fail("the Codex configuration differs from the expected upgraded text");
+    }
+    return { inspection: found, failures: [] };
+}
+/** The host a project config path belongs to, derived from the registry. */
+function hostIdForRelPath(relPath) {
+    return allHostTargets().find((t) => t.scope === "project" && t.relPath === relPath)?.id;
+}
+/**
+ * One `Reload <host>: <hint>.` line per changed, automatically managed host, in
+ * registry order. Hint text lives on the registry entry; nothing here names a
+ * host or a path.
+ */
+export function reloadGuidanceLines(changed) {
+    return HOST_PLATFORM_ORDER.map((id) => MCP_HOST_TARGETS[id])
+        .filter((t) => changed.has(t.id) && t.writeStrategy !== "manual-instructions" && t.reloadHint)
+        .map((t) => `Reload ${t.label}: ${t.reloadHint}.`);
+}
+// ---------------------------------------------------------------------------
 // The command
 // ---------------------------------------------------------------------------
 export async function runUpgradeCli(argv, injected) {
@@ -341,13 +586,32 @@ export async function runUpgradeCli(argv, injected) {
         stderr(`Bridge API upgrade failed: could not inspect launcher configs: ${msg}`);
         return 1;
     }
+    // BAPI-1445: Codex's global config, inspected beside the project targets in its
+    // OWN error boundary so an unexpected failure is reported with fixed text and
+    // the safe display path, never with exception text that could carry a path.
+    const env = deps.env ?? {};
+    let codexSnapshot;
+    try {
+        codexSnapshot = await snapshotCodexConfig(deps, env, target.version);
+    }
+    catch {
+        const where = resolveCodexConfigLocation(env, "").displayPath;
+        stderr(`Bridge API upgrade failed: could not inspect the Codex configuration at ${where}.`);
+        stderr("  Nothing was changed.");
+        return 1;
+    }
+    const codex = codexSnapshot.inspection;
     const blocking = inspections.filter(isPrerequisiteFailure);
     const ahead = inspections.filter((i) => i.action === "ahead");
-    if (blocking.length > 0 || ahead.length > 0) {
+    const codexRefused = isPrerequisiteFailure(codex) || codex.action === "ahead";
+    if (blocking.length > 0 || ahead.length > 0 || codexRefused) {
         stderr("Bridge API upgrade aborted — these configs cannot be safely reconciled:");
         for (const found of [...blocking, ...ahead]) {
             stderr(`  ${found.relPath}: ${describeLauncherReason(found.reason)}`);
         }
+        if (codexRefused) {
+            stderr(`  ${codex.displayPath}: ${describeLauncherReason(codex.reason)}`);
+        }
         stderr("  Nothing was changed. Resolve these by hand, then re-run the upgrade.");
         return 1;
     }
@@ -361,9 +625,7 @@ export async function runUpgradeCli(argv, injected) {
         }
         stdout(`- Would detect and remove competing local install in node_modules/${MCP_PACKAGE_NAME} if present.`);
         stdout(`- Launcher pins (target ${MCP_PACKAGE_NAME}@${target.version}):`);
-        const lines = inspections
-            .map(formatDryRunLine)
-            .filter((l) => l !== null);
+        const lines = [...inspections.map(formatDryRunLine), formatGlobalDryRunLine(codex)].filter((l) => l !== null);
         if (lines.length === 0) {
             stdout("    (no applicable launcher configs found)");
         }
@@ -371,11 +633,24 @@ export async function runUpgradeCli(argv, injected) {
             for (const line of lines)
                 stdout(line);
         }
-        if (isEveryLauncherAlreadyCurrent(toPlannedActions(inspections))) {
+        const plannedInspections = [...inspections, asProjectInspection(codex)];
+        if (isEveryLauncherAlreadyCurrent(toPlannedActions(plannedInspections))) {
             stdout(`- Would print: Already up-to-date.`);
         }
         stdout(`- Would refresh scaffolded artifacts (commands, agents, pipelines).`);
-        stdout(`- Would print a reminder to reload/restart your MCP.`);
+        // Reload guidance only for hosts whose configuration this run would change.
+        const plannedHosts = new Set();
+        for (const found of inspections) {
+            if (PLANNED_CHANGE_ACTIONS.has(found.action)) {
+                const id = hostIdForRelPath(found.relPath);
+                if (id)
+                    plannedHosts.add(id);
+            }
+        }
+        if (PLANNED_CHANGE_ACTIONS.has(codex.action))
+            plannedHosts.add(codex.hostId);
+        for (const line of reloadGuidanceLines(plannedHosts))
+            stdout(`- Would print: ${line}`);
         return 0;
     }
     // ---- Phase 4: competing local install — a reconciliation, not a transition ----
@@ -414,6 +689,21 @@ export async function runUpgradeCli(argv, injected) {
         stderr(`Bridge API upgrade failed: ${msg}`);
         return 1;
     }
+    // ---- Phase 5b (BAPI-1445): the guarded Codex write ----
+    // Only after `runInit` succeeded, and only for a pin that has to move. A failure
+    // here is recorded as a convergence failure, never thrown: the JSON configs
+    // `runInit` already upgraded stay upgraded (no rollback) and nothing retries.
+    const codexFailures = [];
+    let codexExpected = null;
+    if (codex.action === "repin" || codex.action === "normalize-unpinned") {
+        const written = await applyGuardedCodexWrite(deps, codexSnapshot, target.version);
+        if ("failure" in written) {
+            codexFailures.push(written.failure);
+        }
+        else {
+            codexExpected = written.expected;
+        }
+    }
     // ---- Phase 6: verify every claim by re-reading the configs ----
     let verified;
     try {
@@ -471,10 +761,22 @@ export async function runUpgradeCli(argv, injected) {
                 `after the write, found ${after.registrationKey ? `\`${after.registrationKey}\`` : "no recognized registration"}`);
         }
     }
+    // Codex is verified independently — and only when its write did not already fail.
+    let codexVerified = null;
+    if (codexFailures.length === 0) {
+        const codexCheck = await verifyCodexConfig(deps, env, codexSnapshot, target.version, codexExpected);
+        codexVerified = codexCheck.inspection;
+        codexFailures.push(...codexCheck.failures);
+    }
+    verificationFailures.push(...codexFailures);
+    // A Codex transition is reported only once it verified.
+    const codexAction = codexFailures.length === 0 ? globalResultAction(codex, target.version) : null;
     // ---- Phase 7: report what actually happened ----
-    const resultLines = initResult.configActions
-        .map(formatResultLine)
-        .filter((l) => l !== null);
+    const codexLine = codexAction ? formatResultLine(codexAction) : null;
+    const resultLines = [
+        ...initResult.configActions.map(formatResultLine),
+        codexLine,
+    ].filter((l) => l !== null);
     if (resultLines.length > 0) {
         stdout("Launcher pins:");
         for (const line of resultLines)
@@ -495,8 +797,29 @@ export async function runUpgradeCli(argv, injected) {
         stderr("\nBridge API upgrade finished with an UNCONFIGURED MCP entry (see above).");
         return 1;
     }
-    const applicableStandard = verified.filter(isApplicableStandardLauncher);
-    if (isEveryLauncherAlreadyCurrent(initResult.configActions)) {
+    // ---- Phase 8 (BAPI-1398): the project's /drive-epic-run permission rules ----
+    // Only after every gate above passed. Advisory: a malformed settings file or a
+    // refused launcher is reported and never changes the exit code.
+    // BAPI-1446: the same step carries the pinned SessionStart upgrade-notice hook,
+    // requested only for a Claude Code installation and pinned to the CONVERGED
+    // target version (never `VERSION`, `@latest`, or the fake-latest override).
+    if (deps.applyBridgePermissions) {
+        try {
+            const sessionStartHook = (await isClaudeCodeInstallation(deps))
+                ? { pinnedVersion: target.version }
+                : undefined;
+            reportUpgradePermissions(await deps.applyBridgePermissions(deps.cwd, deps.env ?? {}, sessionStartHook), stdout, stderr);
+        }
+        catch {
+            stderr("Warning: could not write Bridge's permission rules (non-fatal).");
+        }
+    }
+    const applicableStandard = [
+        ...verified.filter(isApplicableStandardLauncher),
+        ...(codexVerified && isApplicableStandardLauncher(codexVerified) ? [codexVerified] : []),
+    ];
+    const everyAction = [...initResult.configActions, ...(codexAction ? [codexAction] : [])];
+    if (isEveryLauncherAlreadyCurrent(everyAction)) {
         // The exact string `/upgrade-bridge` is contracted to relay verbatim.
         stdout("\nAlready up-to-date.");
     }
@@ -507,13 +830,71 @@ export async function runUpgradeCli(argv, injected) {
     }
     else {
         stdout(`\nUpgrade complete: launcher pins are at ${target.version}.`);
-        // The running session still holds the OLD MCP connection — MCP config is only
-        // read at session startup, so a launcher repin does not hot-reload it. Tell the
-        // user the concrete action instead of spawning a fresh session for them.
-        stdout("Reload your MCP now (run /mcp) or restart your session to pick up the upgraded server.");
+        // Running sessions still hold the OLD MCP connection — MCP config is only read
+        // at session startup, so a launcher repin does not hot-reload it. Name the
+        // concrete action for each host whose configuration actually changed, from the
+        // registry's own hints and in its order.
+        const changedHosts = new Set();
+        for (const action of initResult.configActions) {
+            if (!CHANGED_ACTION_KINDS.has(action.kind))
+                continue;
+            const id = hostIdForRelPath(action.relPath);
+            if (id)
+                changedHosts.add(id);
+        }
+        if (codexAction && CHANGED_ACTION_KINDS.has(codexAction.kind))
+            changedHosts.add(codex.hostId);
+        for (const line of reloadGuidanceLines(changedHosts))
+            stdout(line);
     }
     return 0;
 }
+/** Planned actions that change a configuration and so warrant reload guidance. */
+const PLANNED_CHANGE_ACTIONS = new Set([
+    "repin",
+    "normalize-unpinned",
+    "add",
+    "create",
+]);
+/** Real-run action kinds that changed a configuration. */
+const CHANGED_ACTION_KINDS = new Set([
+    "repinned",
+    "normalized",
+    "added",
+    "created",
+]);
+/** Render the project permission result in upgrade's own report style. */
+export function reportUpgradePermissions(result, stdout, stderr) {
+    if (result.hook) {
+        // Reported on its own, so a refused launcher or a malformed hooks structure
+        // never hides, or is hidden by, the permission-rule result.
+        const described = describeSessionStartHookOutcome(result.hook);
+        for (const line of described.lines)
+            stdout(line);
+        for (const warning of described.warnings)
+            stderr(`Warning: ${warning}.`);
+    }
+    if (!result.launcher.ok) {
+        stderr(`Warning: Bridge permission rules were not written: ${result.launcher.reason}.`);
+        return;
+    }
+    const scope = result.project;
+    if (scope.status === "written" || scope.status === "unchanged") {
+        stdout(`Bridge permission rules (${scope.path}, launcher ${result.launcher.prefix}):`);
+        if (scope.inserted.length === 0 && scope.removedStale.length === 0) {
+            stdout(`  all ${scope.alreadyPresent.length} rules already present.`);
+        }
+        for (const rule of scope.inserted)
+            stdout(`  wrote ${rule}`);
+        for (const rule of scope.removedStale)
+            stdout(`  removed stale ${rule}`);
+        return;
+    }
+    if (scope.status === "malformed" || scope.status === "io-error") {
+        stderr(`Warning: ${scope.path} ${scope.status === "malformed" ? "is not valid JSON settings and was left unchanged" : "could not be written"}; ` +
+            `${scope.skipped.length} Bridge permission rule(s) were not written.`);
+    }
+}
 /**
  * Project pre-mutation inspections onto the action shape `isEveryLauncherAlreadyCurrent`
  * consumes, so the dry run answers the currentness question exactly the way the

package/build/version.generated.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED — do not edit manually. Regenerate with: npm run build
-export const VERSION = "0.2.67";
-export const BUILD_COMMIT = "8eb6ba563e5f";
-export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.67", "serve"];
+export const VERSION = "0.2.69";
+export const BUILD_COMMIT = "5279e5545a81";
+export const LAUNCHER_ARGS = ["-y", "--prefer-offline", "@bridge_gpt/mcp-server@0.2.69", "serve"];

package/build/worker-guard-hook-bin.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
-import{readFileSync}from"node:fs";import path from"node:path";var WORKER_GUARD_REASON_PREFIX="bridge worker guard",WORKER_GUARD_MALFORMED_LINE=`${WORKER_GUARD_REASON_PREFIX}: payload could not be read; continuing fail-open`;function renderWorkerGuardReason(category,family){return category==="git-ambiguous"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This shell form cannot be safely resolved: substitution, redirection, or stdin-fed arguments hide what git will run. Use literal arguments instead; for a commit message, write it to a file and run git commit -F <file>.`:category==="workflow-entry"||category==="workflow-launch-skill"||category==="workflow-launch-shell"||category==="workflow-planner-tool"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). A correction worker must not start a full workflow. Reading or editing files that mention a workflow is allowed; make the focused correction directly.`:category==="correction-context-invalid"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). The correction context for this worker is not valid, so no tool call can be checked. Stop and report the launch problem.`:category==="correction-payload-invalid"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). The tool call could not be read as a tool name with a tool input, so it cannot be checked. Retry with a well-formed call.`:`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This command family is restricted to the worker's own branch, worktree, and read-only network access. Use a different approach and continue.`}var UNSAFE_UNQUOTED=new Set(["$","`",">","<"]),SEPARATORS=new Set([";","|","&"]);function tokenizeShellCommand(command){let commands=[],argv=[],current="",hasCurrent=!1,unsafe=!1,endToken=()=>{hasCurrent&&(argv.push(current),current="",hasCurrent=!1)},endCommand=()=>{endToken(),(argv.length>0||unsafe)&&commands.push({argv,unsafe}),argv=[],unsafe=!1};for(let i=0;i<command.length;i+=1){let ch=command[i];if(ch==="\\"){let next=command[i+1];next!==void 0&&(current+=next,hasCurrent=!0,i+=1);continue}if(ch==="'"){let close=command.indexOf("'",i+1);if(close===-1){unsafe=!0,current+=command.slice(i+1),hasCurrent=!0;break}current+=command.slice(i+1,close),hasCurrent=!0,i=close;continue}if(ch==='"'){let j=i+1,body="",closed=!1;for(;j<command.length;){let c=command[j];if(c==="\\"&&j+1<command.length){body+=command[j+1],j+=2;continue}if(c==='"'){closed=!0;break}(c==="$"||c==="`")&&(unsafe=!0),body+=c,j+=1}closed||(unsafe=!0),current+=body,hasCurrent=!0,i=j;continue}if(UNSAFE_UNQUOTED.has(ch)){unsafe=!0,current+=ch,hasCurrent=!0;continue}if(SEPARATORS.has(ch)){endCommand();continue}if(ch===`
-`){endCommand();continue}if(ch===" "||ch==="	"||ch==="\r"){endToken();continue}current+=ch,hasCurrent=!0}return endCommand(),commands}var WORKER_GUARD_MAX_PAYLOAD_BYTES=1e6;function asRecord(value){return value!==null&&typeof value=="object"&&!Array.isArray(value)?value:void 0}function isInside(root,candidate){let rel=path.relative(root,candidate);return rel===""?!0:rel.startsWith("..")?!1:!path.isAbsolute(rel)}function resolveEffectiveCwd(ctx,payloadCwd){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root))return;let normalizedRoot=path.resolve(root);if(payloadCwd===void 0)return normalizedRoot;if(typeof payloadCwd!="string"||payloadCwd.length===0)return;let resolved=path.isAbsolute(payloadCwd)?path.resolve(payloadCwd):path.resolve(normalizedRoot,payloadCwd);return isInside(normalizedRoot,resolved)?resolved:void 0}function allTargetsContained(ctx,cwd,targets){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root)||cwd===void 0)return!1;let normalizedRoot=path.resolve(root);return targets.every(target=>{if(target.length===0||target==="~"||target.startsWith("~/"))return!1;let resolved=path.isAbsolute(target)?path.resolve(target):path.resolve(cwd,target);return isInside(normalizedRoot,resolved)})}function parseGitInvocation(argv,baseCwd){let cwd=baseCwd,unsafe=!1,i=1;for(;i<argv.length;){let token=argv[i];if(token==="-C"){let dir=argv[i+1];dir===void 0||cwd===void 0?(unsafe=!0,cwd=void 0):cwd=path.isAbsolute(dir)?path.resolve(dir):path.resolve(cwd,dir),i+=2;continue}if(token==="-c"||token==="--namespace"||token==="--git-dir"||token==="--work-tree"){unsafe=!0,i+=2;continue}if(token.startsWith("-")){i+=1;continue}break}return{subcommand:argv[i]??"",args:argv.slice(i+1),cwd,unsafe}}function isOwnBranchDestination(destination,workerBranch){let colon=destination.indexOf(":"),dst=colon===-1?destination:destination.slice(colon+1);if(dst.length===0)return!1;let bare=dst.startsWith("+")?dst.slice(1):dst;return bare===workerBranch||bare===`refs/heads/${workerBranch}`}function evaluateGitPush(args,ctx){let deny={kind:"deny",category:"git-push",family:"git"},positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}if(token.startsWith("-")){if(token==="--tags"||token==="--delete"||token==="-d"||token==="--mirror"||token==="--all"||token==="--follow-tags"||token.startsWith("--repo"))return deny;(token==="-o"||token==="--push-option"||token==="--receive-pack"||token==="--exec")&&(i+=1);continue}positional.push(token)}let workerBranch=ctx.workerBranch;return typeof workerBranch!="string"||workerBranch.length===0?deny:positional.length<=1?{kind:"allow"}:positional.slice(1).every(d=>isOwnBranchDestination(d,workerBranch))?{kind:"allow"}:deny}function evaluateGitReset(args,ctx){let deny={kind:"deny",category:"git-reset-hard",family:"git"};if(!args.includes("--hard"))return{kind:"allow"};let positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}token.startsWith("-")||positional.push(token)}if(positional.length===0)return{kind:"allow"};let workerBranch=ctx.workerBranch;if(typeof workerBranch!="string"||workerBranch.length===0)return deny;let allowed=new Set([workerBranch,`origin/${workerBranch}`,`refs/heads/${workerBranch}`,`refs/remotes/origin/${workerBranch}`]);return positional.every(ref=>allowed.has(ref))?{kind:"allow"}:deny}function evaluateGitClean(args,ctx,cwd){let deny={kind:"deny",category:"filesystem-clean",family:"git"};if(cwd===void 0||!allTargetsContained(ctx,cwd,[cwd]))return deny;let pathspecs=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){pathspecs.push(...args.slice(i+1));break}if(token==="-e"||token==="--exclude"){i+=1;continue}token.startsWith("-")||pathspecs.push(token)}return pathspecs.length===0?{kind:"allow"}:allTargetsContained(ctx,cwd,pathspecs)?{kind:"allow"}:deny}function isRecursiveForcedRemove(args){let recursive=!1,force=!1;for(let token of args){if(token==="--")break;if(token==="--recursive")recursive=!0;else if(token==="--force")force=!0;else{if(token.startsWith("--"))continue;if(token.startsWith("-")&&token.length>1)for(let flag of token.slice(1))(flag==="r"||flag==="R")&&(recursive=!0),flag==="f"&&(force=!0)}}return recursive&&force}function evaluateRemove(argv,ctx,cwd){let deny={kind:"deny",category:"filesystem-remove",family:"rm"},args=argv.slice(1);if(!isRecursiveForcedRemove(args))return{kind:"allow"};let targets=[],sawDoubleDash=!1;for(let token of args){if(!sawDoubleDash&&token==="--"){sawDoubleDash=!0;continue}!sawDoubleDash&&token.startsWith("-")&&token.length>1||targets.push(token)}return targets.length===0?deny:allTargetsContained(ctx,cwd,targets)?{kind:"allow"}:deny}function isDatabaseCommand(executable){let base=path.basename(executable);return base==="psql"||base.startsWith("pg_")}var DESTRUCTIVE_SQL=/\b(?:DROP|TRUNCATE)\b/i;function evaluateDatabase(argv){let deny={kind:"deny",category:"database-destructive",family:"psql"};return argv.slice(1).some(arg=>DESTRUCTIVE_SQL.test(arg))?deny:{kind:"allow"}}var MUTATING_METHODS=new Set(["POST","PUT","PATCH","DELETE"]);function evaluateNetwork(argv){let deny={kind:"deny",category:"network-mutating",family:"curl"},base=path.basename(argv[0]??""),args=argv.slice(1);for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="-X"||token==="--request"||token==="--method"){let value=args[i+1];if(value===void 0||MUTATING_METHODS.has(value.toUpperCase()))return deny;i+=1;continue}if(token.startsWith("-X")&&token.length>2){if(MUTATING_METHODS.has(token.slice(2).toUpperCase()))return deny;continue}if(token.startsWith("--request=")||token.startsWith("--method=")){let value=token.slice(token.indexOf("=")+1);if(MUTATING_METHODS.has(value.toUpperCase()))return deny;continue}if(token==="--data"||token.startsWith("--data=")||token.startsWith("--data-")||token==="--form"||token==="-F"||token==="--upload-file"||token==="-T"||token==="--post-data"||token.startsWith("--post-data=")||token==="--post-file"||token.startsWith("--post-file=")||token==="--body-data"||token.startsWith("--body-data=")||token==="--body-file"||token.startsWith("--body-file=")||base==="curl"&&token==="-d")return deny}return{kind:"allow"}}function classify(executable){let base=path.basename(executable);return base==="git"?"git":base==="rm"?"rm":isDatabaseCommand(base)?"database":base==="curl"||base==="wget"?"network":null}function unsafeGitCategory(argv){let{subcommand}=parseGitInvocation(argv,void 0);return subcommand==="push"?"git-push":subcommand==="reset"?"git-reset-hard":subcommand==="clean"?"filesystem-clean":"git-ambiguous"}function unsafeSegmentDecision(family,argv){switch(family){case"git":return{kind:"deny",category:unsafeGitCategory(argv),family:"git"};case"rm":return{kind:"deny",category:"filesystem-remove",family:"rm"};case"database":return{kind:"deny",category:"database-destructive",family:"psql"};case"network":return{kind:"deny",category:"network-mutating",family:"curl"}}}var TRANSPARENT_PREFIXES=new Set(["sudo","env","command","nohup","time","nice","exec"]),STDIN_ARGUMENT_PREFIXES=new Set(["xargs"]),SHELL_EXECUTABLES=new Set(["sh","bash","zsh","dash","ksh"]),EVAL_BUILTINS=new Set(["eval"]);function unwrapTransparentPrefixes(argv){let rest=argv;for(let depth=0;depth<8;depth+=1){let head=rest[0];if(head===void 0||!TRANSPARENT_PREFIXES.has(path.basename(head)))return rest;let i=1;for(;i<rest.length;){let token=rest[i];if(path.basename(head)==="env"&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)){i+=1;continue}if(token.startsWith("-")){i+=1;continue}break}rest=rest.slice(i)}return rest}function stripStdinPrefixOptions(argv){let VALUE_OPTS=new Set(["-I","-i","-L","-n","-P","-s","-d","-E","-e","-a","--replace","--max-lines","--max-args","--max-procs","--max-chars","--delimiter","--eof","--arg-file"]),i=1;for(;i<argv.length;){let token=argv[i];if(token==="--"){i+=1;break}if(!token.startsWith("-"))break;if(token.includes("=")){i+=1;continue}i+=VALUE_OPTS.has(token)?2:1}return argv.slice(i)}var WORKFLOW_NAMES="implement-ticket|plan-ticket|idea-to-pr|review-and-implement",WORKFLOW_SLASH_LAUNCH=new RegExp(`(?:^|\\s)/(?:bridge-)?(?:${WORKFLOW_NAMES})(?=\\s|$)`,"i"),WORKFLOW_NAME_EXACT=new RegExp(`^/?(?:[A-Za-z0-9_-]+:)?(?:bridge-)?(?:${WORKFLOW_NAMES})$`,"i"),CLAUDE_PACKAGE_TOKEN=/^(?:@anthropic-ai\/)?claude(?:-code)?(?:@\S+)?$/;function claudeLaunchArgs(argv){let base=path.basename(argv[0]??"");if(base==="claude")return argv.slice(1);if(base==="npx"){let index=argv.findIndex((token,i)=>i>0&&CLAUDE_PACKAGE_TOKEN.test(token));return index===-1?void 0:argv.slice(index+1)}}function isClaudeWorkflowPrintLaunch(segment){let args=claudeLaunchArgs(segment.argv);return args===void 0||!args.some(token=>token==="-p"||token==="--print"||token.startsWith("--print="))?!1:segment.unsafe?!0:args.some(token=>{let value=token.startsWith("--print=")?token.slice(8):token;return WORKFLOW_SLASH_LAUNCH.test(value)})}function evaluateSimpleCommand(segment,ctx,payloadCwd,depth=0,stdinFed=!1){let argv=unwrapTransparentPrefixes(segment.argv),executable=argv[0];if(executable===void 0)return{kind:"allow"};if(SHELL_EXECUTABLES.has(path.basename(executable))&&depth<4){let cIndex=argv.findIndex(t=>t==="-c"),inner=cIndex===-1?void 0:argv[cIndex+1];if(inner!==void 0){for(let nested of tokenizeShellCommand(inner)){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}}if(EVAL_BUILTINS.has(path.basename(executable))&&depth<4){for(let nested of tokenizeShellCommand(argv.slice(1).join(" "))){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed);if(decision.kind==="deny")return decision}return{kind:"allow"}}if(STDIN_ARGUMENT_PREFIXES.has(path.basename(executable))&&depth<4){let rest=stripStdinPrefixOptions(argv);return rest.length===0?{kind:"allow"}:evaluateSimpleCommand({argv:rest,unsafe:segment.unsafe},ctx,payloadCwd,depth+1,!0)}if(segment={argv,unsafe:segment.unsafe},ctx.correctionEnforced&&isClaudeWorkflowPrintLaunch(segment))return{kind:"deny",category:"workflow-launch-shell",family:"workflow"};let family=classify(executable);if(family===null)return{kind:"allow"};if(stdinFed||segment.unsafe)return unsafeSegmentDecision(family,segment.argv);let cwd=resolveEffectiveCwd(ctx,payloadCwd);if(family==="rm")return evaluateRemove(segment.argv,ctx,cwd);if(family==="database")return evaluateDatabase(segment.argv);if(family==="network")return evaluateNetwork(segment.argv);let git=parseGitInvocation(segment.argv,cwd);return git.subcommand==="push"?git.unsafe?{kind:"deny",category:"git-push",family:"git"}:evaluateGitPush(git.args,ctx):git.subcommand==="reset"?git.unsafe?{kind:"deny",category:"git-reset-hard",family:"git"}:evaluateGitReset(git.args,ctx):git.subcommand==="clean"?git.unsafe?{kind:"deny",category:"filesystem-clean",family:"git"}:evaluateGitClean(git.args,ctx,git.cwd):{kind:"allow"}}function workflowDeny(category){return{kind:"deny",category,family:"workflow"}}var FILE_TOOLS=new Set(["Read","Edit","Write","MultiEdit","NotebookEdit","Grep","Glob"]),INVOCATION_FIELDS={Skill:["skill","args"],Task:["prompt","description"],Agent:["prompt","description"],SlashCommand:["command"]},PLANNER_TOOL_NAME=/(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;function evaluateCorrectionToolRole(toolName,input){if(FILE_TOOLS.has(toolName))return{kind:"allow"};if(toolName==="Bash")return;let fields=INVOCATION_FIELDS[toolName];if(fields!==void 0){for(let field of fields){let value=input[field];if(value===void 0)continue;if(typeof value!="string")return workflowDeny("workflow-launch-skill");let nameField=toolName==="Skill"?field==="skill":toolName==="SlashCommand";if(WORKFLOW_SLASH_LAUNCH.test(value)||nameField&&WORKFLOW_NAME_EXACT.test(value.trim().split(/\s+/)[0]??""))return workflowDeny("workflow-launch-skill")}return{kind:"allow"}}if(/^mcp__/i.test(toolName)&&PLANNER_TOOL_NAME.test(toolName))return workflowDeny("workflow-planner-tool");let args=Object.values(input).filter(v=>typeof v=="string").join(" ");return WORKFLOW_SLASH_LAUNCH.test(args)?workflowDeny("workflow-entry"):void 0}function evaluateWorkerGuardPayload(payload,ctx){if(ctx.correctionContextInvalid)return workflowDeny("correction-context-invalid");let root=asRecord(payload);if(root===void 0)return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let toolName=root.tool_name??root.toolName;if(typeof toolName!="string")return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let input=asRecord(root.tool_input??root.toolInput);if(ctx.correctionEnforced){if(input===void 0)return workflowDeny("correction-payload-invalid");let decision=evaluateCorrectionToolRole(toolName,input);if(decision!==void 0)return decision}if(toolName!=="Bash")return{kind:"allow"};if(input===void 0)return{kind:"malformed"};let command=input.command;if(typeof command!="string")return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let rawCwd=root.cwd??input.cwd,payloadCwd=typeof rawCwd=="string"?rawCwd:void 0;for(let segment of tokenizeShellCommand(command)){let decision=evaluateSimpleCommand(segment,ctx,payloadCwd);if(decision.kind==="deny")return decision}return{kind:"allow"}}function evaluateWorkerGuardInput(raw,ctx){let unreadable=()=>ctx.correctionContextInvalid?workflowDeny("correction-context-invalid"):ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};if(typeof raw!="string"||raw.length>WORKER_GUARD_MAX_PAYLOAD_BYTES||raw.trim().length===0)return unreadable();let parsed;try{parsed=JSON.parse(raw)}catch{return unreadable()}try{return evaluateWorkerGuardPayload(parsed,ctx)}catch{return unreadable()}}var WORKER_GUARD_ROOT_FLAG="--worktree-root";function resolveWorkerGuardContext(env,cwd,argv=[]){let ctx={},root;for(let i=0;i<argv.length;i+=1){if(argv[i]===WORKER_GUARD_ROOT_FLAG){root=argv[i+1];break}if(argv[i].startsWith(`${WORKER_GUARD_ROOT_FLAG}=`)){root=argv[i].slice(WORKER_GUARD_ROOT_FLAG.length+1);break}}root===void 0&&typeof cwd=="string"&&(root=cwd),typeof root=="string"&&path.isAbsolute(root)&&(ctx.worktreePath=path.resolve(root));let branch=env.BAPI_WORKER_BRANCH;typeof branch=="string"&&branch.trim().length>0&&(ctx.workerBranch=branch.trim());let flagIndex=argv.indexOf("--correction-intent-version"),flagValue=flagIndex>=0?argv[flagIndex+1]:void 0,envValue=env.BAPI_CORRECTION_INTENT_VERSION;return ctx.correctionEnforced=flagValue==="1"||envValue==="1",ctx.correctionContextInvalid=flagIndex>=0&&flagValue!=="1"||envValue!==void 0&&envValue!=="1"||flagIndex>=0&&envValue!==void 0&&envValue!==flagValue,ctx}function runWorkerGuardHook(io){let exitCode=0,correctionRequested=io.argv.includes("--correction-intent-version")||io.env.BAPI_CORRECTION_INTENT_VERSION!==void 0;try{let raw=io.readStdin(),ctx=resolveWorkerGuardContext(io.env,io.cwd,io.argv),decision=evaluateWorkerGuardInput(raw,ctx);decision.kind==="deny"?(io.writeStderr(renderWorkerGuardReason(decision.category,decision.family)),exitCode=2):decision.kind==="malformed"&&(io.writeStderr(WORKER_GUARD_MALFORMED_LINE),exitCode=0)}catch{try{io.writeStderr(correctionRequested?renderWorkerGuardReason("correction-payload-invalid","workflow"):WORKER_GUARD_MALFORMED_LINE)}catch{}exitCode=correctionRequested?2:0}return exitCode}function readStdinSync(){return readFileSync(0,"utf-8")}process.exit(runWorkerGuardHook({readStdin:readStdinSync,env:process.env,cwd:process.cwd(),argv:process.argv.slice(2),writeStderr:text=>{process.stderr.write(`${text}
+import{readFileSync}from"node:fs";import path from"node:path";var WORKER_GUARD_REASON_PREFIX="bridge worker guard",WORKER_GUARD_MALFORMED_LINE=`${WORKER_GUARD_REASON_PREFIX}: payload could not be read; continuing fail-open`;function renderWorkerGuardReason(category,family,form){if(category==="git-ambiguous")return`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This shell form cannot be safely resolved: substitution, redirection, or stdin-fed arguments hide what git will run. Use literal arguments instead; for a commit message, write it to a file and run git commit -F <file>.`;if(form==="shell_form"){let pattern=category==="git-push"?"If the destination is your own branch and no force is used, run git push origin HEAD:<your work branch> alone.":category==="git-reset-hard"?"If resetting your own branch, run git reset --hard origin/<your work branch> alone.":category==="filesystem-clean"?"If all pathspecs are inside your worktree, run git clean with literal worktree-contained pathspecs alone.":category==="filesystem-remove"?"If all paths are inside your worktree, run rm with literal worktree-contained paths alone.":"If arguments are read-only, run literal read-only arguments alone, without redirects or $VAR.";return`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). Shell form cannot be checked: redirects, pipes, substitution, or stdin-fed arguments. `+pattern}let restriction={"git-push":"Push only to your own branch, without force. Use HEAD:<your work branch> as the destination.","git-reset-hard":"Hard reset only against your own branch ref.","filesystem-clean":"Clean only literal paths inside your worktree.","filesystem-remove":"Remove only literal paths inside your worktree.","database-destructive":"Destructive SQL is prohibited. Use read-only database arguments.","network-mutating":"Mutating requests are prohibited. Use read-only network arguments."};return restriction[category]?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). ${restriction[category]}`:category==="workflow-entry"||category==="workflow-launch-skill"||category==="workflow-launch-shell"||category==="workflow-planner-tool"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). A correction worker must not start a full workflow. Reading or editing files that mention a workflow is allowed; make the focused correction directly.`:category==="correction-context-invalid"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). The correction context for this worker is not valid, so no tool call can be checked. Stop and report the launch problem.`:category==="correction-payload-invalid"?`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). The tool call could not be read as a tool name with a tool input, so it cannot be checked. Retry with a well-formed call.`:`${WORKER_GUARD_REASON_PREFIX}: denied ${family} (${category}). This command family is restricted to the worker's own branch, worktree, and read-only network access. Use a different approach and continue.`}var UNSAFE_UNQUOTED=new Set(["$","`",">","<"]),SEPARATORS=new Set([";","|","&"]);function tokenizeShellCommand(command){let commands=[],argv=[],current="",hasCurrent=!1,unsafe=!1,endToken=()=>{hasCurrent&&(argv.push(current),current="",hasCurrent=!1)},endCommand=()=>{endToken(),(argv.length>0||unsafe)&&commands.push({argv,unsafe}),argv=[],unsafe=!1};for(let i=0;i<command.length;i+=1){let ch=command[i];if(ch==="\\"){let next=command[i+1];next!==void 0&&(current+=next,hasCurrent=!0,i+=1);continue}if(ch==="'"){let close=command.indexOf("'",i+1);if(close===-1){unsafe=!0,current+=command.slice(i+1),hasCurrent=!0;break}current+=command.slice(i+1,close),hasCurrent=!0,i=close;continue}if(ch==='"'){let j=i+1,body="",closed=!1;for(;j<command.length;){let c=command[j];if(c==="\\"&&j+1<command.length){body+=command[j+1],j+=2;continue}if(c==='"'){closed=!0;break}(c==="$"||c==="`")&&(unsafe=!0),body+=c,j+=1}closed||(unsafe=!0),current+=body,hasCurrent=!0,i=j;continue}if(UNSAFE_UNQUOTED.has(ch)){unsafe=!0,current+=ch,hasCurrent=!0;continue}if(SEPARATORS.has(ch)){endCommand();continue}if(ch===`
+`){endCommand();continue}if(ch===" "||ch==="	"||ch==="\r"){endToken();continue}current+=ch,hasCurrent=!0}return endCommand(),commands}function diagnosticProjections(command){if(command.length>WORKER_GUARD_MAX_PAYLOAD_BYTES)return[];let result=[],start=0,masked="",quote="",uncertain=!1,finish=end=>{let original=tokenizeShellCommand(command.slice(start,end)),projected=tokenizeShellCommand(masked),value=!uncertain&&projected.length===1?{argv:projected[0].argv,complete:!projected[0].unsafe}:void 0;result.push(...original.map((_,i)=>i===0?value:void 0)),masked="",uncertain=!1,start=end+1};for(let i=0;i<command.length;i+=1){let ch=command[i];if(ch==="\\"&&quote!=="'"){masked+=command.slice(i,i+2),i+=1;continue}if(quote){masked+=ch,ch===quote&&(quote="");continue}if(ch==="'"||ch==='"'){quote=ch,masked+=ch;continue}if(ch===">"||ch==="<"){masked=masked.replace(/(^|\s)\d+$/,"$1");let j=i+1;for(command[j]===ch&&(j+=1),command[j]==="&"&&(j+=1);/[ \t]/.test(command[j]??"")&&j<command.length;)j+=1;let operandStart=j,operandQuote="";for(;j<command.length;){let c=command[j];if(c==="\\"&&operandQuote!=="'"){j+=2;continue}if(operandQuote){c===operandQuote&&(operandQuote=""),j+=1;continue}if(c==="'"||c==='"'){operandQuote=c,j+=1;continue}if(/[\s;|&<>]/.test(c))break;j+=1}(j===operandStart||operandQuote||command.slice(i,j).startsWith("<<"))&&(uncertain=!0),masked+=" ",i=j-1;continue}if(SEPARATORS.has(ch)||ch===`
+`){finish(i);continue}masked+=ch}return quote&&(uncertain=!0),finish(command.length),result}var WORKER_GUARD_MAX_PAYLOAD_BYTES=1e6;function asRecord(value){return value!==null&&typeof value=="object"&&!Array.isArray(value)?value:void 0}function isInside(root,candidate){let rel=path.relative(root,candidate);return rel===""?!0:rel.startsWith("..")?!1:!path.isAbsolute(rel)}function resolveEffectiveCwd(ctx,payloadCwd){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root))return;let normalizedRoot=path.resolve(root);if(payloadCwd===void 0)return normalizedRoot;if(typeof payloadCwd!="string"||payloadCwd.length===0)return;let resolved=path.isAbsolute(payloadCwd)?path.resolve(payloadCwd):path.resolve(normalizedRoot,payloadCwd);return isInside(normalizedRoot,resolved)?resolved:void 0}function allTargetsContained(ctx,cwd,targets){let root=ctx.worktreePath;if(typeof root!="string"||!path.isAbsolute(root)||cwd===void 0)return!1;let normalizedRoot=path.resolve(root);return targets.every(target=>{if(target.length===0||target==="~"||target.startsWith("~/"))return!1;let resolved=path.isAbsolute(target)?path.resolve(target):path.resolve(cwd,target);return isInside(normalizedRoot,resolved)})}function parseGitInvocation(argv,baseCwd){let cwd=baseCwd,unsafe=!1,i=1;for(;i<argv.length;){let token=argv[i];if(token==="-C"){let dir=argv[i+1];dir===void 0||cwd===void 0?(unsafe=!0,cwd=void 0):cwd=path.isAbsolute(dir)?path.resolve(dir):path.resolve(cwd,dir),i+=2;continue}if(token==="-c"||token==="--namespace"||token==="--git-dir"||token==="--work-tree"){unsafe=!0,i+=2;continue}if(token.startsWith("-")){i+=1;continue}break}return{subcommand:argv[i]??"",args:argv.slice(i+1),cwd,unsafe}}function isOwnBranchDestination(destination,workerBranch){let colon=destination.indexOf(":"),dst=colon===-1?destination:destination.slice(colon+1);if(dst.length===0)return!1;let bare=dst.startsWith("+")?dst.slice(1):dst;return bare===workerBranch||bare===`refs/heads/${workerBranch}`}function evaluateGitPush(args,ctx){let deny={kind:"deny",category:"git-push",family:"git"},positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}if(token.startsWith("-")){if(token==="--tags"||token==="--delete"||token==="-d"||token==="--mirror"||token==="--all"||token==="--follow-tags"||token.startsWith("--repo"))return deny;(token==="-o"||token==="--push-option"||token==="--receive-pack"||token==="--exec")&&(i+=1);continue}positional.push(token)}let workerBranch=ctx.workerBranch;return typeof workerBranch!="string"||workerBranch.length===0?deny:positional.length<=1?{kind:"allow"}:positional.slice(1).every(d=>isOwnBranchDestination(d,workerBranch))?{kind:"allow"}:deny}function evaluateGitReset(args,ctx){let deny={kind:"deny",category:"git-reset-hard",family:"git"};if(!args.includes("--hard"))return{kind:"allow"};let positional=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){positional.push(...args.slice(i+1));break}token.startsWith("-")||positional.push(token)}if(positional.length===0)return{kind:"allow"};let workerBranch=ctx.workerBranch;if(typeof workerBranch!="string"||workerBranch.length===0)return deny;let allowed=new Set([workerBranch,`origin/${workerBranch}`,`refs/heads/${workerBranch}`,`refs/remotes/origin/${workerBranch}`]);return positional.every(ref=>allowed.has(ref))?{kind:"allow"}:deny}function evaluateGitClean(args,ctx,cwd){let deny={kind:"deny",category:"filesystem-clean",family:"git"};if(cwd===void 0||!allTargetsContained(ctx,cwd,[cwd]))return deny;let pathspecs=[];for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="--"){pathspecs.push(...args.slice(i+1));break}if(token==="-e"||token==="--exclude"){i+=1;continue}token.startsWith("-")||pathspecs.push(token)}return pathspecs.length===0?{kind:"allow"}:allTargetsContained(ctx,cwd,pathspecs)?{kind:"allow"}:deny}function isRecursiveForcedRemove(args){let recursive=!1,force=!1;for(let token of args){if(token==="--")break;if(token==="--recursive")recursive=!0;else if(token==="--force")force=!0;else{if(token.startsWith("--"))continue;if(token.startsWith("-")&&token.length>1)for(let flag of token.slice(1))(flag==="r"||flag==="R")&&(recursive=!0),flag==="f"&&(force=!0)}}return recursive&&force}function evaluateRemove(argv,ctx,cwd){let deny={kind:"deny",category:"filesystem-remove",family:"rm"},args=argv.slice(1);if(!isRecursiveForcedRemove(args))return{kind:"allow"};let targets=[],sawDoubleDash=!1;for(let token of args){if(!sawDoubleDash&&token==="--"){sawDoubleDash=!0;continue}!sawDoubleDash&&token.startsWith("-")&&token.length>1||targets.push(token)}return targets.length===0?deny:allTargetsContained(ctx,cwd,targets)?{kind:"allow"}:deny}function isDatabaseCommand(executable){let base=path.basename(executable);return base==="psql"||base.startsWith("pg_")}var DESTRUCTIVE_SQL=/\b(?:DROP|TRUNCATE)\b/i;function evaluateDatabase(argv){let deny={kind:"deny",category:"database-destructive",family:"psql"};return argv.slice(1).some(arg=>DESTRUCTIVE_SQL.test(arg))?deny:{kind:"allow"}}var MUTATING_METHODS=new Set(["POST","PUT","PATCH","DELETE"]);function evaluateNetwork(argv){let deny={kind:"deny",category:"network-mutating",family:"curl"},base=path.basename(argv[0]??""),args=argv.slice(1);for(let i=0;i<args.length;i+=1){let token=args[i];if(token==="-X"||token==="--request"||token==="--method"){let value=args[i+1];if(value===void 0||MUTATING_METHODS.has(value.toUpperCase()))return deny;i+=1;continue}if(token.startsWith("-X")&&token.length>2){if(MUTATING_METHODS.has(token.slice(2).toUpperCase()))return deny;continue}if(token.startsWith("--request=")||token.startsWith("--method=")){let value=token.slice(token.indexOf("=")+1);if(MUTATING_METHODS.has(value.toUpperCase()))return deny;continue}if(token==="--data"||token.startsWith("--data=")||token.startsWith("--data-")||token==="--form"||token==="-F"||token==="--upload-file"||token==="-T"||token==="--post-data"||token.startsWith("--post-data=")||token==="--post-file"||token.startsWith("--post-file=")||token==="--body-data"||token.startsWith("--body-data=")||token==="--body-file"||token.startsWith("--body-file=")||base==="curl"&&token==="-d")return deny}return{kind:"allow"}}function classify(executable){let base=path.basename(executable);return base==="git"?"git":base==="rm"?"rm":isDatabaseCommand(base)?"database":base==="curl"||base==="wget"?"network":null}function unsafeGitCategory(argv){let{subcommand}=parseGitInvocation(argv,void 0);return subcommand==="push"?"git-push":subcommand==="reset"?"git-reset-hard":subcommand==="clean"?"filesystem-clean":"git-ambiguous"}function diagnosticPushForce(args){return args.some(t=>t==="--force"||t==="-f"||t==="--force-with-lease"||t.startsWith("--force-with-lease=")||t.startsWith("+"))}function diagnosticViolation(family,diagnostic,ctx,cwd){let full=unwrapTransparentPrefixes(diagnostic.argv),unknown=diagnostic.complete?-1:full.findIndex(t=>/[$`]/.test(t)),argv=unknown<0?full:full.slice(0,unknown);if(family==="database")return evaluateDatabase(argv).kind==="deny";if(family==="network")return evaluateNetwork(argv).kind==="deny";let git=parseGitInvocation(argv,cwd);return family==="git"&&git.subcommand==="push"&&diagnosticPushForce(git.args)?!0:diagnostic.complete?family==="rm"?evaluateRemove(argv,ctx,cwd).kind==="deny":git.unsafe?!0:git.subcommand==="push"?evaluateGitPush(git.args,ctx).kind==="deny":git.subcommand==="reset"?evaluateGitReset(git.args,ctx).kind==="deny":git.subcommand==="clean"?evaluateGitClean(git.args,ctx,git.cwd).kind==="deny":!1:family==="rm"?argv.slice(1).some(t=>!t.startsWith("-"))&&evaluateRemove(argv,ctx,cwd).kind==="deny":git.subcommand==="push"?git.args.filter(t=>!t.startsWith("-")).length>=2&&evaluateGitPush(git.args,ctx).kind==="deny":git.subcommand==="reset"?git.args.some(t=>!t.startsWith("-"))&&evaluateGitReset(git.args,ctx).kind==="deny":git.subcommand==="clean"?evaluateGitClean(git.args,ctx,git.cwd).kind==="deny":!1}function unsafeSegmentDecision(family,argv,ctx,cwd,diagnostic){let category=family==="git"?unsafeGitCategory(argv):family==="rm"?"filesystem-remove":family==="database"?"database-destructive":"network-mutating",decision={kind:"deny",category,family:family==="database"?"psql":family==="network"?"curl":family};return diagnostic&&category!=="git-ambiguous"&&!diagnosticViolation(family,diagnostic,ctx,cwd)?{...decision,form:"shell_form"}:decision}var TRANSPARENT_PREFIXES=new Set(["sudo","env","command","nohup","time","nice","exec"]),STDIN_ARGUMENT_PREFIXES=new Set(["xargs"]),SHELL_EXECUTABLES=new Set(["sh","bash","zsh","dash","ksh"]),EVAL_BUILTINS=new Set(["eval"]);function unwrapTransparentPrefixes(argv){let rest=argv;for(let depth=0;depth<8;depth+=1){let head=rest[0];if(head===void 0||!TRANSPARENT_PREFIXES.has(path.basename(head)))return rest;let i=1;for(;i<rest.length;){let token=rest[i];if(path.basename(head)==="env"&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)){i+=1;continue}if(token.startsWith("-")){i+=1;continue}break}rest=rest.slice(i)}return rest}function stripStdinPrefixOptions(argv){let VALUE_OPTS=new Set(["-I","-i","-L","-n","-P","-s","-d","-E","-e","-a","--replace","--max-lines","--max-args","--max-procs","--max-chars","--delimiter","--eof","--arg-file"]),i=1;for(;i<argv.length;){let token=argv[i];if(token==="--"){i+=1;break}if(!token.startsWith("-"))break;if(token.includes("=")){i+=1;continue}i+=VALUE_OPTS.has(token)?2:1}return argv.slice(i)}var WORKFLOW_NAMES="implement-ticket|plan-ticket|idea-to-pr|review-and-implement",WORKFLOW_SLASH_LAUNCH=new RegExp(`(?:^|\\s)/(?:bridge-)?(?:${WORKFLOW_NAMES})(?=\\s|$)`,"i"),WORKFLOW_NAME_EXACT=new RegExp(`^/?(?:[A-Za-z0-9_-]+:)?(?:bridge-)?(?:${WORKFLOW_NAMES})$`,"i"),CLAUDE_PACKAGE_TOKEN=/^(?:@anthropic-ai\/)?claude(?:-code)?(?:@\S+)?$/;function claudeLaunchArgs(argv){let base=path.basename(argv[0]??"");if(base==="claude")return argv.slice(1);if(base==="npx"){let index=argv.findIndex((token,i)=>i>0&&CLAUDE_PACKAGE_TOKEN.test(token));return index===-1?void 0:argv.slice(index+1)}}function isClaudeWorkflowPrintLaunch(segment){let args=claudeLaunchArgs(segment.argv);return args===void 0||!args.some(token=>token==="-p"||token==="--print"||token.startsWith("--print="))?!1:segment.unsafe?!0:args.some(token=>{let value=token.startsWith("--print=")?token.slice(8):token;return WORKFLOW_SLASH_LAUNCH.test(value)})}function evaluateSimpleCommand(segment,ctx,payloadCwd,depth=0,stdinFed=!1,diagnostic){let argv=unwrapTransparentPrefixes(segment.argv),executable=argv[0];if(executable===void 0)return{kind:"allow"};if(SHELL_EXECUTABLES.has(path.basename(executable))&&depth<4){let cIndex=argv.findIndex(t=>t==="-c"),inner=cIndex===-1?void 0:argv[cIndex+1];if(inner!==void 0){let projections=diagnostic?.complete?diagnosticProjections(inner):[];for(let[i,nested]of tokenizeShellCommand(inner).entries()){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed,projections[i]);if(decision.kind==="deny")return decision}return{kind:"allow"}}}if(EVAL_BUILTINS.has(path.basename(executable))&&depth<4){let inner=argv.slice(1).join(" "),projections=diagnostic?.complete?diagnosticProjections(inner):[];for(let[i,nested]of tokenizeShellCommand(inner).entries()){let decision=evaluateSimpleCommand(nested,ctx,payloadCwd,depth+1,stdinFed,projections[i]);if(decision.kind==="deny")return decision}return{kind:"allow"}}if(STDIN_ARGUMENT_PREFIXES.has(path.basename(executable))&&depth<4){let rest=stripStdinPrefixOptions(argv);return rest.length===0?{kind:"allow"}:evaluateSimpleCommand({argv:rest,unsafe:segment.unsafe},ctx,payloadCwd,depth+1,!0,diagnostic?{argv:stripStdinPrefixOptions(unwrapTransparentPrefixes(diagnostic.argv)),complete:!1}:void 0)}if(segment={argv,unsafe:segment.unsafe},ctx.correctionEnforced&&isClaudeWorkflowPrintLaunch(segment))return{kind:"deny",category:"workflow-launch-shell",family:"workflow"};let family=classify(executable);if(family===null)return{kind:"allow"};if(stdinFed||segment.unsafe)return unsafeSegmentDecision(family,segment.argv,ctx,resolveEffectiveCwd(ctx,payloadCwd),diagnostic);let cwd=resolveEffectiveCwd(ctx,payloadCwd);if(family==="rm")return evaluateRemove(segment.argv,ctx,cwd);if(family==="database")return evaluateDatabase(segment.argv);if(family==="network")return evaluateNetwork(segment.argv);let git=parseGitInvocation(segment.argv,cwd);return git.subcommand==="push"?git.unsafe?unsafeSegmentDecision("git",segment.argv,ctx,cwd,diagnostic):evaluateGitPush(git.args,ctx):git.subcommand==="reset"?git.unsafe?unsafeSegmentDecision("git",segment.argv,ctx,cwd,diagnostic):evaluateGitReset(git.args,ctx):git.subcommand==="clean"?git.unsafe?unsafeSegmentDecision("git",segment.argv,ctx,cwd,diagnostic):evaluateGitClean(git.args,ctx,git.cwd):{kind:"allow"}}function workflowDeny(category){return{kind:"deny",category,family:"workflow"}}var FILE_TOOLS=new Set(["Read","Edit","Write","MultiEdit","NotebookEdit","Grep","Glob"]),INVOCATION_FIELDS={Skill:["skill","args"],Task:["prompt","description"],Agent:["prompt","description"],SlashCommand:["command"]},PLANNER_TOOL_NAME=/(?:request_plan_generation|get_pipeline_recipe|plan_ticket|implement_ticket)/i;function evaluateCorrectionToolRole(toolName,input){if(FILE_TOOLS.has(toolName))return{kind:"allow"};if(toolName==="Bash")return;let fields=INVOCATION_FIELDS[toolName];if(fields!==void 0){for(let field of fields){let value=input[field];if(value===void 0)continue;if(typeof value!="string")return workflowDeny("workflow-launch-skill");let nameField=toolName==="Skill"?field==="skill":toolName==="SlashCommand";if(WORKFLOW_SLASH_LAUNCH.test(value)||nameField&&WORKFLOW_NAME_EXACT.test(value.trim().split(/\s+/)[0]??""))return workflowDeny("workflow-launch-skill")}return{kind:"allow"}}if(/^mcp__/i.test(toolName)&&PLANNER_TOOL_NAME.test(toolName))return workflowDeny("workflow-planner-tool");let args=Object.values(input).filter(v=>typeof v=="string").join(" ");return WORKFLOW_SLASH_LAUNCH.test(args)?workflowDeny("workflow-entry"):void 0}function evaluateWorkerGuardPayload(payload,ctx){if(ctx.correctionContextInvalid)return workflowDeny("correction-context-invalid");let root=asRecord(payload);if(root===void 0)return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let toolName=root.tool_name??root.toolName;if(typeof toolName!="string")return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let input=asRecord(root.tool_input??root.toolInput);if(ctx.correctionEnforced){if(input===void 0)return workflowDeny("correction-payload-invalid");let decision=evaluateCorrectionToolRole(toolName,input);if(decision!==void 0)return decision}if(toolName!=="Bash")return{kind:"allow"};if(input===void 0)return{kind:"malformed"};let command=input.command;if(typeof command!="string")return ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};let rawCwd=root.cwd??input.cwd,payloadCwd=typeof rawCwd=="string"?rawCwd:void 0,projections=diagnosticProjections(command);for(let[i,segment]of tokenizeShellCommand(command).entries()){let decision=evaluateSimpleCommand(segment,ctx,payloadCwd,0,!1,projections[i]);if(decision.kind==="deny")return decision}return{kind:"allow"}}function evaluateWorkerGuardInput(raw,ctx){let unreadable=()=>ctx.correctionContextInvalid?workflowDeny("correction-context-invalid"):ctx.correctionEnforced?workflowDeny("correction-payload-invalid"):{kind:"malformed"};if(typeof raw!="string"||raw.length>WORKER_GUARD_MAX_PAYLOAD_BYTES||raw.trim().length===0)return unreadable();let parsed;try{parsed=JSON.parse(raw)}catch{return unreadable()}try{return evaluateWorkerGuardPayload(parsed,ctx)}catch{return unreadable()}}var WORKER_GUARD_ROOT_FLAG="--worktree-root";function resolveWorkerGuardContext(env,cwd,argv=[]){let ctx={},root;for(let i=0;i<argv.length;i+=1){if(argv[i]===WORKER_GUARD_ROOT_FLAG){root=argv[i+1];break}if(argv[i].startsWith(`${WORKER_GUARD_ROOT_FLAG}=`)){root=argv[i].slice(WORKER_GUARD_ROOT_FLAG.length+1);break}}root===void 0&&typeof cwd=="string"&&(root=cwd),typeof root=="string"&&path.isAbsolute(root)&&(ctx.worktreePath=path.resolve(root));let branch=env.BAPI_WORKER_BRANCH;typeof branch=="string"&&branch.trim().length>0&&(ctx.workerBranch=branch.trim());let flagIndex=argv.indexOf("--correction-intent-version"),flagValue=flagIndex>=0?argv[flagIndex+1]:void 0,envValue=env.BAPI_CORRECTION_INTENT_VERSION;return ctx.correctionEnforced=flagValue==="1"||envValue==="1",ctx.correctionContextInvalid=flagIndex>=0&&flagValue!=="1"||envValue!==void 0&&envValue!=="1"||flagIndex>=0&&envValue!==void 0&&envValue!==flagValue,ctx}function runWorkerGuardHook(io){let exitCode=0,correctionRequested=io.argv.includes("--correction-intent-version")||io.env.BAPI_CORRECTION_INTENT_VERSION!==void 0;try{let raw=io.readStdin(),ctx=resolveWorkerGuardContext(io.env,io.cwd,io.argv),decision=evaluateWorkerGuardInput(raw,ctx);decision.kind==="deny"?(io.writeStderr(renderWorkerGuardReason(decision.category,decision.family,decision.form)),exitCode=2):decision.kind==="malformed"&&(io.writeStderr(WORKER_GUARD_MALFORMED_LINE),exitCode=0)}catch{try{io.writeStderr(correctionRequested?renderWorkerGuardReason("correction-payload-invalid","workflow"):WORKER_GUARD_MALFORMED_LINE)}catch{}exitCode=correctionRequested?2:0}return exitCode}function readStdinSync(){return readFileSync(0,"utf-8")}process.exit(runWorkerGuardHook({readStdin:readStdinSync,env:process.env,cwd:process.cwd(),argv:process.argv.slice(2),writeStderr:text=>{process.stderr.write(`${text}
 `)}}));

package/build/worker-guard-hook-main.js

@@ -20,7 +20,7 @@ export function runWorkerGuardHook(io) {
         const ctx = resolveWorkerGuardContext(io.env, io.cwd, io.argv);
         const decision = evaluateWorkerGuardInput(raw, ctx);
         if (decision.kind === "deny") {
-            io.writeStderr(renderWorkerGuardReason(decision.category, decision.family));
+            io.writeStderr(renderWorkerGuardReason(decision.category, decision.family, decision.form));
             exitCode = 2;
         }
         else if (decision.kind === "malformed") {