@fusengine/harness 0.1.88 → 0.1.90

package/dist/adapters/codex/index.mjs

@@ -1,7 +1,7 @@
 import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
 import { f as countLines } from "../../home-state-oUGFB4ds.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
-import { n as canonicalizeCodexShellTool, r as parseApplyPatch, t as isBypassPermissions } from "../../permission-mode-B0MUl7FT.mjs";
+import { i as parseApplyPatch, n as canonicalizeMcpToolName, r as canonicalizeCodexShellTool, t as isBypassPermissions } from "../../permission-mode-B-SFyR0X.mjs";
 import { _ as commandToString, c as readClaudeInput, i as denyResponse, r as contextResponse, s as informResponse } from "../../claude-5bC8TDAz.mjs";
 //#region src/adapters/codex/index.ts
 /**
@@ -51,7 +51,7 @@ function applyPatchPrompt(command) {
 function resolvePrompt(input) {
 	const i = input.tool_input;
 	const r = evaluate({
-		tool: canonicalizeCodexShellTool("codex", input.tool_name ?? "Write"),
+		tool: canonicalizeCodexShellTool("codex", canonicalizeMcpToolName("codex", input.tool_name ?? "Write")),
 		filePath: i?.file_path,
 		content: i?.content ?? i?.new_string,
 		command: commandToString(i?.command),

package/dist/cli/bin.mjs

@@ -3,9 +3,9 @@ import { o as resolveStdinMaxBytes } from "../limits-DG5pl-5s.mjs";
 import { c as resolveTtlSec, r as loadDotenv } from "../dotenv-BLBkBTww.mjs";
 import { t as detectHarness } from "../harness-BMuLJ9lm.mjs";
 import { t as claudeHome } from "../home-state-oUGFB4ds.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DdWG0Meg.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-CdIlUtjv.mjs";
 import { n as writeInitFile, t as initFor } from "../run-TAXNRSpD.mjs";
-import { $ as runningVersion, Q as runDoctor, Z as notify, et as versionBanner, i as respond, t as handleHook, zt as todayUtc } from "../handle-DHhukRdh.mjs";
+import { $ as runningVersion, Q as runDoctor, Z as notify, et as versionBanner, i as respond, t as handleHook, zt as todayUtc } from "../handle-CBaOcFZq.mjs";
 import { delimiter, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/cli/index.d.mts

@@ -1,7 +1,12 @@
 //#region src/cli/run.d.ts
 /** Staged files (Added/Copied/Modified/Renamed). Uses `node:child_process` (Bun shell can hang on `git show`). */
 declare function stagedFiles(): string[];
-/** Read a file's staged (index) content — not the working-tree version. */
+/**
+ * Read a file's staged (index) content — not the working-tree version.
+ * Uses `execFileSync` with an argv array (never a shell), so a staged
+ * filename containing shell metacharacters (backticks, `$(...)`, quotes)
+ * reaches `git show` as a single literal argument — see issue #87.
+ */
 declare function stagedContent(path: string): string;
 /**
  * Evaluate staged code files against the policy core; return violation blocks.

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-DdWG0Meg.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-CdIlUtjv.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/{handle-DHhukRdh.mjs → handle-CBaOcFZq.mjs}

@@ -14,7 +14,7 @@ import { a as nowStamp, l as throttleMs, n as readRoots, o as readState, s as se
 import { d as loadIndex, i as cacheLookupMeta, n as webfetchCacheWrite, o as cacheLookupSubstringMeta, t as mcpCacheWrite, u as extractText } from "./mcp-store-BkBDmuxN.mjs";
 import { t as loadRefs } from "./loader-AGz4nK7d.mjs";
 import { C as apexAuthorizationGate, S as trivialCount, _ as recordBrainstormRequired, a as journalLogPath, b as recordTarget, c as appendEvent, d as signTrack, f as verifyTrack, g as recordAgent, h as emptyTrack, i as withTrack, l as withTrackLockSync, m as agentsFresh, o as readTrackSync, p as writeLastNonce, r as trackJournalEnabled, s as diffTrackEvents, t as loadTrack, u as LOCK_FAILED, v as recordDoc, x as recordTrivialEdit, y as recordRefRead } from "./store-5-ZPKb0u.mjs";
-import { n as canonicalizeCodexShellTool, r as parseApplyPatch, t as isBypassPermissions } from "./permission-mode-B0MUl7FT.mjs";
+import { i as parseApplyPatch, n as canonicalizeMcpToolName, r as canonicalizeCodexShellTool, t as isBypassPermissions } from "./permission-mode-B-SFyR0X.mjs";
 import { _ as commandToString, d as collectFiles, f as pathExists, g as writeText, h as spawnCapture, i as denyResponse, l as systemMessage, m as sleep, n as blockResponse, p as readText$1, r as contextResponse, s as informResponse, t as attachSystemMessage } from "./claude-5bC8TDAz.mjs";
 import { i as toKimiResponse, n as kimiDenyResponse } from "./kimi-D6X7b8wF.mjs";
 import { r as toHermesResponse } from "./hermes-kP6NUQlG.mjs";
@@ -90,7 +90,7 @@ function normalizeEvent(id, payload) {
 	}
 	const event = str(payload.hook_event_name) ?? "";
 	const input = payload.tool_input ?? payload;
-	const tool = canonicalizeCodexShellTool(id, str(payload.tool_name) ?? "");
+	const tool = canonicalizeCodexShellTool(id, canonicalizeMcpToolName(id, str(payload.tool_name) ?? ""));
 	const base = {
 		phase: /post|after/i.test(event) ? "post" : "pre",
 		tool,
@@ -5326,8 +5326,13 @@ const RETRY_DELAYS = [
 	1e3,
 	2e3
 ];
-/** Extract the longest assistant synthesis + queried library ids from a transcript. */
-async function extractSynthesis(path) {
+/**
+* Extract the longest assistant synthesis + queried library ids from a transcript.
+* @param id - Harness adapter id, used to canonicalize `block.name` (Codex-mangled
+*   underscore tool names) before the {@link TOOL_PATTERN} match — see
+*   {@link cacheDocFromTranscript} for why this is a defensive, unconfirmed-case cover.
+*/
+async function extractSynthesis(path, id) {
 	const lines = readText$1(path).split("\n").filter(Boolean);
 	const libraries = [];
 	let synthesis = "";
@@ -5337,7 +5342,7 @@ async function extractSynthesis(path) {
 		const contents = entry?.message?.content;
 		if (!Array.isArray(contents)) continue;
 		for (const block of contents) {
-			if (block.type === "tool_use" && TOOL_PATTERN.test(block.name ?? "")) {
+			if (block.type === "tool_use" && TOOL_PATTERN.test(canonicalizeMcpToolName(id, block.name ?? ""))) {
 				const lib = block.input?.libraryId ?? block.input?.query ?? "";
 				if (lib && !libraries.includes(lib)) libraries.push(lib);
 			}
@@ -5354,17 +5359,28 @@ async function extractSynthesis(path) {
 * @param transcript - Path to the agent JSONL transcript.
 * @param cwd - Fallback project root.
 * @param home - Home dir (defaults to `~`).
-*/
-async function cacheDocFromTranscript(transcript, cwd, home = homedir()) {
+* @param id - Harness adapter id (defaults to "claude-code"). On `"codex"`,
+*   every `tool_use.name` read from the transcript is canonicalized before the
+*   {@link TOOL_PATTERN} match, defensively covering the SAME Codex-mangled
+*   underscore form as `doc-cache-gate.ts`'s `docCacheGate`. UNLIKE that gate,
+*   this is NOT a confirmed-reproduced bug: the proof that Codex emits the
+*   underscore form (`sanitize_responses_api_tool_name()`, openai/codex#14605,
+*   `SCENARIO_DASH_TOOL` in #18385) is about the live PreToolUse HOOK payload,
+*   never observed here against transcript `tool_use.name` content. The
+*   canonicalization is a no-op when the transcript already carries the dash
+*   form (idempotence proven in `test/mcp-tool-name.test.ts`, test 2), so this
+*   costs nothing if the hypothesis turns out false.
+*/
+async function cacheDocFromTranscript(transcript, cwd, home = homedir(), id = "claude-code") {
 	if (!transcript || !pathExists(transcript)) return;
 	const projPath = projectRootFromPaths(await transcriptFilePaths(transcript)) ?? process.env.CLAUDE_PROJECT_DIR ?? cwd;
 	const cacheDir = cacheDirFor("doc", projPath, home);
 	const docsDir = join(cacheDir, "docs");
-	let result = await extractSynthesis(transcript);
+	let result = await extractSynthesis(transcript, id);
 	for (const delay of RETRY_DELAYS) {
 		if (result.text.length >= MIN_TEXT_SIZE && result.libraries.length > 0) break;
 		await sleep(delay);
-		result = await extractSynthesis(transcript);
+		result = await extractSynthesis(transcript, id);
 	}
 	const { text, libraries } = result;
 	if (text.length < MIN_TEXT_SIZE || libraries.length === 0) return;
@@ -5762,10 +5778,14 @@ function libraryOf(payload) {
 * @param cwd - Fallback project root (uses `CLAUDE_PROJECT_DIR` first).
 * @param now - Clock (defaults to `Date.now()`).
 * @param home - Home dir (defaults to `~`).
+* @param id - Harness adapter id (defaults to "claude-code"); on `"codex"`,
+*   `payload.tool_name` is canonicalized before the {@link GATED_TOOLS} match
+*   so the Codex-mangled underscore form (`mcp__context7__query_docs`) gates
+*   exactly like the dash form does on every other harness.
 * @returns A native deny response, or `null` to fall through to the live call.
 */
-async function docCacheGate(payload, cwd, now = Date.now(), home = homedir()) {
-	const tool = String(payload.tool_name ?? "");
+async function docCacheGate(payload, cwd, now = Date.now(), home = homedir(), id = "claude-code") {
+	const tool = canonicalizeMcpToolName(id, String(payload.tool_name ?? ""));
 	if (!GATED_TOOLS.test(tool)) return null;
 	const library = libraryOf(payload);
 	if (!library) return null;
@@ -5981,11 +6001,11 @@ async function onSubagentStart(payload, cwd, now, home, id) {
 	const agent = agentTypeOf(payload);
 	return combineContext(await injectApexSubagentContext(cwd, home, id), await injectLessonsCache(cwd, home, now), await typeSpecificCache(agent, cwd, now, home));
 }
-/** SubagentStop routing: transcript-driven cache writers, then the universal SOLID check. */
-async function onSubagentStop(payload, cwd, home) {
+/** SubagentStop routing: transcript-driven cache writers, then the universal SOLID check. `id` selects the harness target (defaults to "claude-code"), threaded into `cacheDocFromTranscript`. */
+async function onSubagentStop(payload, cwd, home, id) {
 	const agent = agentTypeOf(payload);
 	const transcript = transcriptOf(payload);
-	if (agent.includes("research-expert")) await cacheDocFromTranscript(transcript, cwd, home);
+	if (agent.includes("research-expert")) await cacheDocFromTranscript(transcript, cwd, home, id);
 	if (agent.includes("sniper")) {
 		await cacheSniperLessons(transcript, cwd, home);
 		await cacheTestResults(transcript, cwd, home);
@@ -5999,12 +6019,12 @@ async function onSubagentStop(payload, cwd, home) {
 */
 async function dispatchAipilot(event, payload, cwd, now, home = homedir(), id = "claude-code") {
 	if (event === "SubagentStart") return onSubagentStart(payload, cwd, now, home, id);
-	if (event === "SubagentStop") return onSubagentStop(payload, cwd, home);
+	if (event === "SubagentStop") return onSubagentStop(payload, cwd, home, id);
 	if (event === "SessionEnd" || event === "Stop") {
 		await cacheAnalyticsSave(home, now);
 		return "";
 	}
-	if (event === "PreToolUse") return docCacheGate(payload, cwd, now, home);
+	if (event === "PreToolUse") return docCacheGate(payload, cwd, now, home, id);
 	return null;
 }
 /** PostToolUse (Write/Edit SOLID check, else TaskCreate/TaskUpdate sync) for the ai-pilot scope; `id` selects the harness target (defaults to "claude-code"). */

package/dist/permission-mode-B-SFyR0X.mjs

@@ -0,0 +1,226 @@
+//#region src/adapters/codex/apply-patch.ts
+const BEGIN = "*** Begin Patch";
+const END = "*** End Patch";
+const ADD = "*** Add File: ";
+const DEL = "*** Delete File: ";
+const UPD = "*** Update File: ";
+const MOVE = "*** Move to: ";
+const EOF = "*** End of File";
+const ENV = "*** Environment ID: ";
+/**
+* Parse a Codex freeform patch into its per-file changes. Lenient on whitespace
+* around structural markers (as Codex's own parser is); returns `[]` when no
+* recognizable hunk is present (malformed input fails open, not closed).
+* @param text - Raw patch body from `tool_input.command`.
+* @returns One {@link PatchedFile} per Add/Update/Delete hunk, in order.
+*/
+function parseApplyPatch(text) {
+	const files = [];
+	let cur = null;
+	let buf = [];
+	const flush = () => {
+		if (cur) {
+			cur.content = buf.join("\n");
+			files.push(cur);
+		}
+		cur = null;
+		buf = [];
+	};
+	for (const line of text.split("\n")) {
+		const marker = line.trimStart();
+		if (marker === BEGIN || marker.startsWith(ENV)) continue;
+		if (marker === END) {
+			flush();
+			continue;
+		}
+		if (marker.startsWith(ADD)) {
+			flush();
+			cur = {
+				path: marker.slice(14).trim(),
+				content: "",
+				op: "add"
+			};
+			continue;
+		}
+		if (marker.startsWith(DEL)) {
+			flush();
+			files.push({
+				path: marker.slice(17).trim(),
+				content: "",
+				op: "delete"
+			});
+			continue;
+		}
+		if (marker.startsWith(UPD)) {
+			flush();
+			cur = {
+				path: marker.slice(17).trim(),
+				content: "",
+				op: "update"
+			};
+			continue;
+		}
+		if (marker.startsWith(MOVE)) {
+			if (cur) cur.path = marker.slice(13).trim();
+			continue;
+		}
+		if (marker === EOF || !cur) continue;
+		if (cur.op === "add") {
+			if (line.startsWith("+")) buf.push(line.slice(1));
+			continue;
+		}
+		if (line.startsWith("@@")) continue;
+		if (line.startsWith("+")) buf.push(line.slice(1));
+		else if (line.startsWith("-")) continue;
+		else buf.push(line.startsWith(" ") ? line.slice(1) : line);
+	}
+	flush();
+	return files;
+}
+//#endregion
+//#region src/runtime/codex-shell-tool.ts
+/**
+* @module codex-shell-tool
+* Canonicalizes a Codex-only shell `tool_name` alias to `"Bash"`, so every
+* existing `tool === "Bash"` consumer (activity credit, explore-tools
+* classification, the protected-path guard, the design corpus read gate, …)
+* treats a Code Mode exec dispatch exactly like a native Bash call — no
+* per-consumer change needed.
+*
+* A Code Mode-wrapped call (`functions.exec` -> `tools.exec_command(...)`)
+* surfaces via the generic `CoreToolRuntime` hook default (openai/codex#23757,
+* commit 5c20513), which keeps the raw function-tool name `"exec_command"`
+* verbatim — unlike a DIRECT `exec_command` dispatch, which
+* `ExecCommandHandler`'s own `pre_tool_use_payload` override re-labels
+* `"Bash"` (`tool_name: HookToolName::bash()`). This is the exact call chain
+* a real Codex CLI 0.146.0 session was observed emitting for a `sed -n` skill
+* read. Only ONE alias is confirmed here — `ToolName::plain("exec_command")`
+* in `core/src/tools/handlers/unified_exec/exec_command.rs`; `shell`,
+* `unified_exec`, `local_shell`, and `shell_command` were audited but not
+* evidenced as a distinct hook `tool_name` value, so they are deliberately
+* left out rather than guessed.
+* @packageDocumentation
+*/
+/** Codex `tool_name` values that are a shell execution but not literally `"Bash"`. */
+const CODEX_SHELL_TOOL_ALIASES = /* @__PURE__ */ new Set(["exec_command"]);
+/**
+* Canonicalize a Codex-only shell tool alias to `"Bash"`. Scoped to
+* `id === "codex"` — every other harness id, and every non-aliased tool
+* name, passes through unchanged (see `test/codex-shell-read-credit.test.ts`
+* for the non-regression proof).
+* @param id - Harness adapter id (e.g. "codex", "claude-code", "kimi").
+* @param tool - Raw `tool_name` from the hook payload.
+*/
+function canonicalizeCodexShellTool(id, tool) {
+	return id === "codex" && CODEX_SHELL_TOOL_ALIASES.has(tool) ? "Bash" : tool;
+}
+//#endregion
+//#region src/runtime/mcp-tool-name.ts
+/**
+* @module mcp-tool-name
+* Canonicalizes a Codex-only MCP `tool_name` alias back to its original
+* hyphenated form, so every existing dash-keyed consumer (`SHOT_TOOLS`,
+* `RESEARCH_TOOLS`/`classifyExplore`, `docSourceOf`, the design-pipeline
+* `NAV`/`SCROLL`/`GEMINI` constants, …) recognizes a Codex MCP call exactly
+* like the same call on Claude/Kimi/Cursor/Cline/Gemini — no per-consumer
+* change needed.
+*
+* Codex CLI globally rewrites every `-` to `_` across the FULL qualified MCP
+* tool identifier before it ever reaches a hook, in `sanitize_responses_api_tool_name()`
+* (`codex-rs/core/src/mcp_connection_manager.rs`, introduced by
+* openai/codex#14605 — "Normalize MCP tool names to code-mode safe form",
+* code-mode forbids `-` in identifiers). openai/codex#18385's own
+* `SCENARIO_DASH_TOOL` test proves the REWRITTEN form is what reaches hooks:
+* the `echo-tool` tool of server `rmcp` is delivered to hooks as
+* `mcp__rmcp__echo_tool`. Confirmed independently in THIS repo's terrain:
+* `~/.codex/config.toml` declares `[mcp_servers.fuse-browser]` (dash) while
+* Codex session logs and this harness's own dual-marketplace hook payloads
+* (`~/.codex/plugins/.../hooks.json` matchers) observe `mcp__fuse_browser__*`
+* (underscore) — Claude never emits that form (0 occurrences across its
+* transcripts vs 137x the dash form).
+*
+* The rewrite is deliberately NOT undone with a generic `_` -> `-` regex:
+* openai/codex#15832 and #15565 document it as NON-INVERSIBLE — a server
+* literally named `autok_local` collides with a dash-named `autok-local`
+* once both pass through the same rewrite, and OpenAI's own fix was a closed
+* canonical table, never a general regex. The SAME ambiguity exists on our
+* side: a generic reversal would corrupt tool segments that legitimately
+* contain an underscore already (`browser_screenshot`, `node_repl`,
+* `build_sim`, …). So this module only reverses the FOUR entries proven
+* above to matter to this repo's gates — every other segment passes through
+* untouched.
+* @packageDocumentation
+*/
+/**
+* Codex-mangled MCP server segment -> its real (dash) server name. Closed set
+* — see module doc. `Object.create(null)` (never a `{}` literal): `serverKey`
+* is an attacker-influenced string (an MCP server can register itself as
+* `"__proto__"`/`"constructor"`/`"toString"`), and a `{}`-literal lookup by
+* such a key returns the INHERITED `Object.prototype` member instead of
+* `undefined` — an object/function, so `?? serverKey` never falls back and
+* the result silently corrupts to `"mcp__[object Object]__…"` (proven in
+* `test/mcp-tool-name.test.ts`, prototype-pollution-read case). A null-
+* prototype object has no inherited members, so every lookup outside the two
+* literal keys below is a clean miss.
+*/
+const SERVER_ALIASES = Object.assign(Object.create(null), {
+	fuse_browser: "fuse-browser",
+	gemini_design: "gemini-design"
+});
+/**
+* Codex-mangled MCP tool segment -> its real (dash) tool name. Both entries
+* are `context7`-exclusive tool names — applied ONLY when the canonical
+* server is `"context7"` (see the explicit guard in
+* {@link canonicalizeMcpToolName}), never globally. A same-named tool on any
+* other server (e.g. a hypothetical `exa__query_docs`) passes through
+* untouched: openai/codex#15832 documents exactly this class of collision as
+* the reason the rewrite must stay a closed, scoped table, never a blanket
+* one. Closed set, same null-prototype rationale as {@link SERVER_ALIASES}.
+*/
+const TOOL_ALIASES = Object.assign(Object.create(null), {
+	query_docs: "query-docs",
+	resolve_library_id: "resolve-library-id"
+});
+/**
+* Canonicalize a Codex-only MCP tool-name alias to its dash form. Scoped to
+* `id === "codex"` — every other harness id passes through unchanged. The
+* server segment is rewritten via the closed {@link SERVER_ALIASES} table;
+* the tool segment is rewritten via {@link TOOL_ALIASES} ONLY when the
+* (already-resolved) canonical server is `"context7"` — every other server's
+* tool segment is left untouched even if it happens to share a name with a
+* context7 tool. Every other `mcp__<server>__<tool>` segment (or non-MCP
+* tool name) is returned byte-identical (see `test/mcp-tool-name.test.ts`
+* for the non-regression proof across ids, trap tool names, and the
+* server-scoping cases).
+* @param id - Harness adapter id (e.g. "codex", "claude-code", "kimi").
+* @param tool - Raw `tool_name` from the hook payload.
+*/
+function canonicalizeMcpToolName(id, tool) {
+	if (id !== "codex") return tool;
+	const parts = tool.split("__");
+	if (parts.length < 3 || parts[0] !== "mcp") return tool;
+	const serverKey = parts[1] ?? "";
+	const toolKey = parts.slice(2).join("__");
+	const server = SERVER_ALIASES[serverKey] ?? serverKey;
+	return `mcp__${server}__${server === "context7" ? TOOL_ALIASES[toolKey] ?? toolKey : toolKey}`;
+}
+//#endregion
+//#region src/adapters/codex/permission-mode.ts
+/**
+* Codex maps `AskForApproval::Never` -> `permission_mode: "bypassPermissions"`
+* in its hook payload (codex-rs/core/src/hook_runtime.rs::hook_permission_mode)
+* — the only value that isolates `never`; the other three approval policies
+* (`untrusted`, `on-failure`, `on-request`) all collapse to `"default"`.
+* Verified at openai/codex@342e4d4b, hook_runtime.rs run_pre_tool_use_hooks +
+* pre_tool_use.rs PreToolUseRequest. Undocumented implementation detail, not
+* a public contract — see the mapping-regression test that pins this string.
+* @param permissionMode - The payload's `permission_mode` field, if present.
+* @returns True only on an EXACT match — fail-closed. A near-miss
+* (`"BypassPermissions"`, `"bypassPermissions "`, or a substring match) must
+* never accidentally grant the neverApproval exemption.
+*/
+function isBypassPermissions(permissionMode) {
+	return permissionMode === "bypassPermissions";
+}
+//#endregion
+export { parseApplyPatch as i, canonicalizeMcpToolName as n, canonicalizeCodexShellTool as r, isBypassPermissions as t };

package/dist/{run-DdWG0Meg.mjs → run-CdIlUtjv.mjs}

@@ -1,15 +1,25 @@
 import { t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
 import { t as evaluate } from "./evaluate-C1VSI5pb.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 //#region src/cli/run.ts
 /** Staged files (Added/Copied/Modified/Renamed). Uses `node:child_process` (Bun shell can hang on `git show`). */
 function stagedFiles() {
-	return execSync("git diff --cached --name-only --diff-filter=ACMR", { encoding: "utf8" }).trim().split("\n").filter(Boolean);
+	return execFileSync("git", [
+		"diff",
+		"--cached",
+		"--name-only",
+		"--diff-filter=ACMR"
+	], { encoding: "utf8" }).trim().split("\n").filter(Boolean);
 }
-/** Read a file's staged (index) content — not the working-tree version. */
+/**
+* Read a file's staged (index) content — not the working-tree version.
+* Uses `execFileSync` with an argv array (never a shell), so a staged
+* filename containing shell metacharacters (backticks, `$(...)`, quotes)
+* reaches `git show` as a single literal argument — see issue #87.
+*/
 function stagedContent(path) {
-	return execSync(`git show ":${path}"`, { encoding: "utf8" });
+	return execFileSync("git", ["show", `:${path}`], { encoding: "utf8" });
 }
 /**
 * Evaluate staged code files against the policy core; return violation blocks.

package/dist/runtime/index.mjs

@@ -1,6 +1,6 @@
 import { r as projectLayout } from "../layout-KWoE_Mqn.mjs";
 import { a as sanitizeSessionId, c as sessionsDir, i as loadSessionState, n as fuseHarnessHome, o as saveSessionState, r as fusengineCache, s as sessionStatePath, t as claudeHome } from "../home-state-oUGFB4ds.mjs";
-import { A as trackMcpResearch, At as defaultStateDir, B as generateProjectMap, C as seoPostToolUse, Ct as trimLogFile, D as securityAdvisoryForPatch, Dt as claudeMdKey, E as securityAdvisory, Et as projectContext, F as dispatchAipilot, Ft as loadSecurityState, G as countFiles, H as writeTree, I as dispatchLessons, It as saveSecurityState, J as lessonsArchiveFileFor, K as getFileDesc, L as cartoSessionStart, Lt as securityStateDir, M as trackEnrichment, Mt as trackFile, N as dispatchLifecycle, Nt as normalizeEvent, O as postTrackingSideEffects, Ot as promptSubmitContext, P as aipilotPostToolUse, Pt as isoUtc, R as generateEcosystemMap, Rt as securityStatePath, S as postEditContext, St as removeOldFiles, T as dispatchMemory, Tt as gitContext, U as loadEnriched, V as isProject, W as mergeLines, X as lessonsStateFileFor, Y as lessonsFileFor, _ as preCommitGate, _t as readRules, a as recordActivity, at as saveApexState, b as extractSymbols, bt as pruneEmptyDirs, c as MCP_TTL_MS, ct as trackAgentMemory, d as isMcpTool, dt as validateSolidGate, f as queryOf, ft as checkFileSize, g as gate, gt as injectRules, h as TRIVIAL_BUDGET, ht as solidDetectStart, i as respond, it as cleanupSession, j as trackSkillRead, jt as projectHash, k as trackWatchResearch, kt as taskContext, l as WEBFETCH_TTL_MS, lt as subagentCacheContext, m as REQUIRED_AGENTS, mt as detectSolidProfile, n as activityFor, nt as trackSessionChanges, o as mcpPostStore, ot as logToolFailure, p as DEFAULT_WINDOW_MS, pt as countLoc, q as listChildren, r as handlePre, rt as validateRulesLoaded, s as mcpPreIntercept, st as validateTeammateOutput, t as handleHook, tt as postEditTypescript, u as cacheQueryOf, ut as validateTailwind, v as detectDuplication, vt as runSessionStartCleanups, w as seoPostToolUseResponse, wt as devContext, x as lifecycleStdout, xt as purgeTtlTree, y as dryGate, yt as sessionStartCore, z as writePluginMap, zt as todayUtc } from "../handle-DHhukRdh.mjs";
+import { A as trackMcpResearch, At as defaultStateDir, B as generateProjectMap, C as seoPostToolUse, Ct as trimLogFile, D as securityAdvisoryForPatch, Dt as claudeMdKey, E as securityAdvisory, Et as projectContext, F as dispatchAipilot, Ft as loadSecurityState, G as countFiles, H as writeTree, I as dispatchLessons, It as saveSecurityState, J as lessonsArchiveFileFor, K as getFileDesc, L as cartoSessionStart, Lt as securityStateDir, M as trackEnrichment, Mt as trackFile, N as dispatchLifecycle, Nt as normalizeEvent, O as postTrackingSideEffects, Ot as promptSubmitContext, P as aipilotPostToolUse, Pt as isoUtc, R as generateEcosystemMap, Rt as securityStatePath, S as postEditContext, St as removeOldFiles, T as dispatchMemory, Tt as gitContext, U as loadEnriched, V as isProject, W as mergeLines, X as lessonsStateFileFor, Y as lessonsFileFor, _ as preCommitGate, _t as readRules, a as recordActivity, at as saveApexState, b as extractSymbols, bt as pruneEmptyDirs, c as MCP_TTL_MS, ct as trackAgentMemory, d as isMcpTool, dt as validateSolidGate, f as queryOf, ft as checkFileSize, g as gate, gt as injectRules, h as TRIVIAL_BUDGET, ht as solidDetectStart, i as respond, it as cleanupSession, j as trackSkillRead, jt as projectHash, k as trackWatchResearch, kt as taskContext, l as WEBFETCH_TTL_MS, lt as subagentCacheContext, m as REQUIRED_AGENTS, mt as detectSolidProfile, n as activityFor, nt as trackSessionChanges, o as mcpPostStore, ot as logToolFailure, p as DEFAULT_WINDOW_MS, pt as countLoc, q as listChildren, r as handlePre, rt as validateRulesLoaded, s as mcpPreIntercept, st as validateTeammateOutput, t as handleHook, tt as postEditTypescript, u as cacheQueryOf, ut as validateTailwind, v as detectDuplication, vt as runSessionStartCleanups, w as seoPostToolUseResponse, wt as devContext, x as lifecycleStdout, xt as purgeTtlTree, y as dryGate, yt as sessionStartCore, z as writePluginMap, zt as todayUtc } from "../handle-CBaOcFZq.mjs";
 //#region src/runtime/storage.ts
 /**
 * The project's single state dir (`<root>/.harness`) — neutral + harness-agnostic,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fusengine/harness",
-	"version": "0.1.88",
+	"version": "0.1.90",
 	"description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
 	"type": "module",
 	"module": "src/index.ts",

package/dist/permission-mode-B0MUl7FT.mjs

@@ -1,136 +0,0 @@
-//#region src/adapters/codex/apply-patch.ts
-const BEGIN = "*** Begin Patch";
-const END = "*** End Patch";
-const ADD = "*** Add File: ";
-const DEL = "*** Delete File: ";
-const UPD = "*** Update File: ";
-const MOVE = "*** Move to: ";
-const EOF = "*** End of File";
-const ENV = "*** Environment ID: ";
-/**
-* Parse a Codex freeform patch into its per-file changes. Lenient on whitespace
-* around structural markers (as Codex's own parser is); returns `[]` when no
-* recognizable hunk is present (malformed input fails open, not closed).
-* @param text - Raw patch body from `tool_input.command`.
-* @returns One {@link PatchedFile} per Add/Update/Delete hunk, in order.
-*/
-function parseApplyPatch(text) {
-	const files = [];
-	let cur = null;
-	let buf = [];
-	const flush = () => {
-		if (cur) {
-			cur.content = buf.join("\n");
-			files.push(cur);
-		}
-		cur = null;
-		buf = [];
-	};
-	for (const line of text.split("\n")) {
-		const marker = line.trimStart();
-		if (marker === BEGIN || marker.startsWith(ENV)) continue;
-		if (marker === END) {
-			flush();
-			continue;
-		}
-		if (marker.startsWith(ADD)) {
-			flush();
-			cur = {
-				path: marker.slice(14).trim(),
-				content: "",
-				op: "add"
-			};
-			continue;
-		}
-		if (marker.startsWith(DEL)) {
-			flush();
-			files.push({
-				path: marker.slice(17).trim(),
-				content: "",
-				op: "delete"
-			});
-			continue;
-		}
-		if (marker.startsWith(UPD)) {
-			flush();
-			cur = {
-				path: marker.slice(17).trim(),
-				content: "",
-				op: "update"
-			};
-			continue;
-		}
-		if (marker.startsWith(MOVE)) {
-			if (cur) cur.path = marker.slice(13).trim();
-			continue;
-		}
-		if (marker === EOF || !cur) continue;
-		if (cur.op === "add") {
-			if (line.startsWith("+")) buf.push(line.slice(1));
-			continue;
-		}
-		if (line.startsWith("@@")) continue;
-		if (line.startsWith("+")) buf.push(line.slice(1));
-		else if (line.startsWith("-")) continue;
-		else buf.push(line.startsWith(" ") ? line.slice(1) : line);
-	}
-	flush();
-	return files;
-}
-//#endregion
-//#region src/runtime/codex-shell-tool.ts
-/**
-* @module codex-shell-tool
-* Canonicalizes a Codex-only shell `tool_name` alias to `"Bash"`, so every
-* existing `tool === "Bash"` consumer (activity credit, explore-tools
-* classification, the protected-path guard, the design corpus read gate, …)
-* treats a Code Mode exec dispatch exactly like a native Bash call — no
-* per-consumer change needed.
-*
-* A Code Mode-wrapped call (`functions.exec` -> `tools.exec_command(...)`)
-* surfaces via the generic `CoreToolRuntime` hook default (openai/codex#23757,
-* commit 5c20513), which keeps the raw function-tool name `"exec_command"`
-* verbatim — unlike a DIRECT `exec_command` dispatch, which
-* `ExecCommandHandler`'s own `pre_tool_use_payload` override re-labels
-* `"Bash"` (`tool_name: HookToolName::bash()`). This is the exact call chain
-* a real Codex CLI 0.146.0 session was observed emitting for a `sed -n` skill
-* read. Only ONE alias is confirmed here — `ToolName::plain("exec_command")`
-* in `core/src/tools/handlers/unified_exec/exec_command.rs`; `shell`,
-* `unified_exec`, `local_shell`, and `shell_command` were audited but not
-* evidenced as a distinct hook `tool_name` value, so they are deliberately
-* left out rather than guessed.
-* @packageDocumentation
-*/
-/** Codex `tool_name` values that are a shell execution but not literally `"Bash"`. */
-const CODEX_SHELL_TOOL_ALIASES = /* @__PURE__ */ new Set(["exec_command"]);
-/**
-* Canonicalize a Codex-only shell tool alias to `"Bash"`. Scoped to
-* `id === "codex"` — every other harness id, and every non-aliased tool
-* name, passes through unchanged (see `test/codex-shell-read-credit.test.ts`
-* for the non-regression proof).
-* @param id - Harness adapter id (e.g. "codex", "claude-code", "kimi").
-* @param tool - Raw `tool_name` from the hook payload.
-*/
-function canonicalizeCodexShellTool(id, tool) {
-	return id === "codex" && CODEX_SHELL_TOOL_ALIASES.has(tool) ? "Bash" : tool;
-}
-//#endregion
-//#region src/adapters/codex/permission-mode.ts
-/**
-* Codex maps `AskForApproval::Never` -> `permission_mode: "bypassPermissions"`
-* in its hook payload (codex-rs/core/src/hook_runtime.rs::hook_permission_mode)
-* — the only value that isolates `never`; the other three approval policies
-* (`untrusted`, `on-failure`, `on-request`) all collapse to `"default"`.
-* Verified at openai/codex@342e4d4b, hook_runtime.rs run_pre_tool_use_hooks +
-* pre_tool_use.rs PreToolUseRequest. Undocumented implementation detail, not
-* a public contract — see the mapping-regression test that pins this string.
-* @param permissionMode - The payload's `permission_mode` field, if present.
-* @returns True only on an EXACT match — fail-closed. A near-miss
-* (`"BypassPermissions"`, `"bypassPermissions "`, or a substring match) must
-* never accidentally grant the neverApproval exemption.
-*/
-function isBypassPermissions(permissionMode) {
-	return permissionMode === "bypassPermissions";
-}
-//#endregion
-export { canonicalizeCodexShellTool as n, parseApplyPatch as r, isBypassPermissions as t };