@fusengine/harness 0.1.89 → 0.1.91

package/src/runtime/confirm/codex-confirm.ts

@@ -0,0 +1,126 @@
+import { homedir } from "node:os";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { LOCK_FAILED, withTrackLockSync } from "../../tracking/track-lock-sync";
+import { atomicWrite } from "../../util/json-io";
+import { sanitizeSessionId, sessionsDir } from "../home-state";
+import { commandToString } from "../command-string";
+import { displayCodeForAction, hashForAction } from "./confirm-code";
+import { isSubagentActive } from "./confirm-subagent";
+import type { CodexPromptOrigin } from "./codex-prompt-origin";
+
+const TTL_MS = 5 * 60 * 1000;
+const STATE_VERSION = 1;
+
+type RejectReason = "no-token" | "mismatch" | "expired" | "already-consumed" | "missing-tool-use-id" | "state-io";
+type Action = Readonly<{ hash: string; code: string; command: string; ts: number }>;
+type Receipt = Action & Readonly<{ toolUseId: string }>;
+type CodexState = Readonly<{ codexConfirmPending?: Action; codexConfirmToken?: Action; codexConfirmReceipt?: Receipt }>;
+
+function statePath(sid: string, home: string): string {
+  return join(sessionsDir(home), `codex-confirm-${sid}.json`);
+}
+
+function lockDir(sid: string, home: string): string {
+  return join(sessionsDir(home), ".confirm-locks", sid);
+}
+
+function loadState(sid: string, home: string): CodexState {
+  const path = statePath(sid, home);
+  if (!existsSync(path)) return {};
+  const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
+  return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed as CodexState : {};
+}
+
+function saveState(sid: string, state: CodexState, home: string): void {
+  mkdirSync(sessionsDir(home), { recursive: true, mode: 0o700 });
+  atomicWrite(statePath(sid, home), JSON.stringify(state, null, 2));
+}
+
+/** Canonical identity of one Codex shell action and its display token. */
+export function codexAction(tool: string, cwd: string, command: unknown, now: number): Action | null {
+  const canonicalCommand = commandToString(command);
+  if (!canonicalCommand) return null;
+  const identity = JSON.stringify({ version: STATE_VERSION, harness: "codex", tool, cwd: resolve(cwd), command: canonicalCommand });
+  return { hash: hashForAction(identity), code: displayCodeForAction(identity), command: canonicalCommand, ts: now };
+}
+
+/** Atomically authorize or reject a Codex action, recording the current denial when needed. */
+export function authorizeCodexAction(
+  sessionIdRaw: unknown,
+  action: Action,
+  toolUseId: string | undefined,
+  now: number,
+  home: string = homedir(),
+): { allow: true } | { allow: false; reason: RejectReason } {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return { allow: false, reason: "state-io" };
+  try {
+    const result = withTrackLockSync(lockDir(sid, home), () => {
+      const state = loadState(sid, home);
+      const token = state.codexConfirmToken;
+      const receipt = state.codexConfirmReceipt;
+      const receiptExpired = receipt !== undefined && now - receipt.ts > TTL_MS;
+      if (!receiptExpired && receipt?.hash === action.hash && receipt.toolUseId === toolUseId && toolUseId) return { allow: true } as const;
+
+      let reason: RejectReason = "no-token";
+      if (token) {
+        if (token.hash !== action.hash) reason = "mismatch";
+        else if (now - token.ts > TTL_MS) reason = "expired";
+        else if (!toolUseId) reason = "missing-tool-use-id";
+        else {
+          const { codexConfirmToken: _token, codexConfirmPending: _pending, ...rest } = state;
+          saveState(sid, { ...rest, codexConfirmReceipt: { ...action, toolUseId } satisfies Receipt }, home);
+          return { allow: true } as const;
+        }
+      } else if (receipt?.hash === action.hash) reason = receiptExpired ? "expired" : "already-consumed";
+
+      if (reason === "missing-tool-use-id") return { allow: false, reason } as const;
+      const pending = state.codexConfirmPending;
+      const stablePending = pending?.hash === action.hash ? pending : action;
+      const { codexConfirmToken: _token, codexConfirmReceipt: _receipt, ...withoutReceipt } = state;
+      const rest = receiptExpired ? withoutReceipt : { ...withoutReceipt, codexConfirmReceipt: receipt };
+      saveState(sid, { ...rest, codexConfirmPending: stablePending }, home);
+      return { allow: false, reason } as const;
+    });
+    return result === LOCK_FAILED ? { allow: false, reason: "state-io" } : result;
+  } catch {
+    return { allow: false, reason: "state-io" };
+  }
+}
+
+/**
+ * Atomically arm the last Codex denial, consuming its pending record exactly once.
+ * A classified root prompt may bypass G0; classified subagent/unknown prompts fail closed.
+ */
+export function submitCodexConfirmation(
+  sessionIdRaw: unknown,
+  text: string,
+  now: number,
+  home: string = homedir(),
+  origin?: CodexPromptOrigin,
+): void {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return;
+  const refusal = /\b(non|no|stop|annule|cancel|abort|nope|laisse tomber|pas maintenant)\b/i.test(text);
+  const typedCode = text.trim().match(/^confirm[ _-]*([0-9a-f]{4})$/i)?.[1];
+  try {
+    withTrackLockSync(lockDir(sid, home), () => {
+      const state = loadState(sid, home);
+      if (origin !== undefined && origin !== "root") return;
+      if (refusal) {
+        const { codexConfirmPending: _pending, codexConfirmToken: _token, ...rest } = state;
+        saveState(sid, rest, home);
+        return;
+      }
+      if (!typedCode) return;
+      if (origin === undefined && isSubagentActive(sid, now, home)) return;
+      const pending = state.codexConfirmPending;
+      if (!pending || pending.code.toLowerCase() !== typedCode.toLowerCase()) return;
+      const { codexConfirmPending: _pending, ...rest } = state;
+      saveState(sid, { ...rest, codexConfirmToken: { ...pending, ts: now } }, home);
+    });
+  } catch {
+    // Submission is advisory state wiring; hook execution must remain available.
+  }
+}

package/src/runtime/confirm/codex-prompt-origin.ts

@@ -0,0 +1,16 @@
+/** Provenance classification for a Codex `UserPromptSubmit` payload. */
+export type CodexPromptOrigin = "root" | "subagent" | "unknown";
+
+const AGENT_FIELDS = ["agent_id", "agent_type"] as const;
+
+/**
+ * Classify Codex prompt provenance from its optional agent metadata.
+ * Missing metadata is the observed root shape; malformed metadata fails closed.
+ */
+export function codexPromptOrigin(payload: Record<string, unknown>): CodexPromptOrigin {
+  const present = AGENT_FIELDS.filter((field) => Object.hasOwn(payload, field));
+  if (present.length === 0) return "root";
+  return present.every((field) => typeof payload[field] === "string" && payload[field].trim().length > 0)
+    ? "subagent"
+    : "unknown";
+}

package/src/runtime/confirm/confirm-code.ts

@@ -0,0 +1,33 @@
+import { createHash } from "node:crypto";
+
+/**
+ * Full SHA-256 hex digest (64 chars) of an action string (the exact command
+ * a deny prompt showed). This is the ONLY value ever compared to authorize a
+ * confirmation (G3, confirm-state.ts) — collision-resistant, unlike the
+ * 4-char {@link displayCodeForAction} below.
+ * @param action - The command/content string a deny prompt showed.
+ */
+export function hashForAction(action: string): string {
+  return createHash("sha256").update(action).digest("hex");
+}
+
+/**
+ * 4-hex-char PREFIX of {@link hashForAction}, for DISPLAY ONLY — never a
+ * security boundary. It exists purely so a human has something short to
+ * retype ("CONFIRM 4f2a"); at 16 bits it collides constantly across
+ * unrelated actions (birthday bound ~a few hundred actions/session), and the
+ * agent ALWAYS sees it too — `systemMessage` never reaches the user or model
+ * under Codex (measured 2026-08-03: 0 occurrence in the rollout, nothing on
+ * screen), so `permissionDecisionReason` is the only channel, and the model
+ * reads its own code back in the very tool result that got blocked.
+ *
+ * What actually scopes a confirmation to ONE specific action is the full
+ * hash recorded at deny time and re-checked at consume time (see
+ * confirm-pending.ts / confirm-state.ts). What prevents an agent from typing
+ * its own code back to self-approve is G0 (fail-closed while a sub-agent is
+ * active) — never the code's secrecy, because it has none.
+ * @param action - The command/content string to derive the display code from.
+ */
+export function displayCodeForAction(action: string): string {
+  return hashForAction(action).slice(0, 4);
+}

package/src/runtime/confirm/confirm-gate.ts

@@ -0,0 +1,65 @@
+import type { Prompt } from "../../prompt/types";
+import { displayCodeForAction, hashForAction } from "./confirm-code";
+import { isIrreversible } from "./confirm-irreversible";
+import { recordPendingDeny } from "./confirm-pending";
+import { consumeConfirmToken } from "./confirm-state";
+import { authorizeCodexAction, codexAction } from "./codex-confirm";
+
+/**
+ * Harnesses where `respond.ts` silently downgrades `kind: "ask"` to a hard
+ * deny (Codex: `case "codex"`; Kimi: `toKimiResponse` maps `ask` to the same
+ * `permissionDecision:"deny"` envelope as `block`). Claude Code keeps native
+ * interactive `ask` — this mechanism NEVER applies there.
+ */
+const DEGRADES_ASK_TO_DENY: ReadonlySet<string> = new Set(["codex", "kimi"]);
+
+export type ConfirmVerdict = { allow: true } | { allow: false; prompt: Prompt };
+
+/**
+ * Whether/how a CONFIRM token changes an `ask` prompt about to be downgraded
+ * to a deny. Returns `null` when this mechanism doesn't apply AT ALL — any
+ * harness other than codex/kimi, any prompt kind other than `ask`, no
+ * command to key a hash off, or an irreversible command (G4) — in which case
+ * the caller's ORIGINAL prompt/response path runs completely unchanged. That
+ * `null` fast-path, hit on every claude-code call and every non-`ask` prompt,
+ * IS the non-regression property.
+ * @param id - Harness target id.
+ * @param prompt - The prompt `gate()` returned.
+ * @param command - `event.command` for the tool-use under judgment.
+ * @param sessionId - `event.sessionId`.
+ * @param now - Epoch ms.
+ * @param home - Test-only OS home override.
+ */
+export function confirmGate(
+  id: string,
+  prompt: Prompt,
+  command: string | undefined,
+  sessionId: string,
+  now: number,
+  home?: string,
+  codex?: Readonly<{ tool: string; cwd: string; toolUseId?: string }>,
+): ConfirmVerdict | null {
+  if (prompt.kind !== "ask" || !DEGRADES_ASK_TO_DENY.has(id) || !command || isIrreversible(command)) return null;
+  try {
+    if (id === "codex" && codex) {
+      const action = codexAction(codex.tool, codex.cwd, command, now);
+      if (!action) return null;
+      const verdict = authorizeCodexAction(sessionId, action, codex.toolUseId, now, home);
+      if (verdict.allow) return verdict;
+      const ruleId = prompt.ruleId ?? "policy:ask";
+      const diagnostic = `rule ID: ${ruleId}\ncanonical command: ${action.command}\nexpected token: CONFIRM ${action.code}\nrejection: ${verdict.reason}`;
+      return { allow: false, prompt: { ...prompt, reason: `${prompt.reason}\nPour autoriser, réponds : CONFIRM ${action.code}\n${diagnostic}` } };
+    }
+    const hash = hashForAction(command);
+    if (consumeConfirmToken(sessionId, hash, now, home)) return { allow: true };
+    const code = displayCodeForAction(command);
+    recordPendingDeny(sessionId, hash, code, now, home);
+    return { allow: false, prompt: { ...prompt, reason: `${prompt.reason}\nPour autoriser, réponds : CONFIRM ${code}` } };
+  } catch {
+    // A state-io failure (full disk, unwritable home) must fall back to the
+    // plain deny, never crash the hook — same invariant as confirm-submit.ts.
+    // The caller's `confirm ? confirm.prompt : prompt` treats `null` exactly
+    // like "mechanism doesn't apply", i.e. the pre-CONFIRM deny unchanged.
+    return null;
+  }
+}

package/src/runtime/confirm/confirm-irreversible.ts

@@ -0,0 +1,32 @@
+import { GIT_BLOCKED, matchPatterns } from "../../policy/patterns";
+
+/**
+ * A single flag token carrying BOTH `r` and `f` in either order (`-rf`,
+ * `-fr`, `-rfv`, …) — same lookahead technique as patterns.ts's
+ * `CLEAN_FD_FLAG`, reused here rather than re-derived (DRY).
+ */
+const RM_COMBINED_FLAG = /\s-(?=[a-zA-Z]*r)(?=[a-zA-Z]*f)[a-zA-Z]+(?:\s|=|$)/;
+/** Split flags `-r ... -f` (either order) within the SAME command segment (no `;&|` between). */
+const RM_SPLIT_FLAG = /\brm\b[^;&|\n]*\s-r\b[^;&|\n]*\s-f\b|\brm\b[^;&|\n]*\s-f\b[^;&|\n]*\s-r\b/;
+
+/**
+ * Generic `rm -rf`/`-fr` (ANY target, not just `/`/`~`) — deliberately
+ * broader than `src/codex-rules/rules/rm-variants.ts`'s root/system-path-only
+ * forbidden list: G4 must treat every recursive force-delete as
+ * never-confirmable, not only the ones aimed at a system path.
+ */
+function isRmRf(cmd: string): boolean {
+  return /\brm\b/.test(cmd) && (RM_COMBINED_FLAG.test(cmd) || RM_SPLIT_FLAG.test(cmd));
+}
+
+/**
+ * G4: commands NEVER unlockable by a CONFIRM token, regardless of a valid,
+ * fresh, correctly-scoped one. Reuses {@link GIT_BLOCKED} (push --force,
+ * reset --hard, clean -fd, branch -D, rebase --force — DRY, same list the
+ * rest of the policy already enforces) plus a generic `rm -rf` check.
+ * @param cmd - The command a prompt is about (empty/undefined = not irreversible).
+ */
+export function isIrreversible(cmd: string | undefined): boolean {
+  if (!cmd) return false;
+  return matchPatterns(cmd, GIT_BLOCKED) || isRmRf(cmd);
+}

package/src/runtime/confirm/confirm-pending.ts

@@ -0,0 +1,34 @@
+import { homedir } from "node:os";
+import { loadSessionState, saveSessionState, sanitizeSessionId } from "../home-state";
+
+/** The last `ask`-turned-deny for a session: its full hash plus the short code shown to the human. */
+export interface PendingDeny {
+  hash: string;
+  code: string;
+  ts: number;
+}
+
+/**
+ * Record the action a deny prompt just showed (overwrites any previous
+ * pending deny for this session — only the LAST blocked action can be
+ * confirmed). Pure bookkeeping, no gate: every ask-turned-deny records one,
+ * whether or not the user ever confirms it.
+ * @param sessionIdRaw - Raw session id from the payload.
+ * @param hash - Full {@link import("./confirm-code").hashForAction} of the command.
+ * @param code - The short display code shown alongside it.
+ * @param now - Epoch ms.
+ * @param home - Test-only OS home override.
+ */
+export function recordPendingDeny(sessionIdRaw: unknown, hash: string, code: string, now: number, home: string = homedir()): void {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return;
+  const state = loadSessionState(sid, home);
+  saveSessionState(sid, { ...state, pendingDeny: { hash, code, ts: now } satisfies PendingDeny }, home);
+}
+
+/** Read back the pending deny for a session (`undefined` when none/invalid session id). */
+export function getPendingDeny(sessionIdRaw: unknown, home: string = homedir()): PendingDeny | undefined {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return undefined;
+  return loadSessionState(sid, home).pendingDeny as PendingDeny | undefined;
+}

package/src/runtime/confirm/confirm-state.ts

@@ -0,0 +1,56 @@
+import { homedir } from "node:os";
+import { loadSessionState, saveSessionState, sanitizeSessionId } from "../home-state";
+import { isSubagentActive } from "./confirm-subagent";
+
+/** A posed confirmation token: the FULL action hash (G3) plus its mint timestamp (G2). */
+interface ConfirmToken {
+  hash: string;
+  ts: number;
+}
+
+/** Confirmation freshness window (G2) — 5 minutes, matches the validated prototype. */
+const TTL_MS = 5 * 60 * 1000;
+
+/**
+ * Pose a confirmation token for this session's pending action. No-op while
+ * {@link isSubagentActive} (G0, confirm-subagent.ts) — the sole gate that
+ * stops an agent, which always sees the display code in its own blocked tool
+ * result, from typing it back to self-approve.
+ */
+export function placeConfirmToken(sessionIdRaw: unknown, hash: string, now: number, home: string = homedir(), env: Record<string, string | undefined> = process.env): void {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid || isSubagentActive(sid, now, home, env)) return;
+  const state = loadSessionState(sid, home);
+  saveSessionState(sid, { ...state, confirmToken: { hash, ts: now } satisfies ConfirmToken }, home);
+}
+
+/** Invalidate any pending token for this session (G5: an explicit refusal). */
+export function dropConfirmToken(sessionIdRaw: unknown, home: string = homedir()): void {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return;
+  const state = loadSessionState(sid, home);
+  if (state.confirmToken === undefined) return;
+  const { confirmToken: _drop, ...rest } = state;
+  saveSessionState(sid, rest, home);
+}
+
+/**
+ * Consume a token that matches `hash` exactly (G3), whether or not it's
+ * fresh — a mismatched hash leaves the token untouched (it may still be
+ * valid for the action it actually confirms). G1 (one-shot) + G2 (5-min TTL)
+ * both apply only once the hash matches.
+ * @returns true = allow (token consumed); false = deny (nothing changed, or
+ * the matching token had expired and was dropped).
+ */
+export function consumeConfirmToken(sessionIdRaw: unknown, hash: string, now: number, home: string = homedir()): boolean {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return false;
+  const tok = loadSessionState(sid, home).confirmToken as ConfirmToken | undefined;
+  if (!tok || tok.hash !== hash) return false;
+  if (now - tok.ts > TTL_MS) {
+    dropConfirmToken(sid, home);
+    return false;
+  }
+  dropConfirmToken(sid, home);
+  return true;
+}

package/src/runtime/confirm/confirm-subagent.ts

@@ -0,0 +1,112 @@
+import { homedir } from "node:os";
+import { parseEnvInt } from "../../config/env";
+import { loadSessionState, saveSessionState, sanitizeSessionId } from "../home-state";
+
+/** Env var overriding the G0 cool-down window below (seconds). Unset = the 300s/5min default. */
+const CONFIRM_WINDOW_ENV_KEY = "FUSE_CONFIRM_SUBAGENT_WINDOW_SEC";
+/** Default G0 cool-down (seconds) when {@link CONFIRM_WINDOW_ENV_KEY} is unset/invalid — 300s (5min). */
+const DEFAULT_CONFIRM_WINDOW_SEC = 300;
+
+/**
+ * G0 cool-down after the last SubagentStart/SubagentStop seen for this
+ * session — {@link DEFAULT_CONFIRM_WINDOW_SEC} by default, overridable via
+ * `FUSE_CONFIRM_SUBAGENT_WINDOW_SEC` (seconds) without a rebuild. Read this
+ * doc before ever touching this value: it is NOT G0's primary protection,
+ * and it is not sized to "safely cover a sub-agent's whole runtime".
+ *
+ * G0's PRIMARY protection is P0, measured live under Codex in a prior
+ * session: a sub-agent never receives its own `UserPromptSubmit` — only a
+ * human typing into the top-level session does — so a sub-agent is
+ * STRUCTURALLY unable to place a CONFIRM token at all, regardless of this
+ * window's value. This timestamp is a SECOND belt, covering only the
+ * residual case where that structural property does not hold on some future
+ * harness (Kimi: not yet measured either way).
+ *
+ * The default is a deliberate, owner-decided trade-off between over-refusal
+ * and usability, NOT a safety-maximizing constant: sub-agents in this
+ * ecosystem share the lead session's `session_id`, and the owner runs
+ * sub-agents continuously — an earlier 30-minute window froze CONFIRM for
+ * the entire session on every single sub-agent call, which neutralizes the
+ * feature it protects (a guard that disables what it guards is not a good
+ * guard). 5 minutes comfortably covers the case that actually matters — a
+ * sub-agent genuinely in flight at the exact moment a human types a CONFIRM
+ * code — without pinning a busy session shut. Do not read this value as "the
+ * time G0 needs to be safe" — that safety comes from P0.
+ *
+ * This deliberately reuses {@link parseEnvInt} (`src/config/env.ts`) rather
+ * than `resolveTtlSec`/`FUSE_ENFORCE_TTL_SEC` (`src/config/ttl.ts`): that TTL
+ * governs APEX evidence freshness (120s default) — an unrelated concern
+ * accidentally coupling the two would make lengthening the research-evidence
+ * window also lengthen the confirmation cool-down. `resolveTtlSec` also
+ * hardcodes its own fallback (`DEFAULT_TTL_SEC` = 120) regardless of which
+ * env key is passed, so it cannot express a 300s default either — this key
+ * gets its OWN env var and its OWN default via the same underlying
+ * `parseEnvInt` primitive, with no new parsing logic.
+ *
+ * Mechanically this is still a single monotone "last seen" timestamp, NOT a
+ * start/stop pair — a symmetric increment/decrement depth counter was tried
+ * and rejected: the harness dispatches ONE real SubagentStart/SubagentStop
+ * through MULTIPLE concurrent sibling plugin processes (the repo's own
+ * "~11-process multi-plugin fan-out"), all doing UNLOCKED read-modify-write
+ * on the same session-state file — a duplicated decrement can walk the
+ * counter to 0 while a sub-agent is still running, and G0 would then wrongly
+ * OPEN. Two ever-growing `starts`/`stops` counters were also rejected: if the
+ * fan-out dispatches SubagentStart via N processes and SubagentStop via
+ * M ≠ N, `starts > stops` stays true FOREVER and the session is frozen for
+ * good — worse than any window.
+ *
+ * `Math.max(prevSeenAt, now)` avoids both failure modes: an LWW
+ * (last-writer-wins) register merged with `max`, which is idempotent,
+ * commutative, and associative — under ANY interleaving of concurrent
+ * writers (lost updates included), the stored value converges to the
+ * largest `now` any writer supplied, and every writer's `now` is a real
+ * wall-clock read taken within milliseconds of the true event, so it can
+ * never regress below a timestamp it already held. BOTH SubagentStart and
+ * SubagentStop bump the SAME field this way — there is no decrement
+ * anywhere in this file, so there is nothing for a duplicated event to
+ * desynchronize; the flag falls only once this window elapses with no
+ * further sighting.
+ * @param env - Env map to resolve the override from (defaults to `process.env`; tests inject a plain object).
+ */
+function subagentWindowMs(env: Record<string, string | undefined> = process.env): number {
+  return parseEnvInt(env[CONFIRM_WINDOW_ENV_KEY], DEFAULT_CONFIRM_WINDOW_SEC) * 1000;
+}
+
+/**
+ * G0: true within {@link subagentWindowMs} of the last SubagentStart/
+ * SubagentStop seen for this session. An invalid/missing session id is
+ * treated as active too — fail-closed, never pose a token when in doubt.
+ */
+export function isSubagentActive(sessionIdRaw: unknown, now: number, home: string = homedir(), env: Record<string, string | undefined> = process.env): boolean {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return true;
+  const seenAt = loadSessionState(sid, home).subagentSeenAt;
+  return typeof seenAt === "number" && now - seenAt < subagentWindowMs(env);
+}
+
+/**
+ * Record a SubagentStart OR SubagentStop sighting for this session as a
+ * monotone max-write (see {@link subagentWindowMs}'s doc for why this can
+ * never desync unsafely under concurrent racy writers). Both events call
+ * this the SAME way — there is no separate "clear" path.
+ *
+ * Called unconditionally, BEFORE scope branching, on every SubagentStart/Stop
+ * across every plugin (dispatch.ts) — never allowed to throw: a disk fault
+ * here (full disk, unwritable home) must degrade to "sighting not recorded",
+ * never crash sub-agent lifecycle dispatch for scopes that have nothing to do
+ * with CONFIRM. Safe to swallow: G0's PRIMARY protection is P0 (a sub-agent
+ * structurally never receives its own UserPromptSubmit, confirm-gate.ts's
+ * doc) — this window is only a second belt, so losing one sighting degrades
+ * that belt, it does not open the gate.
+ */
+export function markSubagentSeen(sessionIdRaw: unknown, now: number, home: string = homedir()): void {
+  try {
+    const sid = sanitizeSessionId(sessionIdRaw);
+    if (!sid) return;
+    const state = loadSessionState(sid, home);
+    const prev = typeof state.subagentSeenAt === "number" ? state.subagentSeenAt : 0;
+    saveSessionState(sid, { ...state, subagentSeenAt: Math.max(prev, now) }, home);
+  } catch {
+    // A state-io failure must never break the hook (same invariant as confirm-submit.ts).
+  }
+}

package/src/runtime/confirm/confirm-submit.ts

@@ -0,0 +1,38 @@
+import { getPendingDeny } from "./confirm-pending";
+import { dropConfirmToken, placeConfirmToken } from "./confirm-state";
+
+/** Common explicit-refusal words (fr/en), any of which invalidates a pending token (G5). */
+const REFUSAL_RE = /\b(non|no|stop|annule|cancel|abort|nope|laisse tomber|pas maintenant)\b/i;
+/** `CONFIRM <4-hex-chars>`, case-insensitive, tolerant of `confirm4f2a` / `Confirm-4f2a` / `confirm_4f2a`. */
+const CONFIRM_RE = /confirm[\s_-]*([0-9a-f]{4})\b/i;
+
+/**
+ * Parse a submitted user prompt for `CONFIRM <code>` or an explicit refusal.
+ * A refusal always wins (checked first) and drops any pending token (G5),
+ * even if the same text also happens to contain a code. A confirm only
+ * places a token when its 4-char code matches this session's LAST pending
+ * deny (see confirm-pending.ts) — the code is looked up back to the full
+ * hash that deny recorded, never compared as a code-to-code match (that
+ * would reopen the collision {@link import("./confirm-code").displayCodeForAction}
+ * warns about). Never throws — this runs inside a hook.
+ * @param sessionId - The normalized event's session id.
+ * @param text - The prompt text ({@link import("../prompt-text").promptText} output).
+ * @param now - Epoch ms.
+ * @param home - Test-only OS home override.
+ */
+export function handleConfirmSubmit(sessionId: string, text: string, now: number, home?: string): void {
+  try {
+    if (REFUSAL_RE.test(text)) {
+      dropConfirmToken(sessionId, home);
+      return;
+    }
+    const m = text.match(CONFIRM_RE);
+    const typedCode = m?.[1];
+    if (!typedCode) return;
+    const pending = getPendingDeny(sessionId, home);
+    if (!pending || pending.code.toLowerCase() !== typedCode.toLowerCase()) return;
+    placeConfirmToken(sessionId, pending.hash, now, home); // G0 enforced inside
+  } catch {
+    // A state-io failure must never break the hook.
+  }
+}

package/src/runtime/core-guards-active.ts

@@ -0,0 +1,84 @@
+/**
+ * Per-harness ACTIVATION probing for the core-guards plugin, behind
+ * {@link coreGuardsWired}. The owner decision: the solid scope abstains from
+ * its file-size deny ONLY when core-guards is installed AND active — an
+ * installed-but-disabled plugin must leave the solid deny firing. Safe
+ * default, per harness: anything undetectable (unreadable/missing state)
+ * reads as NOT active, so the worst case is a duplicate deny — never zero.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** File content, or null when unreadable (undetectable → caller's safe default). */
+function readText(path: string): string | null {
+  try { return readFileSync(path, "utf8"); } catch { return null; }
+}
+
+/** First `core-guards@…` value in a name→bool map; undefined when absent. */
+function enabledEntry(map: unknown): boolean | undefined {
+  if (typeof map !== "object" || map === null || Array.isArray(map)) return undefined;
+  for (const [k, v] of Object.entries(map as Record<string, unknown>)) {
+    if (k.startsWith("core-guards@")) return v !== false;
+  }
+  return undefined;
+}
+
+/**
+ * Claude Code: `~/.claude/settings.json` → `enabledPlugins`. core-guards is a
+ * REQUIRED marketplace plugin: no entry means active whenever the marketplace
+ * copy exists (`installed`); an explicit `false` means disabled. Unreadable
+ * settings → false (undetectable).
+ * @param home - OS home.
+ * @param installed - Whether the marketplace copy of core-guards exists.
+ */
+export function claudeCoreGuardsActive(home: string, installed: boolean): boolean {
+  const text = readText(join(home, ".claude", "settings.json"));
+  if (text === null) return false;
+  try {
+    const entry = enabledEntry((JSON.parse(text) as { enabledPlugins?: unknown }).enabledPlugins);
+    return entry ?? installed;
+  } catch { return false; }
+}
+
+/**
+ * Codex: `[plugins."core-guards@<mkt>"] enabled = …` in `~/.codex/config.toml`
+ * (minimal section-scoped extraction — no TOML dependency). Missing section,
+ * `enabled = false`, or unreadable file → false.
+ * @param home - OS home.
+ */
+export function codexCoreGuardsActive(home: string): boolean {
+  const text = readText(join(home, ".codex", "config.toml"));
+  if (text === null) return false;
+  // `^` + `m`: the header must start a real line — an inert one-line comment
+  // like `# [plugins."core-guards@mkt"] enabled = true` must never match
+  // (verified: without the anchor it does, flipping this to a false "active"
+  // and silencing the solid file-size deny — the owner's "never zero deny").
+  const m = /^\[plugins\."core-guards@[^"]+"\]\s*enabled\s*=\s*(true|false)/m.exec(text);
+  return m?.[1] === "true";
+}
+
+/**
+ * Kimi: `<KIMI_CODE_HOME>/plugins/installed.json` — map form (`id →
+ * {enabled?}`) or array form (`[{id, enabled?}]`); an entry counts active
+ * unless `enabled === false`. File absent here today → format read
+ * tolerantly; missing/unreadable → false (undetectable).
+ * @param root - Kimi data root (`KIMI_CODE_HOME` ?? `~/.kimi-code`).
+ */
+export function kimiCoreGuardsActive(root: string): boolean {
+  const text = readText(join(root, "plugins", "installed.json"));
+  if (text === null) return false;
+  try {
+    const data = (JSON.parse(text) as { plugins?: unknown }).plugins;
+    if (Array.isArray(data)) {
+      const hit = data.find((p) => typeof p === "object" && p !== null && (p as { id?: unknown }).id === "core-guards");
+      return hit !== undefined && (hit as { enabled?: unknown }).enabled !== false;
+    }
+    if (typeof data !== "object" || data === null) return false;
+    for (const [k, v] of Object.entries(data as Record<string, unknown>)) {
+      if (k === "core-guards" || k.startsWith("core-guards@")) {
+        return typeof v === "object" && v !== null ? (v as { enabled?: unknown }).enabled !== false : v !== false;
+      }
+    }
+    return false;
+  } catch { return false; }
+}

package/src/runtime/core-guards-wired.ts

@@ -0,0 +1,47 @@
+/**
+ * Detect whether the core-guards plugin is installed AND ACTIVE for a harness.
+ * When it is, its `core` scope already owns the PreToolUse file-size deny
+ * (`policy/evaluate.ts`), so the `solid` scope MUST abstain on the same
+ * tool-call — otherwise a user with BOTH plugins wired on PreToolUse
+ * Write|Edit receives the identical deny twice. Activation probing is
+ * per-harness (`core-guards-active.ts`, owner decision):
+ * - claude-code: marketplace copy present + `settings.json` `enabledPlugins`
+ *   (required core: no entry = active; explicit `false` = disabled);
+ * - codex: `[plugins."core-guards@…"] enabled = true` in `~/.codex/config.toml`;
+ * - kimi: `<KIMI_CODE_HOME>/plugins/installed.json` entry not disabled.
+ * SAFE DEFAULT: anything undetectable (unreadable/missing state) reads as
+ * NOT active — the solid scope then fires its own deny, so the worst case is
+ * a duplicate deny, NEVER zero deny.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { claudeCoreGuardsActive, codexCoreGuardsActive, kimiCoreGuardsActive } from "./core-guards-active";
+
+/** Immediate child dir names of `dir`, or [] when unreadable. */
+function children(dir: string): string[] {
+  try { return readdirSync(dir); } catch { return []; }
+}
+
+/** Claude: marketplace copy `~/.claude/plugins/marketplaces/<m>/plugins/core-guards`. */
+function claudeInstalled(home: string): boolean {
+  const markets = join(home, ".claude", "plugins", "marketplaces");
+  return children(markets).some((m) => existsSync(join(markets, m, "plugins", "core-guards")));
+}
+
+/**
+ * True when core-guards is installed AND active for the harness.
+ * @param id - Harness id.
+ * @param env - Environment (defaults to `process.env`).
+ * @param home - OS home (defaults to `env.HOME` / `os.homedir()`; injectable).
+ */
+export function coreGuardsWired(
+  id: string,
+  env: Record<string, string | undefined> = process.env,
+  home: string = env.HOME ?? homedir(),
+): boolean {
+  if (id === "claude-code") return claudeCoreGuardsActive(home, claudeInstalled(home));
+  if (id === "codex") return codexCoreGuardsActive(home);
+  if (id === "kimi") return kimiCoreGuardsActive(env.KIMI_CODE_HOME ?? join(home, ".kimi-code"));
+  return false;
+}