@khoavu882/doflow 2.0.0-beta.4 → 2.0.0

package/core/harnesses/shared/hooks/bridge/envelope.jq

@@ -0,0 +1,129 @@
+def nonempty($v): if ($v | type) == "string" and $v != "" then $v else null end;
+def valid_model_id($v):
+  ($v | type) == "string" and ($v | length) >= 1 and ($v | length) <= 120 and
+  ($v | test("^[A-Za-z0-9][A-Za-z0-9 ._:/@()\\[\\]#+-]*$")) and
+  (($v | endswith(" ")) | not);
+def model_identity($v):
+  if ($v | type) != "string" then {}
+  elif valid_model_id($v) then {model:$v}
+  else {modelUnparsed:true} end;
+# Same reading as identity.ts and policies/identity.sh: ASCII-lowercased, main or worker kept, any other non-empty value is worker. Unset or empty stays null.
+def norm_role($v): if ($v | type) == "string" and $v != "" then ($v | ascii_downcase) as $l | if $l == "main" or $l == "worker" then $l else "worker" end else null end;
+def put($o; $k; $v): if $v == null then $o else $o + {($k): $v} end;
+def event_name($fallback): if (.hook_event_name | type) == "string" then .hook_event_name else $fallback end;
+def path_values($obj; $keys): first([$keys[] as $k | $obj[$k] | select(type == "string" and length > 0)][]) // null | if . == null then null else [.] end;
+def string_value($obj; $keys): first([$keys[] as $k | $obj[$k] | select(type == "string") ][]) // null;
+def session_identity($s): {session: nonempty($s)};
+def correlation($id;$parent): {toolCallId:nonempty($id),parentToolCallId:nonempty($parent)};
+def event_operation($e):
+  if $e == "SessionStart" or $e == "agentSpawn" then "session-start"
+  elif $e == "SessionEnd" then "session-end"
+  elif $e == "UserPromptSubmit" then "prompt"
+  elif $e == "Stop" or $e == "stop" then "stop"
+  elif $e == "SubagentStart" then "subagent-start"
+  elif $e == "SubagentStop" then "subagent-stop"
+  elif $e == "PreCompact" then "compact"
+  elif $e == "PostToolUse" then "post-tool"
+  else "tool" end;
+def canonical_tool($name; $harness):
+  if ($name | type) != "string" then {operation:"tool"}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and ($name | test("^mcp__"))) or ($harness == "antigravity" and ($name | test("^mcp_"))) or ($harness == "pi" and ($name | test("^mcp__"))) then {operation:"mcp",tool:$name}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and (["Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "antigravity" and (["write_to_file","replace_file_content","multi_replace_file_content","edit_file","write_file","create_file","replace_file","replace","Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "pi" and (["edit","write"] | index($name)) != null) then {operation:"edit",tool:$name}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and $name == "Bash") or ($harness == "antigravity" and (["run_command","run_shell_command","Bash","bash"] | index($name)) != null) or ($harness == "pi" and $name == "bash") then {operation:"command",tool:$name}
+  else {operation:"tool",tool:$name} end;
+def decode_claude:
+  (canonical_tool(.tool_name // ""; "claude")) as $t |
+  (if event_name($event) == "SessionStart" then model_identity(.model) else {} end) as $model |
+  if .tool_name == null then {operation: event_operation($event), identity: (session_identity(.session_id) + $model)}
+  else {operation:$t.operation, tool:$t.tool, paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path"]) else null end), command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end), identity:(session_identity(.session_id) + $model)} end;
+def decode_codex:
+  decode_claude as $d |
+  (model_identity(.model)) as $model |
+  (if .tool_name == "apply_patch" then $d + {patch:(string_value(.tool_input; ["command"]))} else $d end) |
+  .identity += $model;
+# Copilot CLI payloads (normalised to the Claude shape by the front door) carry no model, so the
+# envelope names none, whatever a payload happens to hold under .model.
+def decode_copilot:
+  decode_claude as $d |
+  (if .tool_name == "apply_patch" then $d + {patch:(string_value(.tool_input; ["command"]))} else $d end) |
+  .identity |= del(.model, .modelUnparsed);
+def decode_kiro:
+  (if ((.tool_name // "") | type) == "string" and ((.tool_name // "") | startswith("mcp_")) then {operation:"mcp",tool:.tool_name}
+   elif ((.tool_name // "") | type) == "string" and ((.tool_name // "") | test("^@[^/]+/.+")) then
+     ((.tool_name | capture("^@(?<server>[^/]+)/(?<tool>.+)$")) as $m | {operation:"mcp",tool:("mcp__" + $m.server + "__" + $m.tool)})
+   else canonical_tool(.tool_name // ""; "kiro") end) as $t |
+  if .tool_name == null then {operation:event_operation($event),identity:session_identity(.session_id)}
+  else {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path"]) else null end),command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end),identity:session_identity(.session_id)} end;
+def decode_antigravity:
+  (model_identity(.modelName)) as $model |
+  (session_identity(if (.session_id | type) == "string" and .session_id != "" then .session_id else .conversationId end) + $model) as $identity |
+  if .toolCall == null then {operation:event_operation($event),identity:$identity}
+  else (canonical_tool(.toolCall.name // ""; "antigravity")) as $t |
+    {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.toolCall.args; ["AbsolutePath","TargetFile","Path","file_path","path"]) else null end),command:(if $t.operation == "command" then string_value(.toolCall.args; ["CommandLine","command"]) else null end),identity:$identity} end;
+def decode_pi:
+  (canonical_tool(.toolName // ""; "pi")) as $t |
+  {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.input; ["path"]) else null end),command:(if $t.operation == "command" then string_value(.input; ["command"]) else null end),identity:(session_identity(.sessionId) + model_identity(.model)),correlation:(correlation(.toolCallId;.parentToolCallId))};
+# IC-005: only this closed vocabulary enters telemetry. The policy envelope keeps its command.
+def command_segment_class:
+  gsub("^\\s+|\\s+$"; "") | sub("^([A-Za-z_][A-Za-z0-9_]*=[^\\s]*\\s+)+"; "") |
+  if test("^cd\\s+") then "none"
+  elif test("^(doflow-run|doflow) verify( |$)") then "verify.verb"
+  elif test("^(npm|pnpm|yarn|bun)( run)? test$|^node --test( --[^ ]+)*( test/?)?$|^pytest( -[^ ]+)*$|^go test \\./\\.\\.\\.$|^cargo test$") then "test.full"
+  elif test("^(npm|pnpm|yarn|bun)( run)? test |^node --test |^pytest |^go test |^cargo test ") then "test.scoped"
+  elif test("(^| )(jest|vitest|mocha|playwright test)( |$)|^(npm|pnpm|yarn|bun) run test:[^ ]+") then "test.other"
+  else "none" end;
+def classify($cmd):
+  try (if ($cmd | type) != "string" then "none" else
+    ["verify.verb", "test.full", "test.scoped", "test.other", "none"] as $rank |
+    [$cmd | splits("&&|\\|\\||;|\\|") | command_segment_class | . as $c | $rank | index($c)] |
+    (min // 4) as $best | $rank[$best]
+  end) catch "none";
+# Telemetry tuple (IC-003): the first line in explicit `--arg mode encode`, read and stripped by
+# bridge.sh. Every telemetry expression sits inside the `try`, so a fault here yields {dft:1} and
+# never reaches the envelope; exactly one value comes out whatever the inside yields.
+def dft_token($v): if ($v | type) == "string" and ($v | test("^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$")) then $v else null end;
+def dft_id($v): if ($v | type) == "string" and ($v | test("^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$")) then $v else null end;
+def dft_tuple_base($native; $d):
+  if $ENV.DOFLOW_TELEMETRY == "off" then {dft:1} else
+  [try (now as $n | ($n | floor) as $s |
+    {dft:1, date:($s | strftime("%Y-%m-%d")),
+     timestamp:(($s | strftime("%Y-%m-%dT%H:%M:%S")) + "." + (((($n - $s) * 1000 | floor) + 1000 | tostring)[1:]) + "Z"),
+     session:dft_token($d.identity.session),
+     tool:(if $d.operation == "mcp" then null else dft_token($d.tool) end),
+     tool_call_id:dft_token(if $harness == "pi" then $native.toolCallId elif $harness == "claude" or $harness == "codex" then $native.tool_use_id else null end),
+     run:(dft_id($ENV.DOFLOW_RUN_ID) | if . == "local" then null else . end),
+     lineage:dft_id($ENV.DOFLOW_LINEAGE_ID),
+     attempt:($ENV.DOFLOW_ATTEMPT | if type == "string" and test("^[1-9][0-9]{0,3}$") then tonumber else null end),
+     role:norm_role($ENV.DOFLOW_SESSION_ROLE),
+     worker_run:($ENV.DOFLOW_WORKER_RUN | if type == "string" and test("\\Aw-[0-9a-f]{12}\\z") then . else null end)}) catch {dft:1}]
+  | if length == 1 then .[0] else {dft:1} end end;
+def dft_tuple($native; $d):
+  dft_tuple_base($native; $d) |
+  [try (
+    if . == {dft:1} then . else
+      (if $ARGS.named.mode == "observe" then . + {duration_ms:null, tool_duration_ms:($native.duration_ms |
+        if type == "number" and . >= 0 and . <= 9007199254740991 and . == floor then . else null end)} else . + {tool_duration_ms:null} end) |
+      if ($policy == "pre-bash-guard" or $ARGS.named.mode == "observe") and $d.operation == "command"
+      then . + {test_class:classify($d.command)} else . + {test_class:null} end
+    end) catch {dft:1}] | if length == 1 then .[0] else {dft:1} end;
+if ($ARGS.named.mode // "encode") == "minimal" then {doflow_event:{version:(1),harness:$harness,event:(event_name($event)),operation:event_operation($event)}} elif type != "object" then . else
+  . as $native |
+  ($ENV.DOFLOW_TASK_ID | nonempty(.)) as $task |
+  ($ENV.DOFLOW_RUN_ID | nonempty(.)) as $run |
+  ($ENV.DOFLOW_ATTEMPT | try tonumber catch null) as $attempt |
+  ($ENV.DOFLOW_LINEAGE_ID | nonempty(.)) as $lineage |
+  ($ENV.DOFLOW_WORKTREE | nonempty(.)) as $worktree |
+  norm_role($ENV.DOFLOW_SESSION_ROLE) as $role |
+  (if $harness == "claude" then decode_claude elif $harness == "codex" then decode_codex elif $harness == "kiro" then decode_kiro elif $harness == "copilot" then decode_copilot elif $harness == "antigravity" then decode_antigravity elif $harness == "pi" then decode_pi else {operation:"tool"} end) as $d |
+  if $ARGS.named.mode == "observe" then
+    if $harness == "claude" and $d.operation == "command" and $native.hook_event_name == $event and
+      ($event == "PostToolUse" or $event == "PostToolUseFailure")
+    then dft_tuple($native; $d) else {dft:1} end
+  else
+  ({version:1,harness:$harness,event:(event_name($event)),operation:$d.operation,tool:$d.tool,paths:$d.paths,command:$d.command,patch:$d.patch,taskId:$task,
+    identity:($d.identity + {run:$run,attempt:$attempt,lineage:$lineage,role:$role,worktree:$worktree} | with_entries(select(.value != null)) | if length > 0 then . else null end),
+    correlation:(($d.correlation // {}) | with_entries(select(.value != null)) | if length > 0 then . else null end) } | with_entries(select(.value != null))) as $envelope |
+  (if $ARGS.named.mode == "encode" then dft_tuple($native; $d) else empty end),
+  $native + {doflow_event:$envelope}
+  end
+end

package/core/harnesses/shared/hooks/bridge/observe-model.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# observe-model.sh — the shared bridge step `observe-model` (row 120 IC-005).
+#
+# Defines doflow_observe_model <harness> <envelope>. Sourcing defines it only. bridge.sh calls it once
+# per event, after the envelope is built, in a subshell with every stream discarded:
+#
+#   ( . "<bridge-dir>/observe-model.sh" && doflow_observe_model "$harness" "$payload" ) >/dev/null 2>&1 </dev/null || true
+#
+# so it never changes the decision, the exit code or the output, and every I/O error is ignored.
+#
+# When the envelope carries identity.model and a session id it records the model in one file under
+# lib.sh's STATE_DIR (<config home>/doflow/session-env):
+#   - main session (DOFLOW_SESSION_ROLE unset or main): primary/<cwd_hash cwd>/<harness>/<sessionKey>.json,
+#     where cwd is the payload's absolute `cwd`, else the hook's working directory;
+#   - worker (any other role, identity.sh's reading) with a launched identity (DOFLOW_RUN_ID other
+#     than `local`, DOFLOW_LINEAGE_ID and DOFLOW_ATTEMPT, identity.sh's patterns):
+#     worker-model/L.<run>.<lineage>.<attempt>.json. A worker without one writes nothing.
+# sessionKey is the first 16 hex of the sha256 of the session id's bytes. The file holds exactly
+#   {"schema":1,"harness":"<id>","model":"<model-id>","event":"<event>","observedAt":"<UTC>","session":"<sessionKey>"}
+# and is written only when absent or when its model differs: a tmp file in the same folder, then a
+# rename, mode 0600. With no config home, no sha256 tool or a link in place of the file, nothing.
+# The storage stores model-observations and worker-model-observations bound both folders.
+
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_OBSERVE_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_OBSERVE_DIR=. ;; esac
+
+doflow_observe_model() {
+  local harness="${1:-}" envelope="${2:-}" fields="" model="" model_json="" session="" cwd="" event="" now=""
+  local key="" dir="" file="" current="" tmp="" run="${DOFLOW_RUN_ID:-}" lineage="${DOFLOW_LINEAGE_ID:-}" attempt="${DOFLOW_ATTEMPT:-}"
+  case "$harness" in ''|*[!a-z0-9-]*) return 0 ;; esac
+  # lib.sh gives STATE_DIR (the config-home rule), cwd_hash and identity.sh's role reading.
+  . "$_DOFLOW_OBSERVE_DIR/../policies/lib.sh" || return 0
+  [ -n "${STATE_DIR:-}" ] || return 0
+  fields=$(printf '%s\n' "$envelope" | jq -r '
+    def text: type == "string" and length > 0 and (test("[[:cntrl:]]") | not);
+    .doflow_event as $e
+    | select(($e.identity.model | text) and ($e.identity.session | text))
+    | $e.identity.model, ($e.identity.model | tojson), $e.identity.session,
+      (if (.cwd | text) and (.cwd | startswith("/")) then .cwd else "-" end),
+      ($e.event | tojson), (now | strftime("%Y-%m-%dT%H:%M:%SZ"))' 2>/dev/null) || return 0
+  { IFS= read -r model && IFS= read -r model_json && IFS= read -r session && IFS= read -r cwd \
+    && IFS= read -r event && IFS= read -r now; } <<<"$fields" || return 0
+
+  if command -v sha256sum >/dev/null 2>&1; then key=$(printf '%s' "$session" | sha256sum | cut -c1-16)
+  elif command -v shasum >/dev/null 2>&1; then key=$(printf '%s' "$session" | shasum -a 256 | cut -c1-16)
+  else return 0; fi
+  [[ $key =~ ^[0-9a-f]{16}$ ]] || return 0
+
+  _doflow_role_resolve
+  if [ "$_DF_ROLE" = main ]; then
+    case "$cwd" in /*) ;; *) cwd=$PWD ;; esac
+    dir="$STATE_DIR/primary/$(cwd_hash "$cwd")/$harness"
+    file="$dir/$key.json"
+  else
+    [ "$run" != local ] && [[ $run =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]] || return 0
+    [[ $lineage =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]] && [[ $attempt =~ ^[1-9][0-9]{0,3}$ ]] || return 0
+    dir="$STATE_DIR/worker-model"
+    file="$dir/L.$run.$lineage.$attempt.json"
+  fi
+
+  [ ! -L "$file" ] || return 0
+  if [ -f "$file" ]; then
+    current=$(jq -r 'if (.model | type) == "string" then .model else empty end' "$file" 2>/dev/null) || current=""
+    [ "$current" != "$model" ] || return 0
+  fi
+  umask 077
+  mkdir -p "$dir" || return 0
+  tmp="$file.tmp.$$"
+  if printf '{"schema":1,"harness":"%s","model":%s,"event":%s,"observedAt":"%s","session":"%s"}\n' \
+      "$harness" "$model_json" "$event" "$now" "$key" >"$tmp" && mv -f "$tmp" "$file"; then
+    return 0
+  fi
+  rm -f "$tmp"
+  return 0
+}

package/core/harnesses/shared/hooks/bridge/respond.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# Native hook response renderers for the shared lifecycle bridge.
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_RESPOND_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_RESPOND_DIR=. ;; esac
+. "$_DOFLOW_RESPOND_DIR/../policies/deny-json.sh"
+
+doflow_bridge_native_event_var() {
+  DF_NE=$2
+  case "$1:$2" in
+    kiro:preToolUse) DF_NE=PreToolUse ;;
+    kiro:agentSpawn) DF_NE=SessionStart ;;
+    kiro:stop) DF_NE=Stop ;;
+  esac
+}
+
+doflow_bridge_native_event() {
+  local harness="$1" event="$2"
+  case "$harness:$event" in
+    kiro:preToolUse) event=PreToolUse ;;
+    kiro:agentSpawn) event=SessionStart ;;
+    kiro:stop) event=Stop ;;
+  esac
+  printf '%s\n' "$event"
+}
+
+doflow_render_response() {
+  local harness="$1" event="$2" outcome="$3" reason="$4" status="$5" engine="${DOFLOW_KIRO_ENGINE:-2x}"
+  doflow_bridge_native_event_var "$harness" "$event"; event=$DF_NE
+  if [ "$outcome" = deny ]; then
+    case "$harness:$event" in
+      claude:PreToolUse|codex:PreToolUse) emit_pretooluse_deny_nested "$reason" || return $?; return 0 ;;
+      kiro:PreToolUse) printf '%s' "$reason" >&2; return 2 ;;
+      antigravity:PreToolUse)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"deny",reason:$reason}'
+        else printf '{"decision":"deny","reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
+      antigravity:Stop)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"continue",reason:$reason}'
+        else printf '{"decision":"continue","reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
+      copilot:PreToolUse)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{permissionDecision:"deny",permissionDecisionReason:$reason}'
+        else printf '{"permissionDecision":"deny","permissionDecisionReason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
+      copilot:Stop)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"block",reason:$reason}'
+        else printf '{"decision":"block","reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
+      pi:tool_call)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{block:true,reason:$reason}'
+        else printf '{"block":true,"reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
+      kiro:Stop|kiro:stop)
+        if [ "$engine" = v3 ]; then
+          if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"block",reason:$reason}'
+          else printf '{"decision":"block","reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+          return $?
+        fi
+        printf '%s' "$reason" >&2; return 2 ;;
+      codex:Stop|codex:stop) printf '%s\n' '{}' >&1; printf '%s\n' "$reason" >&2; return 2 ;;
+      *) printf '%s\n' "$reason" >&2; return 2 ;;
+    esac
+  fi
+  case "$harness:$event" in
+    codex:Stop|codex:stop) printf '%s\n' '{}' ;;
+    antigravity:PreToolUse) printf '%s\n' '{"decision":"allow"}' ;;
+    kiro:PreToolUse|claude:Stop) if [ "$status" -ne 0 ]; then printf '%s' "$reason" >&2; fi ;;
+  esac
+  return "$status"
+}

package/core/harnesses/shared/hooks/policies/blocked-patterns.conf

@@ -4,27 +4,36 @@
 #   regex<TAB>reason shown to the harness<TAB>exclude_regex (optional)
 #
 # Rules:
-#   - Lines beginning with # are comments (skipped)
+#   - Lines beginning with # are comments (skipped), except the marker
+#     #@exempt-next worker-worktree arms only the next pattern line for the
+#     hook's exact dispatch-worker reset/clean exemption. The worker-dropdb
+#     marker arms only the DROP row for one exact listed database invocation
+#     from the launch snapshot. Other rules still run.
 #   - Empty lines are skipped
 #   - Regex is POSIX Extended Regular Expression (ERE, as used by `grep -E`),
 #     matched case-insensitively against the full command string (RM and GIT run
 #     on a case-insensitive filesystem such as the macOS default), which
 #     includes any expanded heredocs or -m "..." arguments. Git and rm
 #     patterns use a command-context anchor:
-#       (^|[[:space:]]*(&&|\|\||;)[[:space:]]*)
+#       (^|[;&|(`])[[:space:]]*
 #     so they only fire when the dangerous text is an actual invocation,
 #     not when it appears as text inside a commit message or other argument.
 #   - Anchored patterns (those beginning with "(^|") are matched against the
 #     command with quoted text blanked out (pre-bash-guard.sh scrub_quotes),
 #     so echo "x && rm -rf /" or git commit -m "git reset --hard" is not a
 #     command. The argument of sh -c, bash -c, zsh -c and eval is NOT blanked
-#     (it executes). Every other pattern is matched against the full text.
-#   - The rm lines use a wider command position than the others: start of a
+#     (it executes). SQL rules use the raw full text. Only the three shipped
+#     SQL rows may be skipped by the hook's positive raw-command text-only
+#     allow-list: literal commit/echo/printf/gh bodies or exact quoted heredocs
+#     to commit/cat/gh (including the Claude commit cat substitution).
+#     Other shapes retain the raw SQL verdict; dot-led file targets are excluded.
+#   - The git, rm and find lines use command positions at the start of a
 #     line or after ; & | ( or a backtick, then optional sudo/command/time/
 #     nohup/exec/env (with options, VAR=x and, per wrapper, the options that take
 #     a separate argument: sudo -u/-g/-C/-h/-p/-r/-t/-U/-D/-R and --user/--group
-#     root, xargs -n/-I/-L/-P/-s/-d/-E/-a, env -u/-C/-S)/xargs/eval/then/do/else, then rm,
-#     \rm, /bin/rm or /usr/bin/rm. "git rm" and "echo rm -rf /" are therefore
+#     root, xargs -n/-I/-L/-P/-s/-d/-E/-a, env -u/-C/-S)/xargs/eval/then/do/else
+#     or bare NAME=value assignments, then git/rm/find, optionally prefixed
+#     with \, /bin/ or /usr/bin/. "git rm" and "echo rm -rf /" are therefore
 #     not matched. pre-bash-guard.sh's hardcoded floor uses the same rule.
 #     Matching is case-insensitive, so an uppercase flag-only option that shares a
 #     letter with a value-taking one (sudo -H beside -h, xargs -p beside -P) is
@@ -34,6 +43,8 @@
 #     inside a flag cluster such as -uf), --force and a +refspec; the
 #     --force-with-lease form stays allowed, as the reason text advises, but a
 #     +refspec still blocks next to a lease (git push --force-with-lease origin +main).
+#     The clean rule also blocks -ff: double force can delete nested repos and
+#     is never eligible for the worker-worktree exemption.
 #   - The find rule blocks -delete, and -exec rm, off the root, a home directory
 #     or a system directory (among other start paths, find or \find or
 #     /usr/bin/find) when only -type, -maxdepth/-mindepth N, -mount, -xdev,
@@ -54,18 +65,21 @@
 # Add project-specific patterns at the bottom of this file.
 
 # ── Dangerous git operations ──────────────────────────────────────────────────
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(--force|-[a-zA-Z]*f[a-zA-Z]*)([^-[:alnum:]]|$)	Force push blocked — use --force-with-lease or confirm with user first
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+\+[^[:space:];&|]+	Force push blocked — use --force-with-lease or confirm with user first
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+reset --hard	Destructive reset blocked — commit or stash changes before resetting
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+clean -fd	Irreversible clean blocked — use --dry-run to preview what would be deleted
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(--force|-[a-zA-Z]*f[a-zA-Z]*)([^-[:alnum:]]|$)	Force push blocked — use --force-with-lease or confirm with user first
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+\+[^[:space:];&|]+	Force push blocked — use --force-with-lease or confirm with user first
+#@exempt-next worker-worktree
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+reset --hard	Destructive reset blocked — commit or stash changes before resetting
+#@exempt-next worker-worktree
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+(clean -fd|clean -ff)	Irreversible clean blocked — use --dry-run to preview what would be deleted
 
 # ── Filesystem catastrophes ───────────────────────────────────────────────────
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/+\*{0,2})([[:space:];&|)`]|$)|(/+\*{0,2})([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the root directory (/)
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:];&|)`]|$)|((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the home directory
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:];&|)`]|$)|(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of a system directory
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?find([[:space:]]+-[HLP])*([[:space:]]+[^-[:space:];&|][^[:space:];&|]*)*[[:space:]]+(/+\*{0,2}|(~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?|/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+([^-[:space:];&|][^[:space:];&|]*|-(mount|xdev|depth|noleaf|follow|ignore_readdir_race)|-(type|maxdepth|mindepth)[[:space:]]+[^[:space:];&|]+))*[[:space:]]+(-delete([[:space:];&|)`]|$)|-exec(dir)?[[:space:]]+(\\|/(usr/)?bin/)?rm([[:space:];&|)`]|$))	Catastrophic delete blocked — find -delete or -exec rm from the root, home or a system directory with no name, path or time predicate to scope it
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/+\*{0,2})([[:space:];&|)`]|$)|(/+\*{0,2})([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the root directory (/)
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:];&|)`]|$)|((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the home directory
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:];&|)`]|$)|(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of a system directory
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?find([[:space:]]+-[HLP])*([[:space:]]+[^-[:space:];&|][^[:space:];&|]*)*[[:space:]]+(/+\*{0,2}|(~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?|/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+([^-[:space:];&|][^[:space:];&|]*|-(mount|xdev|depth|noleaf|follow|ignore_readdir_race)|-(type|maxdepth|mindepth)[[:space:]]+[^[:space:];&|]+))*[[:space:]]+(-delete([[:space:];&|)`]|$)|-exec(dir)?[[:space:]]+(\\|/(usr/)?bin/)?rm([[:space:];&|)`]|$))	Catastrophic delete blocked — find -delete or -exec rm from the root, home or a system directory with no name, path or time predicate to scope it
 
 # ── SQL destructive statements (no anchor — must catch inside psql heredocs) ──
+#@exempt-next worker-dropdb
 DROP[[:space:]]+(TABLE|DATABASE|SCHEMA)[[:space:]]	Destructive DDL blocked — confirm with user before dropping
 DELETE[[:space:]]+FROM[[:space:]]+[[:alnum:]_]+[[:space:]]*;	Unscoped DELETE blocked — this would affect all rows, add a WHERE clause
 TRUNCATE[[:space:]]+TABLE	Irreversible truncate blocked — confirm with user before truncating

package/core/harnesses/shared/hooks/policies/capture-failure.sh

@@ -6,7 +6,7 @@
 # example its pattern file is missing). It exists only to be sourced, in a subshell with all output
 # discarded, from inside a branch where the policy already fails open:
 #
-#   ( . "$(dirname "$0")/capture-failure.sh"; doflow_capture_failure pre-bash-guard patterns-missing ) >/dev/null 2>&1 || true
+#   ( . "<policy-dir>/capture-failure.sh"; doflow_capture_failure pre-bash-guard patterns-missing ) >/dev/null 2>&1 || true
 #
 # The subshell keeps anything this file does away from the policy, which runs with `set -uo pipefail`,
 # does not source lib.sh and would change exit codes under `set -e`. So this file:
@@ -15,28 +15,61 @@
 #   - reads no stdin and writes nothing to stdout or stderr;
 #   - never rotates the file (rotation is done by the Node writers only, DEC-019);
 #   - never blocks, never changes the policy's decision, and swallows every error.
+
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_CAPTURE_FAILURE_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_CAPTURE_FAILURE_DIR=. ;; esac
 # The line holds only the policy name and the point name from DoFlow's own code, the working
 # directory, the harness name and the install version: never the tool call, its arguments or stdin.
-# It is a no-op when no failure home can be resolved (HOME unset, or XDG_CONFIG_HOME relative) and
-# while capture is off (the `off` sentinel file wins; DOFLOW_FAILURE_CAPTURE=off|0|false|no also
-# turns it off), the same rules the Node writer follows (IC-011, IC-014).
+# It is a no-op when there is no config home (neither XDG_CONFIG_HOME nor HOME is set to an absolute
+# path; doflow_config_home below) and while capture is off (DOFLOW_FAILURE_CAPTURE=off|0|false|no,
+# the `off` sentinel file, or a `failure.capture` value other than "on" in <config home>/settings.json,
+# read by doflow_lex_capture below), the same rules the Node writer follows (IC-011, IC-014, IC-005).
+# The two marked blocks are byte-identical to the ones in bin/doflow-run.
+
+# BEGIN doflow-config-home v1 (rule: src/runtime/config-home.js; checked by test/guards/settings.test.js)
+doflow_config_home() {
+  DOFLOW_HOME=""
+  case "${XDG_CONFIG_HOME:-}" in
+    /*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;; esac ;;
+  esac
+  case "${HOME:-}" in
+    /*) DOFLOW_HOME="${HOME}/.config/doflow" ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${HOME}/.config/doflow" ;; esac ;;
+  esac
+  return 0
+}
+# END doflow-config-home v1
+
+# BEGIN doflow-settings-lexical v1 (rule: src/runtime/settings/lexical.js; checked by test/guards/settings.test.js)
+doflow_lex_capture() {
+  local f="${1:-}" text="" rest="" d=""
+  local re='"failure\.capture"[[:space:]]*:[[:space:]]*("[^"]*"|[^,}"[:space:]]*)'
+  DOFLOW_LEX_CAPTURE=""
+  if [ ! -e "$f" ]; then
+    # Missing is no setting, unless the folder holding it cannot be searched (Node: EACCES is off).
+    d="${f%/*}"
+    if [ -n "$d" ] && [ "$d" != "$f" ] && [ -d "$d" ] && [ ! -x "$d" ]; then DOFLOW_LEX_CAPTURE="off"; fi
+    return 0
+  fi
+  if [ ! -f "$f" ] || [ ! -r "$f" ]; then DOFLOW_LEX_CAPTURE="off"; return 0; fi
+  IFS= read -r -d '' text < "$f" || true
+  rest="$text"
+  while [[ $rest =~ $re ]]; do
+    if [ "${BASH_REMATCH[1]}" = '"on"' ]; then DOFLOW_LEX_CAPTURE="${DOFLOW_LEX_CAPTURE:-on}"; else DOFLOW_LEX_CAPTURE="off"; fi
+    rest="${rest#*"${BASH_REMATCH[0]}"}"
+  done
+  return 0
+}
+# END doflow-settings-lexical v1
 
 doflow_capture_failure() {
   local policy="${1:-}" point="${2:-}"
   local LC_ALL=C   # byte-wise lengths and cuts; scoped to this function
   local home="" setting="" version="" harness="" project="" cwd="" hp="" at="" line="" here="" dir=""
 
-  if [ -n "${XDG_CONFIG_HOME:-}" ]; then
-    case "$XDG_CONFIG_HOME" in
-      /*) home="$XDG_CONFIG_HOME/doflow/failures" ;;
-      *) return 0 ;;
-    esac
-  else
-    case "${HOME:-}" in
-      /*) home="$HOME/.config/doflow/failures" ;;
-      *) return 0 ;;
-    esac
-  fi
+  doflow_config_home
+  [ -n "$DOFLOW_HOME" ] || return 0
+  home="$DOFLOW_HOME/failures"
 
   # Case-insensitive, whitespace trimmed at the ends only: the same reading the Node writer has.
   setting="$(printf '%s' "${DOFLOW_FAILURE_CAPTURE:-}" | tr '[:upper:]' '[:lower:]')" || return 0
@@ -46,6 +79,8 @@ doflow_capture_failure() {
     off|0|false|no) return 0 ;;
   esac
   [ -f "$home/off" ] && return 0
+  doflow_lex_capture "$DOFLOW_HOME/settings.json"
+  [ "$DOFLOW_LEX_CAPTURE" = off ] && return 0
 
   [[ "$policy" =~ ^[a-z][a-z0-9-]{0,39}$ ]] || policy="unknown"
   [[ "$point" =~ ^[A-Za-z][A-Za-z0-9._:-]{0,39}$ ]] || return 0
@@ -54,7 +89,7 @@ doflow_capture_failure() {
   [[ "$harness" =~ ^[A-Za-z0-9._-]{1,40}$ ]] || harness="none"
 
   # script_version of the nearest install manifest: walking up from this file, then the global one.
-  here="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P)" || here=""
+  here="$(CDPATH= cd -P -- "$_DOFLOW_CAPTURE_FAILURE_DIR" 2>/dev/null && pwd -P)" || here=""
   dir="$here"
   while [ -n "$dir" ] && [ -z "$version" ]; do
     if [ -f "$dir/.doflow/.install-manifest.json" ]; then

package/core/harnesses/shared/hooks/policies/compact-text.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# IC-001 (feature 116): shared PreCompact text builder; sourced, not executed.
+
+doflow_compact_text() {
+  local CWD="${1:-}"
+  local preserve branch sha uncommitted recent text
+
+  preserve='Preserve: decisions made, files modified, open questions, planned next steps, acceptance criteria and pending verification of the active task.'
+
+  if [[ -n "$CWD" ]] && is_git_worktree "$CWD"; then
+    branch=$(git_branch_of "$CWD" || echo "")
+    sha=$(git_short_sha_of "$CWD" || echo "")
+    uncommitted=$(git_uncommitted_count_of "$CWD" || echo "0")
+    recent=$(run_with_timeout 1 -- git -C "$CWD" log --format="%h %s" -2 2>/dev/null \
+      | awk 'NR>1{printf " | "}{printf "%s",$0}' || echo "")
+
+    text=$(printf '%s\nInclude in compact summary:\n- git branch: %s sha: %s\n- uncommitted files: %s\n- cwd: %s\n- recent commits: %s' \
+      "$preserve" "${branch:-unknown}" "${sha:-unknown}" "$uncommitted" "${CWD:-unknown}" "${recent:-none}")
+  else
+    text=$(printf '%s\nInclude in compact summary:\n- cwd: %s (not a git repository)' \
+      "$preserve" "${CWD:-unknown}")
+  fi
+
+  # The cap is 490 BYTES in every locale: LC_ALL=C makes the substring and length below count bytes,
+  # where a UTF-8 locale would count characters. A cut can then end inside a multi-byte character, so
+  # a trailing partial UTF-8 sequence is dropped (FU-tsq77m).
+  local LC_ALL=C cut i b need
+  cut="${text:0:490}"
+  i=$(( ${#cut} - 1 ))
+  # Walk back over at most three continuation bytes (0x80-0xBF) to the byte that starts the last character.
+  while [[ $i -ge 1 && $(( ${#cut} - i )) -le 3 ]]; do
+    printf -v b '%d' "'${cut:i:1}"
+    b=$(( b & 255 )) # the shell may print a byte above 127 as a negative number (bash 3.2) or a code unit
+    [[ $b -ge 128 && $b -lt 192 ]] || break
+    i=$(( i - 1 ))
+  done
+  printf -v b '%d' "'${cut:i:1}"
+  b=$(( b & 255 ))
+  need=1
+  [[ $b -ge 192 ]] && need=2
+  [[ $b -ge 224 ]] && need=3
+  [[ $b -ge 240 ]] && need=4
+  [[ $(( ${#cut} - i )) -lt $need ]] && cut="${cut:0:i}"
+  DF_COMPACT_TEXT="$cut"
+  return 0
+}

package/core/harnesses/shared/hooks/policies/contract.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# contract.sh — shared decision and envelope contract for canonical policies.
+#
+# This file is sourced by policy scripts. It sets no shell options, installs no traps, reads no
+# stdin, and keeps decision recording independent of jq.
+
+doflow_decision_init() {
+  DF_POLICY="${1:-}"
+  DF_POLICY_VERSION="${2:-0}"
+  doflow_decide allow allow
+}
+
+doflow_decide() {
+  local LC_ALL=C
+  local outcome="${1:-allow}" code="${2:-invalid-code}" fd="${DOFLOW_DECISION_FD:-}"
+  case "$code" in
+    [a-z]*)
+      case "$code" in
+        *[!a-z0-9:._-]*) code=invalid-code ;;
+        *) [ "${#code}" -le 40 ] || code=invalid-code ;;
+      esac
+      ;;
+    *) code=invalid-code ;;
+  esac
+  case "$fd" in
+    3|4|5|6|7|8|9)
+      # A caller may set the descriptor name without passing an open fd. Keep
+      # that broken handoff silent and harmless, including under `set -e`.
+      { printf '\036{"v":1,"policy":"%s","policyVersion":%s,"outcome":"%s","code":"%s"}\n' \
+        "${DF_POLICY:-}" "${DF_POLICY_VERSION:-0}" "$outcome" "$code" >&"$fd"; } 2>/dev/null || :
+      ;;
+  esac
+}
+
+doflow_read_envelope() {
+  local assignments
+  if [ -z "${INPUT:-}" ]; then
+    DF_ENV_CLASS=missing
+    DF_ENV_CODE=envelope-missing
+    DF_ENV_HARNESS=
+    DF_ENV_EVENT=
+    DF_ENV_OP=
+    DF_ENV_TOOL=
+    DF_ENV_PATHS=
+    DF_ENV_COMMAND=
+    DF_ENV_CWD=
+    DF_ENV_PATCH=
+    DF_ENV_ROOT=
+    DF_ENV_TASK=
+    return 0
+  fi
+  assignments=$(printf '%s' "${INPUT:-}" | jq -sr '
+    (.[0]) as $root |
+    ($root | if type == "object" then . else {} end) as $object |
+    ($object.doflow_event // {}) as $event |
+    ($event | if type == "object" then . else {} end) as $fields |
+    def field($key): ($fields[$key] // "") | if type == "string" then . else "" end;
+    def shellvar($name; $value): ($name + "=" + ($value | @sh));
+    (if ($root | type) != "object" or (($event | type) != "object") then "missing"
+     elif ($event | has("version") | not) then "missing"
+     elif ($event.version | type) == "number" and $event.version == 1 then "v1"
+     else "unsupported" end) as $class |
+    [shellvar("DF_ENV_CLASS"; $class),
+     shellvar("DF_ENV_CODE"; (if $class == "missing" then "envelope-missing" else "" end)),
+     shellvar("DF_ENV_HARNESS"; field("harness")),
+     shellvar("DF_ENV_EVENT"; field("event")),
+     shellvar("DF_ENV_OP"; field("operation")),
+     shellvar("DF_ENV_TOOL"; field("tool")),
+     shellvar("DF_ENV_PATHS"; ([$fields.paths[]? | select(type == "string")] | join("\n"))),
+     shellvar("DF_ENV_COMMAND"; field("command")),
+     shellvar("DF_ENV_CWD"; ($object.cwd // "") | if type=="string" then . else "" end),
+     shellvar("DF_ENV_PATCH"; field("patch")),
+     shellvar("DF_ENV_ROOT"; field("projectRoot")),
+     shellvar("DF_ENV_TASK"; field("taskId"))][]
+  ' 2>/dev/null) || return 1
+  eval "$assignments"
+}