@khoavu882/doflow 2.0.0-beta.5 → 2.0.0

package/core/harnesses/kiro/hooks/pre-bash-guard.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # Kiro front door: pre-bash-guard through the shared lifecycle bridge.
 set -euo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"

package/core/harnesses/kiro/hooks/pre-implement-gate.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # Kiro front door: pre-implementation-gate through the shared lifecycle bridge.
 set -euo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"

package/core/harnesses/kiro/hooks/session-start.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # Kiro front door: session-context through the shared lifecycle bridge.
 set -euo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"

package/core/harnesses/kiro/hooks/stop-check.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # Kiro Stop front door: translate the native payload, then render the bridge verdict for its engine.
 set -uo pipefail
 export DOFLOW_AGENT="${DOFLOW_AGENT:-kiro}"

package/core/harnesses/pi/extensions/doflow-guard.js

@@ -138,6 +138,13 @@ export default function (pi) {
         captureFailure(policy, 'bridge-missing');
         return { block: true, reason: '[doflow] shared hooks lack the bridge; run: doflow update -t pi' };
       }
+      let model;
+      try {
+        const modelId = ctx.model?.id;
+        if (typeof modelId === 'string' && modelId.length > 0) model = modelId;
+      } catch {
+        // A model getter must not prevent the tool call from reaching the bridge.
+      }
       const payload = JSON.stringify({
         type: event.type,
         toolName: event.toolName,
@@ -146,6 +153,7 @@ export default function (pi) {
         input: event.input,
         cwd: ctx.cwd,
         sessionId: ctx.sessionManager?.getSessionId?.() ?? null,
+        ...(model ? { model } : {}),
       });
       if (Buffer.byteLength(payload) > LIMIT) throw Object.assign(new Error('bridge input exceeded limit'), { failurePoint: 'bridge-input-limit' });
       return await bridgeCall(policy, payload, ctx);

package/core/harnesses/shared/hooks/ENVELOPE_MIGRATION.md

@@ -22,7 +22,6 @@ tool's official docs (cross-checked against tool source where docs were incomple
 |---|---|---|
 | Claude Code | `PreToolUse` | `tool_name` Edit/Write/MultiEdit; `tool_input.file_path` |
 | Codex | `PreToolUse` | `apply_patch` carries paths inside a unified diff under `tool_input.command` — the ONE decoder that must parse patch text |
-| Gemini CLI | `BeforeTool` | also offers `BeforeToolSelection` (pre-selection restriction), which the gate does not use |
 | GitHub Copilot | `preToolUse` | camelCase event names; `permissionRequest` is CLI-only, not fired in the cloud agent |
 | OpenCode | `tool.execute.before` | a pluggable hook method, not a sub-event of the generic `event` hook |
 | Pi | `tool_call` | The live-observed `cli-extension` pre-implementation gate row blocks. Project-interactive and user-interactive rows remain unknown; interactive loading and project-trust behavior were not observed. `tool_execution_start` is observation-only |

package/core/harnesses/shared/hooks/bridge/bridge.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # Shared lifecycle bridge. Sourcing defines functions only; it sets no shell options or traps.
-case ${BASH_SOURCE[0]} in */*) _DOFLOW_BRIDGE_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLOW_BRIDGE_DIR=. ;; esac
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_BRIDGE_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_BRIDGE_DIR=. ;; esac
 
 doflow_bridge_failure() {
   local policy="$1" point="$2"
@@ -47,13 +48,20 @@ doflow_bridge_effect() {
   elif [ "$profile" = strict-1 ] && [ "$block" -eq 1 ] && [ "$policy" != stop-check ] && { [ "$outcome" = error ] || [ "$outcome" = unsupported ] || [ "$DF_BRIDGE_CODE" = bridge-spawn ] || [ "$DF_BRIDGE_CODE" = envelope-encode ]; }; then DF_BRIDGE_EFFECT=block
   elif [ "$outcome" = error ] && [ "$DF_BRIDGE_CODE" != bridge-spawn ] && [ -n "$DF_BRIDGE_POINT" ] && [ "$profile" = compat-1 ]; then
     case "$harness:$event" in
-      claude:PreToolUse|codex:PreToolUse|gemini:BeforeTool|pi:tool_call) DF_BRIDGE_EFFECT=block ;;
+      claude:PreToolUse|codex:PreToolUse|copilot:PreToolUse|pi:tool_call) DF_BRIDGE_EFFECT=block ;;
       antigravity:PreToolUse|antigravity:Stop) case "$DF_BRIDGE_CODE" in signal-*) DF_BRIDGE_EFFECT=proceed;; *) DF_BRIDGE_EFFECT=block;; esac ;;
       kiro:PreToolUse) [ "$DF_BRIDGE_CODE" = exit-2-unmarked ] && DF_BRIDGE_EFFECT=block ;;
       claude:Stop) [ "$DF_BRIDGE_CODE" = exit-2-unmarked ] && DF_BRIDGE_EFFECT=block ;;
-      codex:Stop|codex:stop|kiro:Stop|kiro:stop) [ "$DF_BRIDGE_CODE" = exit-2-unmarked ] && DF_BRIDGE_EFFECT=block || DF_BRIDGE_EFFECT=proceed ;;
+      codex:Stop|codex:stop|copilot:Stop|kiro:Stop|kiro:stop) [ "$DF_BRIDGE_CODE" = exit-2-unmarked ] && DF_BRIDGE_EFFECT=block || DF_BRIDGE_EFFECT=proceed ;;
     esac
   fi
+  # Copilot CLI: a guarded preToolUse policy that errors or cannot decide (jq or the policy script
+  # missing, an edit with no decodable target) denies whatever the fault profile; only a policy that
+  # answered allow or advisory lets the call through. Copilot-only: every other harness keeps the
+  # profile rules above byte for byte.
+  if [ "$block" -eq 1 ] && [ "$DF_BRIDGE_EFFECT" = proceed ] && [ "$harness:$event" = copilot:PreToolUse ] && [ "$policy" != stop-check ]; then
+    case "$outcome" in error|unsupported) DF_BRIDGE_EFFECT=block ;; esac
+  fi
 }
 
 doflow_bridge_drops_tool_streams() {
@@ -62,7 +70,7 @@ doflow_bridge_drops_tool_streams() {
     *) return 1 ;;
   esac
   case "$2:$3" in
-    claude:PreToolUse|codex:PreToolUse|gemini:BeforeTool|kiro:PreToolUse|antigravity:PreToolUse|antigravity:Stop|pi:tool_call) return 0 ;;
+    claude:PreToolUse|codex:PreToolUse|copilot:PreToolUse|kiro:PreToolUse|antigravity:PreToolUse|antigravity:Stop|pi:tool_call) return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -74,20 +82,100 @@ doflow_bridge_drops_tool_stderr() {
   doflow_bridge_drops_tool_streams "$1" "$2" "$3"
 }
 
+# One hook line (IC-004) for an allowlisted surface, from the encode tuple in DF_TUPLE, appended to
+# <config>/state/runs/telemetry/<UTC date>.jsonl. Builtins only on the path that writes; every step
+# returns 0, and nothing reaches stdout or stderr. Args: harness, normalised event, policy, and the
+# policy's emit record (rider R1, user-prompt-submit only): its reason, byte count and digest are
+# written only when each passes its pattern (a vocabulary member, digits, 8 lowercase hex or null),
+# else all three are null, as they are on every other line.
+doflow_bridge_hook_line() {
+  local d="" f="" day="" rest="" duration=null t1="" er=null eb=null eg=null r="" b="" g=""
+  [ "${DOFLOW_TELEMETRY:-}" != off ] || return 0
+  case "$DF_TUPLE" in ''|'{"dft":1}') return 0 ;; esac
+  case "$1:$3:$2" in
+    claude:pre-bash-guard:PreToolUse|codex:pre-bash-guard:PreToolUse|kiro:pre-bash-guard:PreToolUse|antigravity:pre-bash-guard:PreToolUse|pi:pre-bash-guard:tool_call|claude:user-prompt-submit:UserPromptSubmit|codex:user-prompt-submit:UserPromptSubmit) ;;
+    *) return 0 ;;
+  esac
+  if [ -n "${DOFLOW_CONFIG_DIR:-}" ]; then
+    d=$DOFLOW_CONFIG_DIR
+  else
+    d=${PWD:-}
+    case "$d" in /*) ;; *) return 0 ;; esac
+    while :; do
+      if [ -d "$d/.doflow" ]; then
+        case "$d/" in
+          */.doflow/*) ;;
+          *) d=${d%/}/.doflow; break ;;
+        esac
+      fi
+      [ -n "$d" ] && [ "$d" != "/" ] || return 0
+      d=${d%/*}
+    done
+  fi
+  [ -d "$d/state" ] || return 0
+  day=${DF_TUPLE:17:10}
+  case "$day" in [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) ;; *) return 0 ;; esac
+  rest=${DF_TUPLE#\{\"dft\":1,\"date\":\"??????????\",}
+  case "$rest" in \"timestamp\":*\}) ;; *) return 0 ;; esac
+  if [ -n "$_df_t0" ]; then
+    t1=${EPOCHREALTIME:-}; t1=${t1/[.,]/}; _df_t0=${_df_t0/[.,]/}
+    case "$t1$_df_t0" in ''|*[!0-9]*) ;; *) duration=$(( (t1 - _df_t0) / 1000 )); [ "$duration" -ge 0 ] || duration=null ;; esac
+  fi
+  if [ "$3" = user-prompt-submit ] && [ -n "${4:-}" ]; then
+    r=${4#*\"reason\":\"}; r=${r%%\"*}
+    b=${4#*\"bytes\":}; b=${b%%[,\}]*}
+    g=${4#*\"digest\":}; g=${g%%[,\}]*}
+    case "$r" in
+      emit|refused:mandatory-over-budget|silent:already-bootstrapped|silent:unchanged|silent:no-home|fault:deps|fault:unit|fault:slot|fault:summary|fault:grant|fault:warning|fault:render) ;;
+      *) r="" ;;
+    esac
+    # Explicit character lists: a locale's collation can put capitals inside a range such as [a-f].
+    case "$b" in ''|*[!0123456789]*|0?*|???????????*) b="" ;; esac
+    case "$g" in
+      null|\"[0123456789abcdef][0123456789abcdef][0123456789abcdef][0123456789abcdef][0123456789abcdef][0123456789abcdef][0123456789abcdef][0123456789abcdef]\") ;;
+      *) g="" ;;
+    esac
+    if [ -n "$r" ] && [ -n "$b" ] && [ -n "$g" ]; then er=\"$r\"; eb=$b; eg=$g; fi
+  fi
+  [ -d "$d/state/runs/telemetry" ] || mkdir "$d/state/runs/telemetry" 2>/dev/null || return 0
+  f=$d/state/runs/telemetry/$day.jsonl
+  [ ! -e "$f" ] || [ -f "$f" ] || return 0
+  { printf '{"kind":"hook","harness":"%s","event":"%s","policy":"%s","verdict":"%s","duration_ms":%s,"emit_reason":%s,"emit_bytes":%s,"emit_digest":%s,%s\n' "$1" "$2" "$3" "$DF_BRIDGE_OUTCOME" "$duration" "$er" "$eb" "$eg" "$rest" >>"$f"; } 2>/dev/null || true
+  return 0
+}
+
 doflow_bridge() {
-  local harness="${1:-}" event="${2:-}" policy="${3:-}" response_event="" emit="native" payload="" encoded="" policy_path="" captured="" err="" code=0 policy_code=0 record="" reason="" decision_reason="" stdout="" status=0 decision="" line="" spawn_failed=0 encode_failed=0
+  local harness="${1:-}" event="${2:-}" policy="${3:-}" response_event="" emit="native" payload="" encoded="" policy_path="" captured="" err="" code=0 policy_code=0 record="" emit_record="" reason="" decision_reason="" stdout="" status=0 decision="" line="" spawn_failed=0 encode_failed=0 _df_t0=""
+  DF_TUPLE=""
+  if [ "${BASH_VERSINFO[0]:-0}" -ge 5 ] 2>/dev/null; then _df_t0=${EPOCHREALTIME:-}; fi
   . "$_DOFLOW_BRIDGE_DIR/respond.sh"
   doflow_bridge_native_event_var "$harness" "$event"; response_event=$DF_NE
   if [ "${4:-}" = --emit ]; then emit="${5:-native}"; fi
   payload="$(cat)"
   if command -v jq >/dev/null 2>&1; then
-    encoded="$(printf '%s\n' "$payload" | DOFLOW_TASK_ID="${DOFLOW_TASK_ID:-}" DOFLOW_RUN_ID="${DOFLOW_RUN_ID:-}" DOFLOW_ATTEMPT="${DOFLOW_ATTEMPT:-}" DOFLOW_SESSION_ROLE="${DOFLOW_SESSION_ROLE:-}" jq -c --arg harness "$harness" --arg event "$event" --arg policy "$policy" --arg mode encode -f "$_DOFLOW_BRIDGE_DIR/envelope.jq" 2>/dev/null)" && {
+    encoded="$(printf '%s\n' "$payload" | DOFLOW_TASK_ID="${DOFLOW_TASK_ID:-}" DOFLOW_RUN_ID="${DOFLOW_RUN_ID:-}" DOFLOW_ATTEMPT="${DOFLOW_ATTEMPT:-}" DOFLOW_LINEAGE_ID="${DOFLOW_LINEAGE_ID:-}" DOFLOW_SESSION_ROLE="${DOFLOW_SESSION_ROLE:-}" DOFLOW_WORKTREE="${DOFLOW_WORKTREE:-}" jq -c --arg harness "$harness" --arg event "$event" --arg policy "$policy" --arg mode encode -f "$_DOFLOW_BRIDGE_DIR/envelope.jq" 2>/dev/null)" || encode_failed=1
+    # The telemetry tuple is the first line; without an envelope line after it there is no envelope.
+    case "$encoded" in
+      '{"dft"'*)
+        DF_TUPLE=${encoded%%$'\n'*}
+        case "$encoded" in *$'\n'*) encoded=${encoded#*$'\n'} ;; *) encoded="" ;; esac
+        ;;
+    esac
+    if [ "$encode_failed" -eq 0 ]; then
       case "$encoded" in \{*) payload="$encoded" ;; *) encode_failed=1 ;; esac
-    } || { encode_failed=1; }
+    fi
     if [ "$encode_failed" -eq 1 ]; then
       encoded="$(jq -cn --arg harness "$harness" --arg event "$event" --arg policy "$policy" --arg mode minimal -f "$_DOFLOW_BRIDGE_DIR/envelope.jq" 2>/dev/null)" || encoded=""
       case "$encoded" in \{*) payload="$encoded" ;; *) payload="{\"doflow_event\":{\"version\":1,\"harness\":\"$harness\",\"event\":\"$event\",\"operation\":\"tool\"}}" ;; esac
       doflow_bridge_failure "$policy" envelope-encode
+    else
+      # Step observe-model (row 120 IC-005): an envelope whose identity names a model is recorded
+      # under the config home. It never changes the decision, the exit code or the streams.
+      case "$payload" in
+        *'"doflow_event":{'*'"model":"'*)
+          [ ! -f "$_DOFLOW_BRIDGE_DIR/observe-model.sh" ] || ( . "$_DOFLOW_BRIDGE_DIR/observe-model.sh" && doflow_observe_model "$harness" "$payload" ) >/dev/null 2>&1 </dev/null || true
+          ;;
+      esac
     fi
   else
     doflow_bridge_failure "$policy" dependency-missing:jq
@@ -113,7 +201,11 @@ doflow_bridge() {
     case "$line" in
       *$'\036'*)
         local prefix="${line%%$'\036'*}"
-        record="${line#*$'\036'}"
+        # Rider R1: the emit record is telemetry, never the decision record.
+        case "${line#*$'\036'}" in
+          '{"v":1,"emit":'*) emit_record="${line#*$'\036'}" ;;
+          *) record="${line#*$'\036'}" ;;
+        esac
         [ -z "$prefix" ] || err="$err$prefix"$'\n'
         ;;
       *) err="$err$line"$'\n' ;;
@@ -125,6 +217,7 @@ doflow_bridge() {
   if [ "$spawn_failed" -eq 1 ]; then DF_BRIDGE_OUTCOME=error; DF_BRIDGE_CODE=bridge-spawn; DF_BRIDGE_REASON=bridge-spawn; DF_BRIDGE_VERSION=0; DF_BRIDGE_POINT=bridge-spawn; fi
   if [ -n "$DF_BRIDGE_POINT" ] && [ "$DF_BRIDGE_POINT" != decision-mismatch ] && [ "$DF_BRIDGE_POINT" != eval-error:signal-TERM ] && [ "$DF_BRIDGE_POINT" != eval-error:signal-INT ] && [ "$DF_BRIDGE_POINT" != eval-error:signal-PIPE ]; then doflow_bridge_failure "$policy" "$DF_BRIDGE_POINT"; fi
   doflow_bridge_effect "$harness" "$event" "$policy" "$DF_BRIDGE_OUTCOME"
+  doflow_bridge_hook_line "$harness" "$response_event" "$policy" "$emit_record"
   if [ "$DF_BRIDGE_EFFECT" = block ] && [ "$DF_BRIDGE_OUTCOME" != deny ]; then reason="[$policy] DoFlow policy error; details: doflow-run failure list"; fi
   if [ "$DF_BRIDGE_OUTCOME" != deny ] && [ "$DF_BRIDGE_EFFECT" = proceed ]; then
     case "$harness:$response_event:$DF_BRIDGE_OUTCOME" in
@@ -167,7 +260,7 @@ doflow_bridge() {
   fi
   case "$policy:$DF_BRIDGE_OUTCOME:$harness:$response_event:$DF_BRIDGE_CODE" in
     session-context:error:*:*:*|user-prompt-submit:error:*:*:*|subagent-audit:error:*:*:*|session-context:unsupported:*:*:*|user-prompt-submit:unsupported:*:*:*|subagent-audit:unsupported:*:*:*) ;;
-    *:error:codex:Stop:exit-*|*:error:codex:Stop:signal-*|*:error:codex:stop:exit-*|*:error:codex:stop:signal-*|*:error:kiro:PreToolUse:exit-*|*:error:kiro:PreToolUse:signal-*|*:error:kiro:Stop:exit-*|*:error:kiro:Stop:signal-*|*:error:claude:Stop:exit-*|*:error:claude:Stop:signal-*) ;;
+    *:error:codex:Stop:exit-*|*:error:codex:Stop:signal-*|*:error:copilot:Stop:exit-*|*:error:copilot:Stop:signal-*|*:error:codex:stop:exit-*|*:error:codex:stop:signal-*|*:error:kiro:PreToolUse:exit-*|*:error:kiro:PreToolUse:signal-*|*:error:kiro:Stop:exit-*|*:error:kiro:Stop:signal-*|*:error:claude:Stop:exit-*|*:error:claude:Stop:signal-*) ;;
     *)
       if ! doflow_bridge_drops_tool_stderr "$policy" "$harness" "$response_event" && [ -n "$err" ]; then printf '%s' "$err" >&2; fi
       ;;

package/core/harnesses/shared/hooks/bridge/envelope.jq

@@ -1,4 +1,14 @@
 def nonempty($v): if ($v | type) == "string" and $v != "" then $v else null end;
+def valid_model_id($v):
+  ($v | type) == "string" and ($v | length) >= 1 and ($v | length) <= 120 and
+  ($v | test("^[A-Za-z0-9][A-Za-z0-9 ._:/@()\\[\\]#+-]*$")) and
+  (($v | endswith(" ")) | not);
+def model_identity($v):
+  if ($v | type) != "string" then {}
+  elif valid_model_id($v) then {model:$v}
+  else {modelUnparsed:true} end;
+# Same reading as identity.ts and policies/identity.sh: ASCII-lowercased, main or worker kept, any other non-empty value is worker. Unset or empty stays null.
+def norm_role($v): if ($v | type) == "string" and $v != "" then ($v | ascii_downcase) as $l | if $l == "main" or $l == "worker" then $l else "worker" end else null end;
 def put($o; $k; $v): if $v == null then $o else $o + {($k): $v} end;
 def event_name($fallback): if (.hook_event_name | type) == "string" then .hook_event_name else $fallback end;
 def path_values($obj; $keys): first([$keys[] as $k | $obj[$k] | select(type == "string" and length > 0)][]) // null | if . == null then null else [.] end;
@@ -12,26 +22,31 @@ def event_operation($e):
   elif $e == "Stop" or $e == "stop" then "stop"
   elif $e == "SubagentStart" then "subagent-start"
   elif $e == "SubagentStop" then "subagent-stop"
-  elif $e == "PreCompact" or $e == "PreCompress" then "compact"
-  elif $e == "PostToolUse" or $e == "AfterTool" then "post-tool"
+  elif $e == "PreCompact" then "compact"
+  elif $e == "PostToolUse" then "post-tool"
   else "tool" end;
 def canonical_tool($name; $harness):
   if ($name | type) != "string" then {operation:"tool"}
-  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro") and ($name | test("^mcp__"))) or (($harness == "gemini" or $harness == "antigravity") and ($name | test("^mcp_"))) or ($harness == "pi" and ($name | test("^mcp__"))) then {operation:"mcp",tool:$name}
-  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro") and (["Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "gemini" and (["write_file","replace"] | index($name)) != null) or ($harness == "antigravity" and (["write_to_file","replace_file_content","multi_replace_file_content","edit_file","write_file","create_file","replace_file","replace","Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "pi" and (["edit","write"] | index($name)) != null) then {operation:"edit",tool:$name}
-  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro") and $name == "Bash") or ($harness == "gemini" and $name == "run_shell_command") or ($harness == "antigravity" and (["run_command","run_shell_command","Bash","bash"] | index($name)) != null) or ($harness == "pi" and $name == "bash") then {operation:"command",tool:$name}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and ($name | test("^mcp__"))) or ($harness == "antigravity" and ($name | test("^mcp_"))) or ($harness == "pi" and ($name | test("^mcp__"))) then {operation:"mcp",tool:$name}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and (["Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "antigravity" and (["write_to_file","replace_file_content","multi_replace_file_content","edit_file","write_file","create_file","replace_file","replace","Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "pi" and (["edit","write"] | index($name)) != null) then {operation:"edit",tool:$name}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and $name == "Bash") or ($harness == "antigravity" and (["run_command","run_shell_command","Bash","bash"] | index($name)) != null) or ($harness == "pi" and $name == "bash") then {operation:"command",tool:$name}
   else {operation:"tool",tool:$name} end;
 def decode_claude:
   (canonical_tool(.tool_name // ""; "claude")) as $t |
-  if .tool_name == null then {operation: event_operation($event), identity: session_identity(.session_id)}
-  else {operation:$t.operation, tool:$t.tool, paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path"]) else null end), command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end), identity:session_identity(.session_id)} end;
+  (if event_name($event) == "SessionStart" then model_identity(.model) else {} end) as $model |
+  if .tool_name == null then {operation: event_operation($event), identity: (session_identity(.session_id) + $model)}
+  else {operation:$t.operation, tool:$t.tool, paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path"]) else null end), command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end), identity:(session_identity(.session_id) + $model)} end;
 def decode_codex:
   decode_claude as $d |
-  if .tool_name == "apply_patch" then $d + {patch:(string_value(.tool_input; ["command"]))} else $d end;
-def decode_gemini:
-  (canonical_tool(.tool_name // ""; "gemini")) as $t |
-  if .tool_name == null then {operation:event_operation($event),identity:session_identity(.session_id)}
-  else {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path","path"]) else null end),command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end),identity:session_identity(.session_id)} end;
+  (model_identity(.model)) as $model |
+  (if .tool_name == "apply_patch" then $d + {patch:(string_value(.tool_input; ["command"]))} else $d end) |
+  .identity += $model;
+# Copilot CLI payloads (normalised to the Claude shape by the front door) carry no model, so the
+# envelope names none, whatever a payload happens to hold under .model.
+def decode_copilot:
+  decode_claude as $d |
+  (if .tool_name == "apply_patch" then $d + {patch:(string_value(.tool_input; ["command"]))} else $d end) |
+  .identity |= del(.model, .modelUnparsed);
 def decode_kiro:
   (if ((.tool_name // "") | type) == "string" and ((.tool_name // "") | startswith("mcp_")) then {operation:"mcp",tool:.tool_name}
    elif ((.tool_name // "") | type) == "string" and ((.tool_name // "") | test("^@[^/]+/.+")) then
@@ -40,21 +55,75 @@ def decode_kiro:
   if .tool_name == null then {operation:event_operation($event),identity:session_identity(.session_id)}
   else {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path"]) else null end),command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end),identity:session_identity(.session_id)} end;
 def decode_antigravity:
-  if .toolCall == null then {operation:event_operation($event),identity:session_identity(.session_id)}
+  (model_identity(.modelName)) as $model |
+  (session_identity(if (.session_id | type) == "string" and .session_id != "" then .session_id else .conversationId end) + $model) as $identity |
+  if .toolCall == null then {operation:event_operation($event),identity:$identity}
   else (canonical_tool(.toolCall.name // ""; "antigravity")) as $t |
-    {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.toolCall.args; ["AbsolutePath","TargetFile","Path","file_path","path"]) else null end),command:(if $t.operation == "command" then string_value(.toolCall.args; ["CommandLine","command"]) else null end),identity:session_identity(.session_id)} end;
+    {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.toolCall.args; ["AbsolutePath","TargetFile","Path","file_path","path"]) else null end),command:(if $t.operation == "command" then string_value(.toolCall.args; ["CommandLine","command"]) else null end),identity:$identity} end;
 def decode_pi:
   (canonical_tool(.toolName // ""; "pi")) as $t |
-  {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.input; ["path"]) else null end),command:(if $t.operation == "command" then string_value(.input; ["command"]) else null end),identity:session_identity(.sessionId),correlation:(correlation(.toolCallId;.parentToolCallId))};
+  {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.input; ["path"]) else null end),command:(if $t.operation == "command" then string_value(.input; ["command"]) else null end),identity:(session_identity(.sessionId) + model_identity(.model)),correlation:(correlation(.toolCallId;.parentToolCallId))};
+# IC-005: only this closed vocabulary enters telemetry. The policy envelope keeps its command.
+def command_segment_class:
+  gsub("^\\s+|\\s+$"; "") | sub("^([A-Za-z_][A-Za-z0-9_]*=[^\\s]*\\s+)+"; "") |
+  if test("^cd\\s+") then "none"
+  elif test("^(doflow-run|doflow) verify( |$)") then "verify.verb"
+  elif test("^(npm|pnpm|yarn|bun)( run)? test$|^node --test( --[^ ]+)*( test/?)?$|^pytest( -[^ ]+)*$|^go test \\./\\.\\.\\.$|^cargo test$") then "test.full"
+  elif test("^(npm|pnpm|yarn|bun)( run)? test |^node --test |^pytest |^go test |^cargo test ") then "test.scoped"
+  elif test("(^| )(jest|vitest|mocha|playwright test)( |$)|^(npm|pnpm|yarn|bun) run test:[^ ]+") then "test.other"
+  else "none" end;
+def classify($cmd):
+  try (if ($cmd | type) != "string" then "none" else
+    ["verify.verb", "test.full", "test.scoped", "test.other", "none"] as $rank |
+    [$cmd | splits("&&|\\|\\||;|\\|") | command_segment_class | . as $c | $rank | index($c)] |
+    (min // 4) as $best | $rank[$best]
+  end) catch "none";
+# Telemetry tuple (IC-003): the first line in explicit `--arg mode encode`, read and stripped by
+# bridge.sh. Every telemetry expression sits inside the `try`, so a fault here yields {dft:1} and
+# never reaches the envelope; exactly one value comes out whatever the inside yields.
+def dft_token($v): if ($v | type) == "string" and ($v | test("^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$")) then $v else null end;
+def dft_id($v): if ($v | type) == "string" and ($v | test("^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$")) then $v else null end;
+def dft_tuple_base($native; $d):
+  if $ENV.DOFLOW_TELEMETRY == "off" then {dft:1} else
+  [try (now as $n | ($n | floor) as $s |
+    {dft:1, date:($s | strftime("%Y-%m-%d")),
+     timestamp:(($s | strftime("%Y-%m-%dT%H:%M:%S")) + "." + (((($n - $s) * 1000 | floor) + 1000 | tostring)[1:]) + "Z"),
+     session:dft_token($d.identity.session),
+     tool:(if $d.operation == "mcp" then null else dft_token($d.tool) end),
+     tool_call_id:dft_token(if $harness == "pi" then $native.toolCallId elif $harness == "claude" or $harness == "codex" then $native.tool_use_id else null end),
+     run:(dft_id($ENV.DOFLOW_RUN_ID) | if . == "local" then null else . end),
+     lineage:dft_id($ENV.DOFLOW_LINEAGE_ID),
+     attempt:($ENV.DOFLOW_ATTEMPT | if type == "string" and test("^[1-9][0-9]{0,3}$") then tonumber else null end),
+     role:norm_role($ENV.DOFLOW_SESSION_ROLE),
+     worker_run:($ENV.DOFLOW_WORKER_RUN | if type == "string" and test("\\Aw-[0-9a-f]{12}\\z") then . else null end)}) catch {dft:1}]
+  | if length == 1 then .[0] else {dft:1} end end;
+def dft_tuple($native; $d):
+  dft_tuple_base($native; $d) |
+  [try (
+    if . == {dft:1} then . else
+      (if $ARGS.named.mode == "observe" then . + {duration_ms:null, tool_duration_ms:($native.duration_ms |
+        if type == "number" and . >= 0 and . <= 9007199254740991 and . == floor then . else null end)} else . + {tool_duration_ms:null} end) |
+      if ($policy == "pre-bash-guard" or $ARGS.named.mode == "observe") and $d.operation == "command"
+      then . + {test_class:classify($d.command)} else . + {test_class:null} end
+    end) catch {dft:1}] | if length == 1 then .[0] else {dft:1} end;
 if ($ARGS.named.mode // "encode") == "minimal" then {doflow_event:{version:(1),harness:$harness,event:(event_name($event)),operation:event_operation($event)}} elif type != "object" then . else
   . as $native |
   ($ENV.DOFLOW_TASK_ID | nonempty(.)) as $task |
   ($ENV.DOFLOW_RUN_ID | nonempty(.)) as $run |
   ($ENV.DOFLOW_ATTEMPT | try tonumber catch null) as $attempt |
-  (if $ENV.DOFLOW_SESSION_ROLE == "main" or $ENV.DOFLOW_SESSION_ROLE == "worker" then $ENV.DOFLOW_SESSION_ROLE else null end) as $role |
-  (if $harness == "claude" then decode_claude elif $harness == "codex" then decode_codex elif $harness == "gemini" then decode_gemini elif $harness == "kiro" then decode_kiro elif $harness == "antigravity" then decode_antigravity elif $harness == "pi" then decode_pi else {operation:"tool"} end) as $d |
+  ($ENV.DOFLOW_LINEAGE_ID | nonempty(.)) as $lineage |
+  ($ENV.DOFLOW_WORKTREE | nonempty(.)) as $worktree |
+  norm_role($ENV.DOFLOW_SESSION_ROLE) as $role |
+  (if $harness == "claude" then decode_claude elif $harness == "codex" then decode_codex elif $harness == "kiro" then decode_kiro elif $harness == "copilot" then decode_copilot elif $harness == "antigravity" then decode_antigravity elif $harness == "pi" then decode_pi else {operation:"tool"} end) as $d |
+  if $ARGS.named.mode == "observe" then
+    if $harness == "claude" and $d.operation == "command" and $native.hook_event_name == $event and
+      ($event == "PostToolUse" or $event == "PostToolUseFailure")
+    then dft_tuple($native; $d) else {dft:1} end
+  else
   ({version:1,harness:$harness,event:(event_name($event)),operation:$d.operation,tool:$d.tool,paths:$d.paths,command:$d.command,patch:$d.patch,taskId:$task,
-    identity:($d.identity + {run:$run,attempt:$attempt,role:$role} | with_entries(select(.value != null)) | if length > 0 then . else null end),
+    identity:($d.identity + {run:$run,attempt:$attempt,lineage:$lineage,role:$role,worktree:$worktree} | with_entries(select(.value != null)) | if length > 0 then . else null end),
     correlation:(($d.correlation // {}) | with_entries(select(.value != null)) | if length > 0 then . else null end) } | with_entries(select(.value != null))) as $envelope |
+  (if $ARGS.named.mode == "encode" then dft_tuple($native; $d) else empty end),
   $native + {doflow_event:$envelope}
+  end
 end

package/core/harnesses/shared/hooks/bridge/observe-model.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# observe-model.sh — the shared bridge step `observe-model` (row 120 IC-005).
+#
+# Defines doflow_observe_model <harness> <envelope>. Sourcing defines it only. bridge.sh calls it once
+# per event, after the envelope is built, in a subshell with every stream discarded:
+#
+#   ( . "<bridge-dir>/observe-model.sh" && doflow_observe_model "$harness" "$payload" ) >/dev/null 2>&1 </dev/null || true
+#
+# so it never changes the decision, the exit code or the output, and every I/O error is ignored.
+#
+# When the envelope carries identity.model and a session id it records the model in one file under
+# lib.sh's STATE_DIR (<config home>/doflow/session-env):
+#   - main session (DOFLOW_SESSION_ROLE unset or main): primary/<cwd_hash cwd>/<harness>/<sessionKey>.json,
+#     where cwd is the payload's absolute `cwd`, else the hook's working directory;
+#   - worker (any other role, identity.sh's reading) with a launched identity (DOFLOW_RUN_ID other
+#     than `local`, DOFLOW_LINEAGE_ID and DOFLOW_ATTEMPT, identity.sh's patterns):
+#     worker-model/L.<run>.<lineage>.<attempt>.json. A worker without one writes nothing.
+# sessionKey is the first 16 hex of the sha256 of the session id's bytes. The file holds exactly
+#   {"schema":1,"harness":"<id>","model":"<model-id>","event":"<event>","observedAt":"<UTC>","session":"<sessionKey>"}
+# and is written only when absent or when its model differs: a tmp file in the same folder, then a
+# rename, mode 0600. With no config home, no sha256 tool or a link in place of the file, nothing.
+# The storage stores model-observations and worker-model-observations bound both folders.
+
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_OBSERVE_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_OBSERVE_DIR=. ;; esac
+
+doflow_observe_model() {
+  local harness="${1:-}" envelope="${2:-}" fields="" model="" model_json="" session="" cwd="" event="" now=""
+  local key="" dir="" file="" current="" tmp="" run="${DOFLOW_RUN_ID:-}" lineage="${DOFLOW_LINEAGE_ID:-}" attempt="${DOFLOW_ATTEMPT:-}"
+  case "$harness" in ''|*[!a-z0-9-]*) return 0 ;; esac
+  # lib.sh gives STATE_DIR (the config-home rule), cwd_hash and identity.sh's role reading.
+  . "$_DOFLOW_OBSERVE_DIR/../policies/lib.sh" || return 0
+  [ -n "${STATE_DIR:-}" ] || return 0
+  fields=$(printf '%s\n' "$envelope" | jq -r '
+    def text: type == "string" and length > 0 and (test("[[:cntrl:]]") | not);
+    .doflow_event as $e
+    | select(($e.identity.model | text) and ($e.identity.session | text))
+    | $e.identity.model, ($e.identity.model | tojson), $e.identity.session,
+      (if (.cwd | text) and (.cwd | startswith("/")) then .cwd else "-" end),
+      ($e.event | tojson), (now | strftime("%Y-%m-%dT%H:%M:%SZ"))' 2>/dev/null) || return 0
+  { IFS= read -r model && IFS= read -r model_json && IFS= read -r session && IFS= read -r cwd \
+    && IFS= read -r event && IFS= read -r now; } <<<"$fields" || return 0
+
+  if command -v sha256sum >/dev/null 2>&1; then key=$(printf '%s' "$session" | sha256sum | cut -c1-16)
+  elif command -v shasum >/dev/null 2>&1; then key=$(printf '%s' "$session" | shasum -a 256 | cut -c1-16)
+  else return 0; fi
+  [[ $key =~ ^[0-9a-f]{16}$ ]] || return 0
+
+  _doflow_role_resolve
+  if [ "$_DF_ROLE" = main ]; then
+    case "$cwd" in /*) ;; *) cwd=$PWD ;; esac
+    dir="$STATE_DIR/primary/$(cwd_hash "$cwd")/$harness"
+    file="$dir/$key.json"
+  else
+    [ "$run" != local ] && [[ $run =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]] || return 0
+    [[ $lineage =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]] && [[ $attempt =~ ^[1-9][0-9]{0,3}$ ]] || return 0
+    dir="$STATE_DIR/worker-model"
+    file="$dir/L.$run.$lineage.$attempt.json"
+  fi
+
+  [ ! -L "$file" ] || return 0
+  if [ -f "$file" ]; then
+    current=$(jq -r 'if (.model | type) == "string" then .model else empty end' "$file" 2>/dev/null) || current=""
+    [ "$current" != "$model" ] || return 0
+  fi
+  umask 077
+  mkdir -p "$dir" || return 0
+  tmp="$file.tmp.$$"
+  if printf '{"schema":1,"harness":"%s","model":%s,"event":%s,"observedAt":"%s","session":"%s"}\n' \
+      "$harness" "$model_json" "$event" "$now" "$key" >"$tmp" && mv -f "$tmp" "$file"; then
+    return 0
+  fi
+  rm -f "$tmp"
+  return 0
+}

package/core/harnesses/shared/hooks/bridge/respond.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # Native hook response renderers for the shared lifecycle bridge.
-case ${BASH_SOURCE[0]} in */*) _DOFLOW_RESPOND_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLOW_RESPOND_DIR=. ;; esac
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_RESPOND_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_RESPOND_DIR=. ;; esac
 . "$_DOFLOW_RESPOND_DIR/../policies/deny-json.sh"
 
 doflow_bridge_native_event_var() {
@@ -28,7 +29,6 @@ doflow_render_response() {
   if [ "$outcome" = deny ]; then
     case "$harness:$event" in
       claude:PreToolUse|codex:PreToolUse) emit_pretooluse_deny_nested "$reason" || return $?; return 0 ;;
-      gemini:BeforeTool) emit_pretooluse_deny_flat "$reason"; return 0 ;;
       kiro:PreToolUse) printf '%s' "$reason" >&2; return 2 ;;
       antigravity:PreToolUse)
         if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"deny",reason:$reason}'
@@ -38,6 +38,14 @@ doflow_render_response() {
         if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"continue",reason:$reason}'
         else printf '{"decision":"continue","reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
         return $? ;;
+      copilot:PreToolUse)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{permissionDecision:"deny",permissionDecisionReason:$reason}'
+        else printf '{"permissionDecision":"deny","permissionDecisionReason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
+      copilot:Stop)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"block",reason:$reason}'
+        else printf '{"decision":"block","reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
       pi:tool_call)
         if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{block:true,reason:$reason}'
         else printf '{"block":true,"reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi

package/core/harnesses/shared/hooks/policies/blocked-patterns.conf

@@ -4,27 +4,36 @@
 #   regex<TAB>reason shown to the harness<TAB>exclude_regex (optional)
 #
 # Rules:
-#   - Lines beginning with # are comments (skipped)
+#   - Lines beginning with # are comments (skipped), except the marker
+#     #@exempt-next worker-worktree arms only the next pattern line for the
+#     hook's exact dispatch-worker reset/clean exemption. The worker-dropdb
+#     marker arms only the DROP row for one exact listed database invocation
+#     from the launch snapshot. Other rules still run.
 #   - Empty lines are skipped
 #   - Regex is POSIX Extended Regular Expression (ERE, as used by `grep -E`),
 #     matched case-insensitively against the full command string (RM and GIT run
 #     on a case-insensitive filesystem such as the macOS default), which
 #     includes any expanded heredocs or -m "..." arguments. Git and rm
 #     patterns use a command-context anchor:
-#       (^|[[:space:]]*(&&|\|\||;)[[:space:]]*)
+#       (^|[;&|(`])[[:space:]]*
 #     so they only fire when the dangerous text is an actual invocation,
 #     not when it appears as text inside a commit message or other argument.
 #   - Anchored patterns (those beginning with "(^|") are matched against the
 #     command with quoted text blanked out (pre-bash-guard.sh scrub_quotes),
 #     so echo "x && rm -rf /" or git commit -m "git reset --hard" is not a
 #     command. The argument of sh -c, bash -c, zsh -c and eval is NOT blanked
-#     (it executes). Every other pattern is matched against the full text.
-#   - The rm lines use a wider command position than the others: start of a
+#     (it executes). SQL rules use the raw full text. Only the three shipped
+#     SQL rows may be skipped by the hook's positive raw-command text-only
+#     allow-list: literal commit/echo/printf/gh bodies or exact quoted heredocs
+#     to commit/cat/gh (including the Claude commit cat substitution).
+#     Other shapes retain the raw SQL verdict; dot-led file targets are excluded.
+#   - The git, rm and find lines use command positions at the start of a
 #     line or after ; & | ( or a backtick, then optional sudo/command/time/
 #     nohup/exec/env (with options, VAR=x and, per wrapper, the options that take
 #     a separate argument: sudo -u/-g/-C/-h/-p/-r/-t/-U/-D/-R and --user/--group
-#     root, xargs -n/-I/-L/-P/-s/-d/-E/-a, env -u/-C/-S)/xargs/eval/then/do/else, then rm,
-#     \rm, /bin/rm or /usr/bin/rm. "git rm" and "echo rm -rf /" are therefore
+#     root, xargs -n/-I/-L/-P/-s/-d/-E/-a, env -u/-C/-S)/xargs/eval/then/do/else
+#     or bare NAME=value assignments, then git/rm/find, optionally prefixed
+#     with \, /bin/ or /usr/bin/. "git rm" and "echo rm -rf /" are therefore
 #     not matched. pre-bash-guard.sh's hardcoded floor uses the same rule.
 #     Matching is case-insensitive, so an uppercase flag-only option that shares a
 #     letter with a value-taking one (sudo -H beside -h, xargs -p beside -P) is
@@ -34,6 +43,8 @@
 #     inside a flag cluster such as -uf), --force and a +refspec; the
 #     --force-with-lease form stays allowed, as the reason text advises, but a
 #     +refspec still blocks next to a lease (git push --force-with-lease origin +main).
+#     The clean rule also blocks -ff: double force can delete nested repos and
+#     is never eligible for the worker-worktree exemption.
 #   - The find rule blocks -delete, and -exec rm, off the root, a home directory
 #     or a system directory (among other start paths, find or \find or
 #     /usr/bin/find) when only -type, -maxdepth/-mindepth N, -mount, -xdev,
@@ -54,18 +65,21 @@
 # Add project-specific patterns at the bottom of this file.
 
 # ── Dangerous git operations ──────────────────────────────────────────────────
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(--force|-[a-zA-Z]*f[a-zA-Z]*)([^-[:alnum:]]|$)	Force push blocked — use --force-with-lease or confirm with user first
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+\+[^[:space:];&|]+	Force push blocked — use --force-with-lease or confirm with user first
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+reset --hard	Destructive reset blocked — commit or stash changes before resetting
-(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+clean -fd	Irreversible clean blocked — use --dry-run to preview what would be deleted
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(--force|-[a-zA-Z]*f[a-zA-Z]*)([^-[:alnum:]]|$)	Force push blocked — use --force-with-lease or confirm with user first
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+\+[^[:space:];&|]+	Force push blocked — use --force-with-lease or confirm with user first
+#@exempt-next worker-worktree
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+reset --hard	Destructive reset blocked — commit or stash changes before resetting
+#@exempt-next worker-worktree
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+(clean -fd|clean -ff)	Irreversible clean blocked — use --dry-run to preview what would be deleted
 
 # ── Filesystem catastrophes ───────────────────────────────────────────────────
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/+\*{0,2})([[:space:];&|)`]|$)|(/+\*{0,2})([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the root directory (/)
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:];&|)`]|$)|((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the home directory
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:];&|)`]|$)|(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of a system directory
-(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?find([[:space:]]+-[HLP])*([[:space:]]+[^-[:space:];&|][^[:space:];&|]*)*[[:space:]]+(/+\*{0,2}|(~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?|/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+([^-[:space:];&|][^[:space:];&|]*|-(mount|xdev|depth|noleaf|follow|ignore_readdir_race)|-(type|maxdepth|mindepth)[[:space:]]+[^[:space:];&|]+))*[[:space:]]+(-delete([[:space:];&|)`]|$)|-exec(dir)?[[:space:]]+(\\|/(usr/)?bin/)?rm([[:space:];&|)`]|$))	Catastrophic delete blocked — find -delete or -exec rm from the root, home or a system directory with no name, path or time predicate to scope it
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/+\*{0,2})([[:space:];&|)`]|$)|(/+\*{0,2})([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the root directory (/)
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:];&|)`]|$)|((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the home directory
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:];&|)`]|$)|(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of a system directory
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?find([[:space:]]+-[HLP])*([[:space:]]+[^-[:space:];&|][^[:space:];&|]*)*[[:space:]]+(/+\*{0,2}|(~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?|/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+([^-[:space:];&|][^[:space:];&|]*|-(mount|xdev|depth|noleaf|follow|ignore_readdir_race)|-(type|maxdepth|mindepth)[[:space:]]+[^[:space:];&|]+))*[[:space:]]+(-delete([[:space:];&|)`]|$)|-exec(dir)?[[:space:]]+(\\|/(usr/)?bin/)?rm([[:space:];&|)`]|$))	Catastrophic delete blocked — find -delete or -exec rm from the root, home or a system directory with no name, path or time predicate to scope it
 
 # ── SQL destructive statements (no anchor — must catch inside psql heredocs) ──
+#@exempt-next worker-dropdb
 DROP[[:space:]]+(TABLE|DATABASE|SCHEMA)[[:space:]]	Destructive DDL blocked — confirm with user before dropping
 DELETE[[:space:]]+FROM[[:space:]]+[[:alnum:]_]+[[:space:]]*;	Unscoped DELETE blocked — this would affect all rows, add a WHERE clause
 TRUNCATE[[:space:]]+TABLE	Irreversible truncate blocked — confirm with user before truncating