@khoavu882/doflow 2.0.0-beta.5 → 2.0.1

package/core/harnesses/shared/hooks/bridge/envelope.jq

@@ -1,4 +1,14 @@
 def nonempty($v): if ($v | type) == "string" and $v != "" then $v else null end;
+def valid_model_id($v):
+  ($v | type) == "string" and ($v | length) >= 1 and ($v | length) <= 120 and
+  ($v | test("^[A-Za-z0-9][A-Za-z0-9 ._:/@()\\[\\]#+-]*$")) and
+  (($v | endswith(" ")) | not);
+def model_identity($v):
+  if ($v | type) != "string" then {}
+  elif valid_model_id($v) then {model:$v}
+  else {modelUnparsed:true} end;
+# Same reading as identity.ts and policies/identity.sh: ASCII-lowercased, main or worker kept, any other non-empty value is worker. Unset or empty stays null.
+def norm_role($v): if ($v | type) == "string" and $v != "" then ($v | ascii_downcase) as $l | if $l == "main" or $l == "worker" then $l else "worker" end else null end;
 def put($o; $k; $v): if $v == null then $o else $o + {($k): $v} end;
 def event_name($fallback): if (.hook_event_name | type) == "string" then .hook_event_name else $fallback end;
 def path_values($obj; $keys): first([$keys[] as $k | $obj[$k] | select(type == "string" and length > 0)][]) // null | if . == null then null else [.] end;
@@ -12,26 +22,31 @@ def event_operation($e):
   elif $e == "Stop" or $e == "stop" then "stop"
   elif $e == "SubagentStart" then "subagent-start"
   elif $e == "SubagentStop" then "subagent-stop"
-  elif $e == "PreCompact" or $e == "PreCompress" then "compact"
-  elif $e == "PostToolUse" or $e == "AfterTool" then "post-tool"
+  elif $e == "PreCompact" then "compact"
+  elif $e == "PostToolUse" then "post-tool"
   else "tool" end;
 def canonical_tool($name; $harness):
   if ($name | type) != "string" then {operation:"tool"}
-  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro") and ($name | test("^mcp__"))) or (($harness == "gemini" or $harness == "antigravity") and ($name | test("^mcp_"))) or ($harness == "pi" and ($name | test("^mcp__"))) then {operation:"mcp",tool:$name}
-  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro") and (["Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "gemini" and (["write_file","replace"] | index($name)) != null) or ($harness == "antigravity" and (["write_to_file","replace_file_content","multi_replace_file_content","edit_file","write_file","create_file","replace_file","replace","Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "pi" and (["edit","write"] | index($name)) != null) then {operation:"edit",tool:$name}
-  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro") and $name == "Bash") or ($harness == "gemini" and $name == "run_shell_command") or ($harness == "antigravity" and (["run_command","run_shell_command","Bash","bash"] | index($name)) != null) or ($harness == "pi" and $name == "bash") then {operation:"command",tool:$name}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and ($name | test("^mcp__"))) or ($harness == "antigravity" and ($name | test("^mcp_"))) or ($harness == "pi" and ($name | test("^mcp__"))) then {operation:"mcp",tool:$name}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and (["Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "antigravity" and (["write_to_file","replace_file_content","multi_replace_file_content","edit_file","write_file","create_file","replace_file","replace","Edit","Write","MultiEdit","apply_patch"] | index($name)) != null) or ($harness == "pi" and (["edit","write"] | index($name)) != null) then {operation:"edit",tool:$name}
+  elif (($harness == "claude" or $harness == "codex" or $harness == "kiro" or $harness == "copilot") and $name == "Bash") or ($harness == "antigravity" and (["run_command","run_shell_command","Bash","bash"] | index($name)) != null) or ($harness == "pi" and $name == "bash") then {operation:"command",tool:$name}
   else {operation:"tool",tool:$name} end;
 def decode_claude:
   (canonical_tool(.tool_name // ""; "claude")) as $t |
-  if .tool_name == null then {operation: event_operation($event), identity: session_identity(.session_id)}
-  else {operation:$t.operation, tool:$t.tool, paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path"]) else null end), command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end), identity:session_identity(.session_id)} end;
+  (if event_name($event) == "SessionStart" then model_identity(.model) else {} end) as $model |
+  if .tool_name == null then {operation: event_operation($event), identity: (session_identity(.session_id) + $model)}
+  else {operation:$t.operation, tool:$t.tool, paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path"]) else null end), command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end), identity:(session_identity(.session_id) + $model)} end;
 def decode_codex:
   decode_claude as $d |
-  if .tool_name == "apply_patch" then $d + {patch:(string_value(.tool_input; ["command"]))} else $d end;
-def decode_gemini:
-  (canonical_tool(.tool_name // ""; "gemini")) as $t |
-  if .tool_name == null then {operation:event_operation($event),identity:session_identity(.session_id)}
-  else {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path","path"]) else null end),command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end),identity:session_identity(.session_id)} end;
+  (model_identity(.model)) as $model |
+  (if .tool_name == "apply_patch" then $d + {patch:(string_value(.tool_input; ["command"]))} else $d end) |
+  .identity += $model;
+# Copilot CLI payloads (normalised to the Claude shape by the front door) carry no model, so the
+# envelope names none, whatever a payload happens to hold under .model.
+def decode_copilot:
+  decode_claude as $d |
+  (if .tool_name == "apply_patch" then $d + {patch:(string_value(.tool_input; ["command"]))} else $d end) |
+  .identity |= del(.model, .modelUnparsed);
 def decode_kiro:
   (if ((.tool_name // "") | type) == "string" and ((.tool_name // "") | startswith("mcp_")) then {operation:"mcp",tool:.tool_name}
    elif ((.tool_name // "") | type) == "string" and ((.tool_name // "") | test("^@[^/]+/.+")) then
@@ -40,21 +55,75 @@ def decode_kiro:
   if .tool_name == null then {operation:event_operation($event),identity:session_identity(.session_id)}
   else {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.tool_input; ["file_path"]) else null end),command:(if $t.operation == "command" then string_value(.tool_input; ["command"]) else null end),identity:session_identity(.session_id)} end;
 def decode_antigravity:
-  if .toolCall == null then {operation:event_operation($event),identity:session_identity(.session_id)}
+  (model_identity(.modelName)) as $model |
+  (session_identity(if (.session_id | type) == "string" and .session_id != "" then .session_id else .conversationId end) + $model) as $identity |
+  if .toolCall == null then {operation:event_operation($event),identity:$identity}
   else (canonical_tool(.toolCall.name // ""; "antigravity")) as $t |
-    {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.toolCall.args; ["AbsolutePath","TargetFile","Path","file_path","path"]) else null end),command:(if $t.operation == "command" then string_value(.toolCall.args; ["CommandLine","command"]) else null end),identity:session_identity(.session_id)} end;
+    {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.toolCall.args; ["AbsolutePath","TargetFile","Path","file_path","path"]) else null end),command:(if $t.operation == "command" then string_value(.toolCall.args; ["CommandLine","command"]) else null end),identity:$identity} end;
 def decode_pi:
   (canonical_tool(.toolName // ""; "pi")) as $t |
-  {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.input; ["path"]) else null end),command:(if $t.operation == "command" then string_value(.input; ["command"]) else null end),identity:session_identity(.sessionId),correlation:(correlation(.toolCallId;.parentToolCallId))};
+  {operation:$t.operation,tool:$t.tool,paths:(if $t.operation == "edit" then path_values(.input; ["path"]) else null end),command:(if $t.operation == "command" then string_value(.input; ["command"]) else null end),identity:(session_identity(.sessionId) + model_identity(.model)),correlation:(correlation(.toolCallId;.parentToolCallId))};
+# IC-005: only this closed vocabulary enters telemetry. The policy envelope keeps its command.
+def command_segment_class:
+  gsub("^\\s+|\\s+$"; "") | sub("^([A-Za-z_][A-Za-z0-9_]*=[^\\s]*\\s+)+"; "") |
+  if test("^cd\\s+") then "none"
+  elif test("^(doflow-run|doflow) verify( |$)") then "verify.verb"
+  elif test("^(npm|pnpm|yarn|bun)( run)? test$|^node --test( --[^ ]+)*( test/?)?$|^pytest( -[^ ]+)*$|^go test \\./\\.\\.\\.$|^cargo test$") then "test.full"
+  elif test("^(npm|pnpm|yarn|bun)( run)? test |^node --test |^pytest |^go test |^cargo test ") then "test.scoped"
+  elif test("(^| )(jest|vitest|mocha|playwright test)( |$)|^(npm|pnpm|yarn|bun) run test:[^ ]+") then "test.other"
+  else "none" end;
+def classify($cmd):
+  try (if ($cmd | type) != "string" then "none" else
+    ["verify.verb", "test.full", "test.scoped", "test.other", "none"] as $rank |
+    [$cmd | splits("&&|\\|\\||;|\\|") | command_segment_class | . as $c | $rank | index($c)] |
+    (min // 4) as $best | $rank[$best]
+  end) catch "none";
+# Telemetry tuple (IC-003): the first line in explicit `--arg mode encode`, read and stripped by
+# bridge.sh. Every telemetry expression sits inside the `try`, so a fault here yields {dft:1} and
+# never reaches the envelope; exactly one value comes out whatever the inside yields.
+def dft_token($v): if ($v | type) == "string" and ($v | test("^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$")) then $v else null end;
+def dft_id($v): if ($v | type) == "string" and ($v | test("^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$")) then $v else null end;
+def dft_tuple_base($native; $d):
+  if $ENV.DOFLOW_TELEMETRY == "off" then {dft:1} else
+  [try (now as $n | ($n | floor) as $s |
+    {dft:1, date:($s | strftime("%Y-%m-%d")),
+     timestamp:(($s | strftime("%Y-%m-%dT%H:%M:%S")) + "." + (((($n - $s) * 1000 | floor) + 1000 | tostring)[1:]) + "Z"),
+     session:dft_token($d.identity.session),
+     tool:(if $d.operation == "mcp" then null else dft_token($d.tool) end),
+     tool_call_id:dft_token(if $harness == "pi" then $native.toolCallId elif $harness == "claude" or $harness == "codex" then $native.tool_use_id else null end),
+     run:(dft_id($ENV.DOFLOW_RUN_ID) | if . == "local" then null else . end),
+     lineage:dft_id($ENV.DOFLOW_LINEAGE_ID),
+     attempt:($ENV.DOFLOW_ATTEMPT | if type == "string" and test("^[1-9][0-9]{0,3}$") then tonumber else null end),
+     role:norm_role($ENV.DOFLOW_SESSION_ROLE),
+     worker_run:($ENV.DOFLOW_WORKER_RUN | if type == "string" and test("\\Aw-[0-9a-f]{12}\\z") then . else null end)}) catch {dft:1}]
+  | if length == 1 then .[0] else {dft:1} end end;
+def dft_tuple($native; $d):
+  dft_tuple_base($native; $d) |
+  [try (
+    if . == {dft:1} then . else
+      (if $ARGS.named.mode == "observe" then . + {duration_ms:null, tool_duration_ms:($native.duration_ms |
+        if type == "number" and . >= 0 and . <= 9007199254740991 and . == floor then . else null end)} else . + {tool_duration_ms:null} end) |
+      if $ARGS.named.mode == "observe" and $d.operation == "command"
+      then . + {test_class:classify($d.command)} else . + {test_class:null} end
+    end) catch {dft:1}] | if length == 1 then .[0] else {dft:1} end;
 if ($ARGS.named.mode // "encode") == "minimal" then {doflow_event:{version:(1),harness:$harness,event:(event_name($event)),operation:event_operation($event)}} elif type != "object" then . else
   . as $native |
   ($ENV.DOFLOW_TASK_ID | nonempty(.)) as $task |
   ($ENV.DOFLOW_RUN_ID | nonempty(.)) as $run |
   ($ENV.DOFLOW_ATTEMPT | try tonumber catch null) as $attempt |
-  (if $ENV.DOFLOW_SESSION_ROLE == "main" or $ENV.DOFLOW_SESSION_ROLE == "worker" then $ENV.DOFLOW_SESSION_ROLE else null end) as $role |
-  (if $harness == "claude" then decode_claude elif $harness == "codex" then decode_codex elif $harness == "gemini" then decode_gemini elif $harness == "kiro" then decode_kiro elif $harness == "antigravity" then decode_antigravity elif $harness == "pi" then decode_pi else {operation:"tool"} end) as $d |
+  ($ENV.DOFLOW_LINEAGE_ID | nonempty(.)) as $lineage |
+  ($ENV.DOFLOW_WORKTREE | nonempty(.)) as $worktree |
+  norm_role($ENV.DOFLOW_SESSION_ROLE) as $role |
+  (if $harness == "claude" then decode_claude elif $harness == "codex" then decode_codex elif $harness == "kiro" then decode_kiro elif $harness == "copilot" then decode_copilot elif $harness == "antigravity" then decode_antigravity elif $harness == "pi" then decode_pi else {operation:"tool"} end) as $d |
+  if $ARGS.named.mode == "observe" then
+    if $harness == "claude" and $d.operation == "command" and $native.hook_event_name == $event and
+      ($event == "PostToolUse" or $event == "PostToolUseFailure")
+    then dft_tuple($native; $d) else {dft:1} end
+  else
   ({version:1,harness:$harness,event:(event_name($event)),operation:$d.operation,tool:$d.tool,paths:$d.paths,command:$d.command,patch:$d.patch,taskId:$task,
-    identity:($d.identity + {run:$run,attempt:$attempt,role:$role} | with_entries(select(.value != null)) | if length > 0 then . else null end),
+    identity:($d.identity + {run:$run,attempt:$attempt,lineage:$lineage,role:$role,worktree:$worktree} | with_entries(select(.value != null)) | if length > 0 then . else null end),
     correlation:(($d.correlation // {}) | with_entries(select(.value != null)) | if length > 0 then . else null end) } | with_entries(select(.value != null))) as $envelope |
+  (if $ARGS.named.mode == "encode" then dft_tuple($native; $d) else empty end),
   $native + {doflow_event:$envelope}
+  end
 end

package/core/harnesses/shared/hooks/bridge/observe-model.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# observe-model.sh — the shared bridge step `observe-model` (row 120 IC-005).
+#
+# Defines doflow_observe_model <harness> <envelope>. Sourcing defines it only. bridge.sh calls it once
+# per event, after the envelope is built, in a subshell with every stream discarded:
+#
+#   ( . "<bridge-dir>/observe-model.sh" && doflow_observe_model "$harness" "$payload" ) >/dev/null 2>&1 </dev/null || true
+#
+# so it never changes the decision, the exit code or the output, and every I/O error is ignored.
+#
+# When the envelope carries identity.model and a session id it records the model in one file under
+# lib.sh's STATE_DIR (<config home>/doflow/session-env):
+#   - main session (DOFLOW_SESSION_ROLE unset or main): primary/<cwd_hash cwd>/<harness>/<sessionKey>.json,
+#     where cwd is the payload's absolute `cwd`, else the hook's working directory;
+#   - worker (any other role, identity.sh's reading) with a launched identity (DOFLOW_RUN_ID other
+#     than `local`, DOFLOW_LINEAGE_ID and DOFLOW_ATTEMPT, identity.sh's patterns):
+#     worker-model/L.<run>.<lineage>.<attempt>.json. A worker without one writes nothing.
+# sessionKey is the first 16 hex of the sha256 of the session id's bytes. The file holds exactly
+#   {"schema":1,"harness":"<id>","model":"<model-id>","event":"<event>","observedAt":"<UTC>","session":"<sessionKey>"}
+# and is written only when absent or when its model differs: a tmp file in the same folder, then a
+# rename, mode 0600. With no config home, no sha256 tool or a link in place of the file, nothing.
+# The storage stores model-observations and worker-model-observations bound both folders.
+
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_OBSERVE_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_OBSERVE_DIR=. ;; esac
+
+doflow_observe_model() {
+  local harness="${1:-}" envelope="${2:-}" fields="" model="" model_json="" session="" cwd="" event="" now=""
+  local key="" dir="" file="" current="" tmp="" run="${DOFLOW_RUN_ID:-}" lineage="${DOFLOW_LINEAGE_ID:-}" attempt="${DOFLOW_ATTEMPT:-}"
+  case "$harness" in ''|*[!a-z0-9-]*) return 0 ;; esac
+  # lib.sh gives STATE_DIR (the config-home rule), cwd_hash and identity.sh's role reading.
+  . "$_DOFLOW_OBSERVE_DIR/../policies/lib.sh" || return 0
+  [ -n "${STATE_DIR:-}" ] || return 0
+  fields=$(printf '%s\n' "$envelope" | jq -r '
+    def text: type == "string" and length > 0 and (test("[[:cntrl:]]") | not);
+    .doflow_event as $e
+    | select(($e.identity.model | text) and ($e.identity.session | text))
+    | $e.identity.model, ($e.identity.model | tojson), $e.identity.session,
+      (if (.cwd | text) and (.cwd | startswith("/")) then .cwd else "-" end),
+      ($e.event | tojson), (now | strftime("%Y-%m-%dT%H:%M:%SZ"))' 2>/dev/null) || return 0
+  { IFS= read -r model && IFS= read -r model_json && IFS= read -r session && IFS= read -r cwd \
+    && IFS= read -r event && IFS= read -r now; } <<<"$fields" || return 0
+
+  if command -v sha256sum >/dev/null 2>&1; then key=$(printf '%s' "$session" | sha256sum | cut -c1-16)
+  elif command -v shasum >/dev/null 2>&1; then key=$(printf '%s' "$session" | shasum -a 256 | cut -c1-16)
+  else return 0; fi
+  [[ $key =~ ^[0-9a-f]{16}$ ]] || return 0
+
+  _doflow_role_resolve
+  if [ "$_DF_ROLE" = main ]; then
+    case "$cwd" in /*) ;; *) cwd=$PWD ;; esac
+    dir="$STATE_DIR/primary/$(cwd_hash "$cwd")/$harness"
+    file="$dir/$key.json"
+  else
+    [ "$run" != local ] && [[ $run =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]] || return 0
+    [[ $lineage =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]] && [[ $attempt =~ ^[1-9][0-9]{0,3}$ ]] || return 0
+    dir="$STATE_DIR/worker-model"
+    file="$dir/L.$run.$lineage.$attempt.json"
+  fi
+
+  [ ! -L "$file" ] || return 0
+  if [ -f "$file" ]; then
+    current=$(jq -r 'if (.model | type) == "string" then .model else empty end' "$file" 2>/dev/null) || current=""
+    [ "$current" != "$model" ] || return 0
+  fi
+  umask 077
+  mkdir -p "$dir" || return 0
+  tmp="$file.tmp.$$"
+  if printf '{"schema":1,"harness":"%s","model":%s,"event":%s,"observedAt":"%s","session":"%s"}\n' \
+      "$harness" "$model_json" "$event" "$now" "$key" >"$tmp" && mv -f "$tmp" "$file"; then
+    return 0
+  fi
+  rm -f "$tmp"
+  return 0
+}

package/core/harnesses/shared/hooks/bridge/respond.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # Native hook response renderers for the shared lifecycle bridge.
-case ${BASH_SOURCE[0]} in */*) _DOFLOW_RESPOND_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLOW_RESPOND_DIR=. ;; esac
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_RESPOND_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_RESPOND_DIR=. ;; esac
 . "$_DOFLOW_RESPOND_DIR/../policies/deny-json.sh"
 
 doflow_bridge_native_event_var() {
@@ -28,7 +29,6 @@ doflow_render_response() {
   if [ "$outcome" = deny ]; then
     case "$harness:$event" in
       claude:PreToolUse|codex:PreToolUse) emit_pretooluse_deny_nested "$reason" || return $?; return 0 ;;
-      gemini:BeforeTool) emit_pretooluse_deny_flat "$reason"; return 0 ;;
       kiro:PreToolUse) printf '%s' "$reason" >&2; return 2 ;;
       antigravity:PreToolUse)
         if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"deny",reason:$reason}'
@@ -38,6 +38,14 @@ doflow_render_response() {
         if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"continue",reason:$reason}'
         else printf '{"decision":"continue","reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
         return $? ;;
+      copilot:PreToolUse)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{permissionDecision:"deny",permissionDecisionReason:$reason}'
+        else printf '{"permissionDecision":"deny","permissionDecisionReason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
+      copilot:Stop)
+        if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{decision:"block",reason:$reason}'
+        else printf '{"decision":"block","reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
+        return $? ;;
       pi:tool_call)
         if command -v jq >/dev/null 2>&1; then jq -cn --arg reason "$reason" '{block:true,reason:$reason}'
         else printf '{"block":true,"reason":%s}\n' "$( _doflow_json_reason "$reason" )"; fi
@@ -53,6 +61,12 @@ doflow_render_response() {
       *) printf '%s\n' "$reason" >&2; return 2 ;;
     esac
   fi
+  if [ -n "${6:-}" ]; then
+    case "$harness:$event" in
+      claude:PreToolUse|codex:PreToolUse) emit_pretooluse_advice "$6" || return $?; return 0 ;;
+      claude:Stop|codex:Stop|codex:stop) emit_stop_advice "$6" || return $?; return 0 ;;
+    esac
+  fi
   case "$harness:$event" in
     codex:Stop|codex:stop) printf '%s\n' '{}' ;;
     antigravity:PreToolUse) printf '%s\n' '{"decision":"allow"}' ;;

package/core/harnesses/shared/hooks/policies/capture-failure.sh

@@ -6,7 +6,7 @@
 # example its pattern file is missing). It exists only to be sourced, in a subshell with all output
 # discarded, from inside a branch where the policy already fails open:
 #
-#   ( . "<policy-dir>/capture-failure.sh"; doflow_capture_failure pre-bash-guard patterns-missing ) >/dev/null 2>&1 || true
+#   ( . "<policy-dir>/capture-failure.sh"; doflow_capture_failure mcp-tool-guard contract-missing ) >/dev/null 2>&1 || true
 #
 # The subshell keeps anything this file does away from the policy, which runs with `set -uo pipefail`,
 # does not source lib.sh and would change exit codes under `set -e`. So this file:
@@ -16,29 +16,60 @@
 #   - never rotates the file (rotation is done by the Node writers only, DEC-019);
 #   - never blocks, never changes the policy's decision, and swallows every error.
 
-case ${BASH_SOURCE[0]} in */*) _DOFLOW_CAPTURE_FAILURE_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLOW_CAPTURE_FAILURE_DIR=. ;; esac
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_CAPTURE_FAILURE_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_CAPTURE_FAILURE_DIR=. ;; esac
 # The line holds only the policy name and the point name from DoFlow's own code, the working
 # directory, the harness name and the install version: never the tool call, its arguments or stdin.
-# It is a no-op when no failure home can be resolved (HOME unset, or XDG_CONFIG_HOME relative) and
-# while capture is off (the `off` sentinel file wins; DOFLOW_FAILURE_CAPTURE=off|0|false|no also
-# turns it off), the same rules the Node writer follows (IC-011, IC-014).
+# It is a no-op when there is no config home (neither XDG_CONFIG_HOME nor HOME is set to an absolute
+# path; doflow_config_home below) and while capture is off (DOFLOW_FAILURE_CAPTURE=off|0|false|no,
+# the `off` sentinel file, or a `failure.capture` value other than "on" in <config home>/settings.json,
+# read by doflow_lex_capture below), the same rules the Node writer follows (IC-011, IC-014, IC-005).
+# The two marked blocks are byte-identical to the ones in bin/doflow-run.
+
+# BEGIN doflow-config-home v1 (rule: src/runtime/config-home.js; checked by test/guards/settings.test.js)
+doflow_config_home() {
+  DOFLOW_HOME=""
+  case "${XDG_CONFIG_HOME:-}" in
+    /*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;; esac ;;
+  esac
+  case "${HOME:-}" in
+    /*) DOFLOW_HOME="${HOME}/.config/doflow" ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${HOME}/.config/doflow" ;; esac ;;
+  esac
+  return 0
+}
+# END doflow-config-home v1
+
+# BEGIN doflow-settings-lexical v1 (rule: src/runtime/settings/lexical.js; checked by test/guards/settings.test.js)
+doflow_lex_capture() {
+  local f="${1:-}" text="" rest="" d=""
+  local re='"failure\.capture"[[:space:]]*:[[:space:]]*("[^"]*"|[^,}"[:space:]]*)'
+  DOFLOW_LEX_CAPTURE=""
+  if [ ! -e "$f" ]; then
+    # Missing is no setting, unless the folder holding it cannot be searched (Node: EACCES is off).
+    d="${f%/*}"
+    if [ -n "$d" ] && [ "$d" != "$f" ] && [ -d "$d" ] && [ ! -x "$d" ]; then DOFLOW_LEX_CAPTURE="off"; fi
+    return 0
+  fi
+  if [ ! -f "$f" ] || [ ! -r "$f" ]; then DOFLOW_LEX_CAPTURE="off"; return 0; fi
+  IFS= read -r -d '' text < "$f" || true
+  rest="$text"
+  while [[ $rest =~ $re ]]; do
+    if [ "${BASH_REMATCH[1]}" = '"on"' ]; then DOFLOW_LEX_CAPTURE="${DOFLOW_LEX_CAPTURE:-on}"; else DOFLOW_LEX_CAPTURE="off"; fi
+    rest="${rest#*"${BASH_REMATCH[0]}"}"
+  done
+  return 0
+}
+# END doflow-settings-lexical v1
 
 doflow_capture_failure() {
   local policy="${1:-}" point="${2:-}"
   local LC_ALL=C   # byte-wise lengths and cuts; scoped to this function
   local home="" setting="" version="" harness="" project="" cwd="" hp="" at="" line="" here="" dir=""
 
-  if [ -n "${XDG_CONFIG_HOME:-}" ]; then
-    case "$XDG_CONFIG_HOME" in
-      /*) home="$XDG_CONFIG_HOME/doflow/failures" ;;
-      *) return 0 ;;
-    esac
-  else
-    case "${HOME:-}" in
-      /*) home="$HOME/.config/doflow/failures" ;;
-      *) return 0 ;;
-    esac
-  fi
+  doflow_config_home
+  [ -n "$DOFLOW_HOME" ] || return 0
+  home="$DOFLOW_HOME/failures"
 
   # Case-insensitive, whitespace trimmed at the ends only: the same reading the Node writer has.
   setting="$(printf '%s' "${DOFLOW_FAILURE_CAPTURE:-}" | tr '[:upper:]' '[:lower:]')" || return 0
@@ -48,6 +79,8 @@ doflow_capture_failure() {
     off|0|false|no) return 0 ;;
   esac
   [ -f "$home/off" ] && return 0
+  doflow_lex_capture "$DOFLOW_HOME/settings.json"
+  [ "$DOFLOW_LEX_CAPTURE" = off ] && return 0
 
   [[ "$policy" =~ ^[a-z][a-z0-9-]{0,39}$ ]] || policy="unknown"
   [[ "$point" =~ ^[A-Za-z][A-Za-z0-9._:-]{0,39}$ ]] || return 0

package/core/harnesses/shared/hooks/policies/compact-text.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# IC-001 (feature 116): shared PreCompact text builder; sourced, not executed.
+
+doflow_compact_text() {
+  local CWD="${1:-}"
+  local preserve branch sha uncommitted recent text
+
+  preserve='Preserve: decisions made, files modified, open questions, planned next steps, acceptance criteria and pending verification of the active task.'
+
+  if [[ -n "$CWD" ]] && is_git_worktree "$CWD"; then
+    branch=$(git_branch_of "$CWD" || echo "")
+    sha=$(git_short_sha_of "$CWD" || echo "")
+    uncommitted=$(git_uncommitted_count_of "$CWD" || echo "0")
+    recent=$(run_with_timeout 1 -- git -C "$CWD" log --format="%h %s" -2 2>/dev/null \
+      | awk 'NR>1{printf " | "}{printf "%s",$0}' || echo "")
+
+    text=$(printf '%s\nInclude in compact summary:\n- git branch: %s sha: %s\n- uncommitted files: %s\n- cwd: %s\n- recent commits: %s' \
+      "$preserve" "${branch:-unknown}" "${sha:-unknown}" "$uncommitted" "${CWD:-unknown}" "${recent:-none}")
+  else
+    text=$(printf '%s\nInclude in compact summary:\n- cwd: %s (not a git repository)' \
+      "$preserve" "${CWD:-unknown}")
+  fi
+
+  # The cap is 490 BYTES in every locale: LC_ALL=C makes the substring and length below count bytes,
+  # where a UTF-8 locale would count characters. A cut can then end inside a multi-byte character, so
+  # a trailing partial UTF-8 sequence is dropped (FU-tsq77m).
+  local LC_ALL=C cut i b need
+  cut="${text:0:490}"
+  i=$(( ${#cut} - 1 ))
+  # Walk back over at most three continuation bytes (0x80-0xBF) to the byte that starts the last character.
+  while [[ $i -ge 1 && $(( ${#cut} - i )) -le 3 ]]; do
+    printf -v b '%d' "'${cut:i:1}"
+    b=$(( b & 255 )) # the shell may print a byte above 127 as a negative number (bash 3.2) or a code unit
+    [[ $b -ge 128 && $b -lt 192 ]] || break
+    i=$(( i - 1 ))
+  done
+  printf -v b '%d' "'${cut:i:1}"
+  b=$(( b & 255 ))
+  need=1
+  [[ $b -ge 192 ]] && need=2
+  [[ $b -ge 224 ]] && need=3
+  [[ $b -ge 240 ]] && need=4
+  [[ $(( ${#cut} - i )) -lt $need ]] && cut="${cut:0:i}"
+  DF_COMPACT_TEXT="$cut"
+  return 0
+}

package/core/harnesses/shared/hooks/policies/contract.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # contract.sh — shared decision and envelope contract for canonical policies.
 #
 # This file is sourced by policy scripts. It sets no shell options, installs no traps, reads no
@@ -43,6 +44,7 @@ doflow_read_envelope() {
     DF_ENV_TOOL=
     DF_ENV_PATHS=
     DF_ENV_COMMAND=
+    DF_ENV_CWD=
     DF_ENV_PATCH=
     DF_ENV_ROOT=
     DF_ENV_TASK=
@@ -67,6 +69,7 @@ doflow_read_envelope() {
      shellvar("DF_ENV_TOOL"; field("tool")),
      shellvar("DF_ENV_PATHS"; ([$fields.paths[]? | select(type == "string")] | join("\n"))),
      shellvar("DF_ENV_COMMAND"; field("command")),
+     shellvar("DF_ENV_CWD"; ($object.cwd // "") | if type=="string" then . else "" end),
      shellvar("DF_ENV_PATCH"; field("patch")),
      shellvar("DF_ENV_ROOT"; field("projectRoot")),
      shellvar("DF_ENV_TASK"; field("taskId"))][]

package/core/harnesses/shared/hooks/policies/deny-json.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# deny-json.sh — shared PreToolUse deny-JSON emitters for front-door dispatchers.
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+# deny-json.sh — shared PreToolUse deny-JSON and advice-JSON emitters for front-door dispatchers.
 #
 # Deliberately carries no `set` directive (unlike lib.sh, which sets -euo
 # pipefail on source): a front door needs `set -e` OFF while it captures a
@@ -10,7 +11,7 @@
 #
 # Usage: source "<policy-dir>/deny-json.sh"
 
-case ${BASH_SOURCE[0]} in */*) _DOFLOW_DENY_JSON_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLOW_DENY_JSON_DIR=. ;; esac
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_DENY_JSON_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_DENY_JSON_DIR=. ;; esac
 
 # Escape a string as a JSON string body without external tools. Work bytewise so
 # every control byte is handled the same way regardless of the caller's locale.
@@ -53,12 +54,24 @@ emit_pretooluse_deny_nested() {
   fi
 }
 
-# Gemini shape: flat {decision, reason} (packages/core/src/hooks/types.ts).
-emit_pretooluse_deny_flat() {
-  local reason="$1"
+# Advice emitters (D1, advise-only hooks). An advisory outcome never changes a decision; these put its
+# one line where a harness shows it. Claude/Codex PreToolUse: additionalContext reaches the model, and
+# carries no permissionDecision, so the user's own permission prompt still applies. Claude/Codex Stop:
+# systemMessage is shown to the user and, unlike additionalContext, does not continue the turn.
+emit_pretooluse_advice() {
+  local line="$1"
+  if command -v jq >/dev/null 2>&1; then
+    jq -n --arg line "$line" '{hookSpecificOutput: {hookEventName: "PreToolUse", additionalContext: $line}}'
+  else
+    printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","additionalContext":%s}}\n' "$(_doflow_json_reason "$line")"
+  fi
+}
+
+emit_stop_advice() {
+  local line="$1"
   if command -v jq >/dev/null 2>&1; then
-    jq -n --arg reason "$reason" '{decision: "deny", reason: $reason}'
+    jq -n --arg line "$line" '{systemMessage: $line}'
   else
-    printf '{"decision":"deny","reason":%s}\n' "$(_doflow_json_reason "$reason")"
+    printf '{"systemMessage":%s}\n' "$(_doflow_json_reason "$line")"
   fi
 }

package/core/harnesses/shared/hooks/policies/emission-rules.sh

@@ -0,0 +1,37 @@
+# Generated by node src/runtime/context/emission-rules.js --write. Do not edit.
+# rules-digest: sha256:3f344067dc5466521e89700b8ca03c5729dfe2e3bc0896629d4e08a5395dd4bb
+DF_RULES_VERSION=1
+DF_RULES_MAX_BYTES_DEFAULT=16384
+DF_RULES_SUMMARY_CAP=4000
+DF_RULES_SUMMARY_READ=65536
+doflow_emission_rule() {
+  # $1 = event.segment, $2 = vector: input values joined with ':' in IC-002 order
+  case "$1|$2" in
+    'compact-instructions.instructions|main') DF_ACTION=include ;;
+    'compact-instructions.instructions|worker') DF_ACTION=include ;;
+    'compact-meta.meta|main:default-main') DF_ACTION=write ;;
+    'compact-store.summary|main:default-main') DF_ACTION=write ;;
+    'compact-store.summary|main:launched') DF_ACTION=write ;;
+    'compact-store.summary|worker:launched') DF_ACTION=write ;;
+    'delta.pack|true') DF_ACTION=include ;;
+    'launch.grant|fits:false') DF_ACTION=whole ;;
+    'launch.grant|fits:true') DF_ACTION=whole ;;
+    'launch.grant|over:false') DF_ACTION=pointer ;;
+    'launch.pack|false') DF_ACTION=include ;;
+    'launch.slot|false') DF_ACTION=claim ;;
+    'launch.summary|main:false:pending') DF_ACTION=truncate ;;
+    'launch.summary|worker:false:pending') DF_ACTION=truncate ;;
+    'legacy-adopt.legacy|main:default-main:false:false:true') DF_ACTION=adopt ;;
+    'prompt.git|main:false') DF_ACTION=include ;;
+    'prompt.grant|false:fits:false') DF_ACTION=whole ;;
+    'prompt.grant|false:fits:true') DF_ACTION=whole ;;
+    'prompt.grant|false:over:false') DF_ACTION=pointer ;;
+    'prompt.nudge|main:nudge') DF_ACTION=include ;;
+    'prompt.slot|false') DF_ACTION=claim ;;
+    'prompt.summary|main:default-main:false:false:pending') DF_ACTION=truncate ;;
+    'prompt.summary|main:launched:false:false:pending') DF_ACTION=truncate ;;
+    'prompt.summary|worker:launched:false:false:pending') DF_ACTION=truncate ;;
+    'prompt.warning|main:false:false:true') DF_ACTION=include ;;
+    *) DF_ACTION=skip ;;
+  esac
+}