@khoavu882/doflow 2.0.0-beta.5 → 2.0.1

package/core/harnesses/shared/hooks/policies/identity.sh

@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# identity.sh — Canonical Policy Library: session role and identity (feature 078, IC-007, IC-009)
+#
+# The only definition of doflow_session_role and doflow_identity (DEC-011). policies/lib.sh sources
+# it from its own directory; the Claude and Codex hooks/lib.sh copies source it through
+# ../../.doflow/shared/hooks/policies/identity.sh.
+#
+# Sourcing this file defines functions only: it sets no shell option, no variable and no trap, and
+# prints nothing. Every function is bash 3.2 safe (no ${var,,}, no associative arrays) and safe
+# under the caller's `set -euo pipefail`.
+
+# Sets _DF_ROLE to `main` or `worker` from DOFLOW_SESSION_ROLE, matched case-insensitively, without
+# a subshell. Unset or empty is `main`; any other value is `worker` and writes one stderr line, once
+# per process (a call inside $(...) cannot mark the parent, so each such call still warns).
+_doflow_role_resolve() {
+  case "${DOFLOW_SESSION_ROLE:-}" in
+    ""|[Mm][Aa][Ii][Nn]) _DF_ROLE=main ;;
+    [Ww][Oo][Rr][Kk][Ee][Rr]) _DF_ROLE=worker ;;
+    *)
+      _DF_ROLE=worker
+      if [ -z "${_DF_ROLE_WARNED:-}" ]; then
+        echo "[doflow] unknown DOFLOW_SESSION_ROLE; treating session as worker" >&2
+        _DF_ROLE_WARNED=1
+      fi
+      ;;
+  esac
+  return 0
+}
+
+# Print `main` or `worker` for this session, read from DOFLOW_SESSION_ROLE (matched
+# case-insensitively). Unset or empty is `main`; a value that is neither `main` nor
+# `worker` is `worker` and writes one line to stderr. A worker never writes or claims the
+# project's compact summary or warning. Always returns 0. bash 3.2 safe (no ${var,,}).
+doflow_session_role() {
+  _doflow_role_resolve
+  printf '%s\n' "$_DF_ROLE"
+  return 0
+}
+
+# Record one failure-capture point for the calling policy, never on stdout or stderr. The policy
+# name is the running script's name without `.sh` or `.impl.sh`; capture-failure.sh replaces a name
+# outside its pattern with `unknown`.
+_doflow_identity_capture() {
+  local point="$1" policy="${0##*/}" dir
+  policy="${policy%.sh}"
+  policy="${policy%.impl}"
+  # Inside a function, BASH_SOURCE[0] is the file that defined it: this file's directory.
+  _DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) dir=${_DOFLOW_SRC%/*} ;; *) dir=. ;; esac
+  if declare -F doflow_capture_failure >/dev/null 2>&1; then
+    ( doflow_capture_failure "$policy" "$point" ) >/dev/null 2>&1 || true
+  else
+    ( . "$dir/capture-failure.sh" && doflow_capture_failure "$policy" "$point" ) >/dev/null 2>&1 || true
+  fi
+  return 0
+}
+
+# doflow_identity <session_id> <cwd>
+# Sets DF_ID_RUN, DF_ID_ATTEMPT, DF_ID_LINEAGE, DF_ID_ROLE, DF_ID_WORKTREE, DF_ID_KIND and
+# DF_ID_UNIT per IC-007. Reads only the launcher variables, the payload session_id and cwd; never
+# git or the harness's idea of a main session. Built-ins only, except `pwd -P` in a `cd` subshell
+# when DOFLOW_WORKTREE is set and `mkdir -p` when a launched unit binds. An invalid run or lineage
+# is captured as `identity-invalid` and never reaches a path. Always returns 0.
+doflow_identity() {
+  local session_id="${1:-}" cwd="${2:-}" LC_ALL=C
+  local run="${DOFLOW_RUN_ID:-}" attempt="${DOFLOW_ATTEMPT:-}" lineage="${DOFLOW_LINEAGE_ID:-}"
+  local worktree="${DOFLOW_WORKTREE:-}" invalid=0 run_ok=0 lineage_ok=0 attempt_ok=0
+  local sessions dir bound="" had_c=0 mine=0 tries
+
+  _doflow_role_resolve
+  DF_ID_ROLE=$_DF_ROLE
+
+  # run: id pattern and not `local`; unset is `local`; invalid is unlaunched with lineage solo.
+  if [ -z "$run" ]; then
+    DF_ID_RUN=local
+  elif [ "$run" != local ] && [[ $run =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]]; then
+    DF_ID_RUN=$run
+    run_ok=1
+  else
+    DF_ID_RUN=local
+    invalid=1
+  fi
+
+  # attempt: integer 1 to 9999; invalid is as unset.
+  DF_ID_ATTEMPT=""
+  if [[ $attempt =~ ^[1-9][0-9]{0,3}$ ]]; then
+    DF_ID_ATTEMPT=$attempt
+    attempt_ok=1
+  fi
+
+  # lineage: id pattern; unset is `main` for main and `solo` for worker; invalid is `solo`.
+  if [ -z "$lineage" ]; then
+    if [ "$DF_ID_ROLE" = main ]; then DF_ID_LINEAGE=main; else DF_ID_LINEAGE=solo; fi
+  elif [[ $lineage =~ ^[A-Za-z0-9][A-Za-z0-9_-]{0,55}$ ]]; then
+    DF_ID_LINEAGE=$lineage
+    lineage_ok=1
+  else
+    DF_ID_LINEAGE=solo
+    invalid=1
+  fi
+  if [ -n "$run" ] && [ "$run_ok" = 0 ]; then
+    DF_ID_LINEAGE=solo
+    lineage_ok=0
+  fi
+  [ "$invalid" = 0 ] || _doflow_identity_capture identity-invalid
+
+  # worktree: an absolute path to an existing directory, canonicalised; otherwise the payload cwd.
+  DF_ID_WORKTREE=$cwd
+  case "$worktree" in
+    /*)
+      if [ -d "$worktree" ]; then
+        worktree=$(CDPATH= cd -P -- "$worktree" 2>/dev/null && pwd -P) || worktree=""
+        [ -z "$worktree" ] || DF_ID_WORKTREE=$worktree
+      fi
+      ;;
+  esac
+
+  if [ "$run_ok" = 1 ] && [ "$lineage_ok" = 1 ] && [ "$attempt_ok" = 1 ]; then
+    DF_ID_KIND=launched
+    DF_ID_UNIT="L.$DF_ID_RUN.$DF_ID_LINEAGE.$DF_ID_ATTEMPT"
+  elif [ "$DF_ID_RUN" = local ] && [ "$DF_ID_LINEAGE" = main ]; then
+    # default-main: run unset and lineage main, whether main was defaulted or set explicitly.
+    DF_ID_KIND=default-main
+    DF_ID_UNIT=$session_id
+  else
+    DF_ID_KIND=solo
+    DF_ID_UNIT=$session_id
+  fi
+
+  # Binding (DEC-008, DEC-044): the first session to present a launched unit creates `bound`
+  # exclusively; a session whose id differs from the bound one is inherited and gets its own solo
+  # unit. A unit that cannot be bound with a session id (store unwritable, `bound` a symlink, which is
+  # never followed, or `bound` still empty after one retry) is inherited too. With no session id the
+  # unit is solo with an empty unit id and no capture.
+  if [ "$DF_ID_KIND" = launched ]; then
+    # The store is lib.sh's SESSION_DIR. Sourced without lib.sh, the config-home rule of
+    # src/runtime/config-home.js is applied inline (an absolute XDG_CONFIG_HOME, else an absolute
+    # HOME + /.config); with no config home there is no store and the unit is not bound (086 IC-010).
+    sessions="${SESSION_DIR:-}"
+    # doflow-config-home v1 inline copy: no marked block here, identity.sh defines only its four functions (086 B.2).
+    if [ -z "$sessions" ]; then
+      case "${XDG_CONFIG_HOME:-}" in
+        /*) sessions="$XDG_CONFIG_HOME/doflow/session-env/sessions" ;;
+        [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) sessions="$XDG_CONFIG_HOME/doflow/session-env/sessions" ;; esac ;;
+      esac
+      case "${HOME:-}" in
+        /*) [ -n "$sessions" ] || sessions="$HOME/.config/doflow/session-env/sessions" ;;
+        [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) [ -n "$sessions" ] || sessions="$HOME/.config/doflow/session-env/sessions" ;; esac ;;
+      esac
+    fi
+    dir="${sessions:+$sessions/$DF_ID_UNIT}"
+    if [ -n "$session_id" ] && [ -n "$dir" ] && mkdir -p "$dir" 2>/dev/null; then
+      case $- in *C*) had_c=1 ;; esac
+      set -C
+      { printf '%s\n' "$session_id" >"$dir/bound"; } 2>/dev/null && mine=1
+      [ "$had_c" = 1 ] || set +C
+      if [ "$mine" = 0 ]; then
+        # An empty first line may be a concurrent binder between its create and its write.
+        for tries in 1 2; do
+          [ -f "$dir/bound" ] && [ ! -L "$dir/bound" ] || break
+          IFS= read -r bound 2>/dev/null <"$dir/bound" || true
+          [ -z "$bound" ] || break
+        done
+        [ -z "$bound" ] || [ "$bound" != "$session_id" ] || mine=1
+      fi
+    fi
+    if [ "$mine" = 0 ]; then
+      DF_ID_KIND=solo
+      DF_ID_LINEAGE=solo
+      DF_ID_UNIT=$session_id
+      if [ -n "$session_id" ] && [ -z "${_DF_ID_INHERITED_CAPTURED:-}" ]; then
+        _doflow_identity_capture identity-inherited
+        _DF_ID_INHERITED_CAPTURED=1
+      fi
+    fi
+  fi
+  return 0
+}

package/core/harnesses/shared/hooks/policies/lib.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # lib.sh — shared constants and helpers for the Canonical Policy Library
 #
 # Usage: source "<policy-dir>/lib.sh"
@@ -9,7 +10,7 @@
 #   3. capture stdin once: INPUT=$(cat)
 #   4. use: json_field "$INPUT" ".field_name"
 
-case ${BASH_SOURCE[0]} in */*) _DOFLOW_LIB_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLOW_LIB_DIR=. ;; esac
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_LIB_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_LIB_DIR=. ;; esac
 #
 # Deployment:
 #   This file is installed by the doflow CLI and overwritten on update — do
@@ -17,7 +18,7 @@ case ${BASH_SOURCE[0]} in */*) _DOFLOW_LIB_DIR=${BASH_SOURCE[0]%/*} ;; *) _DOFLO
 #
 # Consolidation note (022-normalize-hooks, Phase B): this is the single
 # canonical copy every front door's dispatched policy script sources — the
-# claude/gemini/kiro/codex copies it replaces were already byte-identical
+# claude/kiro/codex copies it replaces were already byte-identical
 # except for one Claude-only default (see DOFLOW_AGENT below), confirmed via
 # diff before consolidating.
 
@@ -25,16 +26,33 @@ set -euo pipefail
 
 # ── State directories ────────────────────────────────────────────────────────
 
-# XDG-compliant, agent-agnostic store shared by every harness DoFlow supports.
-DOFLOW_HOME="${XDG_CONFIG_HOME:-$HOME/.config}/doflow"
-STATE_DIR="$DOFLOW_HOME/session-env"
-SESSION_DIR="$STATE_DIR/sessions"
-PROJECTS_DIR="$STATE_DIR/projects"
+# XDG-compliant, agent-agnostic store shared by every harness DoFlow supports, under the config home
+# (doflow_config_home: an absolute XDG_CONFIG_HOME, else an absolute HOME + /.config, else none). With
+# no config home every state path below is empty, sourcing this file still never exits, and each state
+# function returns 0 at once: session work is skipped and a guard reaches its own decision (086 IC-010).
+# BEGIN doflow-config-home v1 (rule: src/runtime/config-home.js; checked by test/guards/settings.test.js)
+doflow_config_home() {
+  DOFLOW_HOME=""
+  case "${XDG_CONFIG_HOME:-}" in
+    /*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;; esac ;;
+  esac
+  case "${HOME:-}" in
+    /*) DOFLOW_HOME="${HOME}/.config/doflow" ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${HOME}/.config/doflow" ;; esac ;;
+  esac
+  return 0
+}
+# END doflow-config-home v1
+doflow_config_home
+STATE_DIR="${DOFLOW_HOME:+$DOFLOW_HOME/session-env}"
+SESSION_DIR="${STATE_DIR:+$STATE_DIR/sessions}"
+PROJECTS_DIR="${STATE_DIR:+$STATE_DIR/projects}"
 # shellcheck disable=SC2034  # used by session-context.sh and stop-check.sh which source this file
-SESSIONS_LOG="$DOFLOW_HOME/sessions.log"
+SESSIONS_LOG="${DOFLOW_HOME:+$DOFLOW_HOME/sessions.log}"
 
 # Identifies which harness is running. A front door sets this before sourcing
-# this file (e.g. `export DOFLOW_AGENT=gemini; exec bash .../policies/...sh`);
+# this file (e.g. `export DOFLOW_AGENT=codex; exec bash .../policies/...sh`);
 # "unknown" here — not any one harness's name — is the honest fallback when a
 # front door omits it, since every prior per-harness copy of this file
 # defaulted to "claude-code" regardless of which harness actually shipped it.
@@ -253,18 +271,22 @@ has_uncommitted_changes() {
 # ── Directory helpers ─────────────────────────────────────────────────────────
 
 # Create and return the session-scoped state directory for a given session_id.
-# Safe to call multiple times (mkdir -p is idempotent).
+# Safe to call multiple times (mkdir -p is idempotent). Prints nothing and creates nothing when
+# there is no config home (SESSION_DIR empty).
 ensure_session_dir() {
   local session_id="$1"
+  [ -n "$SESSION_DIR" ] || return 0
   mkdir -p "$SESSION_DIR/$session_id"
   echo "$SESSION_DIR/$session_id"
 }
 
 # Create and return the project-scoped state directory for a given cwd.
-# Shared across all sessions in the same directory.
+# Shared across all sessions in the same directory. Prints nothing and creates nothing when there
+# is no config home (PROJECTS_DIR empty).
 ensure_project_dir() {
   local cwd="$1"
   local hash
+  [ -n "$PROJECTS_DIR" ] || return 0
   hash=$(cwd_hash "$cwd")
   mkdir -p "$PROJECTS_DIR/$hash"
   echo "$PROJECTS_DIR/$hash"
@@ -293,30 +315,16 @@ require_jq() {
   fi
 }
 
-# ── Session role ──────────────────────────────────────────────────────────────
-
-# Print `main` or `worker` for this session, read from DOFLOW_SESSION_ROLE (matched
-# case-insensitively). Unset or empty is `main`; a value that is neither `main` nor
-# `worker` is `worker` and writes one line to stderr. A worker never writes or claims the
-# project's compact summary or warning. Always returns 0. bash 3.2 safe (no ${var,,}).
-doflow_session_role() {
-  local role
-  role=$(printf '%s' "${DOFLOW_SESSION_ROLE:-}" | tr '[:upper:]' '[:lower:]') || role=""
-  case "$role" in
-    ""|main) printf 'main\n' ;;
-    worker) printf 'worker\n' ;;
-    *)
-      echo "[doflow] unknown DOFLOW_SESSION_ROLE; treating session as worker" >&2
-      printf 'worker\n'
-      ;;
-  esac
-  return 0
-}
+# ── Session role and identity ─────────────────────────────────────────────────
+
+# doflow_session_role and doflow_identity live in identity.sh, their only definition (IC-009).
+. "$_DOFLOW_LIB_DIR/identity.sh"
 
 # Start storage cleanup without changing the hook's output, status, or latency.
 storage_upkeep_async() {
-  local cwd="${1:-}" root run home config_dir
+  local cwd="${1:-}" root run home config_dir detach=""
   [ -n "$cwd" ] || return 0
+  command -v setsid >/dev/null 2>&1 && detach="setsid"
   home="${HOME:-}"
   config_dir="${CLAUDE_CONFIG_DIR:-$home/.claude}"
   root=$(nudge_repo_root "$cwd" 2>/dev/null) || root="$cwd"
@@ -329,7 +337,9 @@ storage_upkeep_async() {
     # Background the fully redirected subshell; an inner `&` leaves this shell
     # holding the hook's captured stdout open until the dispatcher exits. The
     # storage verb takes its project from the working directory: run it at the root.
-    ( cd "$root" 2>/dev/null && nohup "$run" storage --action upkeep </dev/null >/dev/null 2>&1 ) >/dev/null 2>&1 3>&- 5>&- &
+    # setsid (absent on macOS) moves the upkeep out of the hook's session, so a harness that
+    # signals the hook's process group when the hook exits does not take the upkeep with it.
+    ( cd "$root" 2>/dev/null && nohup $detach "$run" storage --action upkeep </dev/null >/dev/null 2>&1 ) >/dev/null 2>&1 3>&- 5>&- &
     return 0
   done
   return 0
@@ -379,7 +389,7 @@ nudge_repo_root() {
 # file that cannot be read, is empty or holds anything else is `off`.
 nudge_setting() {
   local root="${1:-}" file line=""
-  for file in "${root:+$root/.doflow/prompt-nudge}" "$DOFLOW_HOME/prompt-nudge"; do
+  for file in "${root:+$root/.doflow/prompt-nudge}" "${DOFLOW_HOME:+$DOFLOW_HOME/prompt-nudge}"; do
     [ -n "$file" ] && [ -e "$file" ] || continue
     line=""
     { IFS= read -r line || true; } 2>/dev/null < "$file" || line=""
@@ -406,17 +416,20 @@ nudge_safe_id() {
   return 0
 }
 
-# Print the marker path for a session id. The caller checks nudge_safe_id first.
+# Print the marker path for a session id. The caller checks nudge_safe_id first. With no config
+# home there is no marker path and nothing is printed.
 nudge_marker_file() {
+  [ -n "$STATE_DIR" ] || return 0
   printf '%s\n' "$STATE_DIR/nudge/$1"
 }
 
 # Create the marker for <id> holding <nudged|suppressed>. Succeeds only when this call
 # created it: the create is exclusive, so a second call for the same id fails and
 # leaves the first content. After a create, markers untouched for over 30 days are
-# removed. Silent on every failure.
+# removed. Silent on every failure. With no config home it creates nothing and returns 0 at once.
 nudge_mark() {
-  local id="${1:-}" word="${2:-}" dir="$STATE_DIR/nudge" file
+  local id="${1:-}" word="${2:-}" dir="${STATE_DIR:+$STATE_DIR/nudge}" file
+  [ -n "$dir" ] || return 0
   nudge_safe_id "$id" || return 1
   case "$word" in nudged|suppressed) ;; *) return 1 ;; esac
   file="$dir/$id"
@@ -452,7 +465,8 @@ nudge_feature_active() {
 # S3: succeed when a `/do-*` skill already ran this session, read from the run ledger:
 # the lexically last <config>/state/runs/*.jsonl, whose last line's timestamp is not
 # earlier than the session's captured_at (both YYYY-MM-DDTHH:MM:SSZ). Config dir:
-# $DOFLOW_CONFIG_DIR, else the nearest `.doflow` at or above <cwd>, else $HOME/.doflow.
+# $DOFLOW_CONFIG_DIR, else the nearest non-nested `.doflow` at or above <cwd>, else $HOME/.doflow
+# (none when HOME is unset or empty).
 # Without a captured_at the ledger counts when it is named for today's UTC date; a last
 # line without a usable timestamp counts too. No ledger, or an empty one, does not.
 nudge_ledger_active() {
@@ -462,10 +476,19 @@ nudge_ledger_active() {
   if [ -n "${DOFLOW_CONFIG_DIR:-}" ]; then
     config="$DOFLOW_CONFIG_DIR"
   else
-    config="$HOME/.doflow"
+    config="${HOME:+$HOME/.doflow}"
     # The ancestor in the walk's own spelling (`\` read as `/`), the form its test succeeded on.
-    if dir=$(nudge_find_up "$cwd" .doflow -d); then config="${dir//\\//}/.doflow"; fi
+    if dir=$(nudge_find_up "$cwd" .doflow -d); then
+      while :; do
+        dir="${dir//\\//}"
+        case "$dir/" in
+          */.doflow/*) dir=$(nudge_find_up "${dir%/*}" .doflow -d) || break ;;
+          *) config="$dir/.doflow"; break ;;
+        esac
+      done
+    fi
   fi
+  [ -n "$config" ] || return 1
   for f in "$config"/state/runs/*.jsonl; do
     [ -f "$f" ] && ledger="$f"
   done
@@ -493,7 +516,7 @@ nudge_registry() {
     "${policy_dir:+$policy_dir/../../../runtime/core/registry/workflows.json}" \
     "${policy_dir:+$policy_dir/../../../../registry/workflows.json}" \
     "${root:+$root/.doflow/runtime/core/registry/workflows.json}" \
-    "$HOME/.doflow/runtime/core/registry/workflows.json"; do
+    "${HOME:+$HOME/.doflow/runtime/core/registry/workflows.json}"; do
     if [ -n "$candidate" ] && [ -f "$candidate" ]; then
       printf '%s\n' "$candidate"
       return 0

package/core/harnesses/shared/hooks/policies/mcp-policy.conf

@@ -1,6 +1,6 @@
 # mcp-policy.conf — MCP tool deny patterns for mcp-tool-guard.sh
 #
-# Format (TAB-separated), identical convention to blocked-patterns.conf:
+# Format (TAB-separated):
 #   regex<TAB>reason shown to the harness
 #
 # Rules:

package/core/harnesses/shared/hooks/policies/mcp-tool-guard.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-case $0 in */*) _DOFLOW_POLDIR=${0%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+_DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
 # mcp-tool-guard.sh — Canonical Policy Library: PreToolUse(mcp_*) hook
 #
 # Intercepts every MCP tool call and blocks matches against mcp-policy.conf, the
-# same TAB-separated pattern<TAB>reason convention pre-bash-guard.sh uses for
-# shell commands. Ships with mcp-policy.conf carrying zero active patterns, so
+# TAB-separated pattern<TAB>reason format. Ships with mcp-policy.conf carrying zero active patterns, so
 # this is pure infrastructure until real usage data justifies specific deny
 # rules — see agent-docs/research/hook-governance-agent-tool-mcp-skill.md §3.2.
 #
@@ -20,7 +20,7 @@ case $0 in */*) _DOFLOW_POLDIR=${0%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
 #
 # mcp-policy.conf's shape (TAB-separated regex<TAB>reason, '#'-comments,
 # blank lines skipped) is identical across every harness that ships one today
-# (claude/codex/gemini/kiro) — reconciliation found no divergence to resolve
+# (claude/codex/kiro) — reconciliation found no divergence to resolve
 # there.
 
 set -uo pipefail
@@ -38,8 +38,7 @@ else
   else
     printf '[mcp-tool-guard] DoFlow hooks out of step; run: doflow update\n' >&2
   fi
-  doflow_decide deny contract-missing
-  exit 2
+  exit 0
 fi
 doflow_decision_init mcp-tool-guard 1
 command -v jq >/dev/null 2>&1 || {
@@ -63,8 +62,8 @@ else
     ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure mcp-tool-guard envelope-missing ) >/dev/null 2>&1 || true
   fi
   if [[ "${DOFLOW_AGENT:-}" =~ ^[a-z]+$ ]]; then printf '[mcp-tool-guard] DoFlow hooks out of step; run: doflow update -t %s\n' "$DOFLOW_AGENT" >&2; else printf '[mcp-tool-guard] DoFlow hooks out of step; run: doflow update\n' >&2; fi
-  doflow_decide deny "${DF_ENV_CODE:-envelope-missing}"
-  exit 2
+  doflow_decide unsupported "${DF_ENV_CODE:-envelope-missing}"
+  exit 0
 fi
 
 POLICY_FILE="$_DOFLOW_POLDIR/mcp-policy.conf"