@lyupro/codex-bridge 0.5.1 → 0.5.3

package/src/home/hooks/shell-write-intent.mjs

@@ -0,0 +1,120 @@
+/**
+ * Reports whether a shell command plainly intends to write files and the target paths it names.
+ *
+ * This is deliberately not a complete list, and it cannot become one. Enumerating every way a
+ * shell can write would reproduce the original defect one level up: the 2026-08-16 incident is
+ * why the worktree witness hook exists beside this cheap prevention check.
+ */
+
+const COMMANDS = new Set(['cp', 'mv', 'rm', 'touch', 'truncate', 'tee', 'sed']);
+const INTERPRETERS = /\b(?:python(?:\d+(?:\.\d+)?)?|node|perl|ruby)(?:\.exe)?\b/i;
+
+function unquote(value) {
+  const trimmed = value.trim().replace(/[;,]+$/, '');
+  if ((trimmed.startsWith('"') && trimmed.endsWith('"'))
+    || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+
+// A candidate holding a character no file name may contain is not a file name. The redirection
+// pattern cannot tell `>` the operator from `>` the redirect, so `node -e "i>0?'yes':'no'"` was
+// refused on 2026-08-23 naming the path `0?'yes` — a false refusal on a command that writes
+// nothing. Narrowing here costs nothing the witness does not already cover.
+const IMPOSSIBLE_IN_A_NAME = /[?*<>|"]/;
+
+function addPath(paths, value) {
+  const candidate = unquote(value);
+  if (candidate
+    && !['&', '$', '%', '`'].includes(candidate[0])
+    && !IMPOSSIBLE_IN_A_NAME.test(candidate)
+    && !paths.includes(candidate)) paths.push(candidate);
+}
+
+function tokens(segment) {
+  return segment.match(/"(?:\\.|[^"])*"|'[^']*'|[^\s]+/g) ?? [];
+}
+
+function positional(args) {
+  return args.filter((arg) => !arg.startsWith('-'));
+}
+
+/**
+ * Strip the directory and the Windows executable suffix before matching the command name.
+ * `INTERPRETERS` has always allowed `python.exe`; the command list did not, so `sed.exe -i` —
+ * the spelling Git Bash and PowerShell hand over on this platform — walked past the guard while
+ * the identical `sed -i` was refused (found accepting the 2026-08-17 smoke run, which had recorded
+ * that gap as intended behaviour).
+ */
+function commandName(token) {
+  return token.replace(/^.*[\\/]/, '').replace(/\.exe$/i, '').toLowerCase();
+}
+
+/**
+ * Split a heredoc command into the shell around it and the document inside it.
+ *
+ * `shell` is everything the shell itself runs — the line opening the document AND every command
+ * after its closing marker. Dropping that tail hid `… <<EOF … EOF; echo x >> README.md` from the
+ * guard completely, and a live probe on 2026-08-23 wrote to a tracked file during a held run
+ * exactly that way. `paths` holds only what the document body names, which the caller uses just
+ * when the interpreter is itself the writer.
+ */
+function heredoc(command) {
+  const header = command.match(/^(.*?<<-?\s*(['"]?)([A-Za-z_][\w-]*)\2[^\r\n]*)[\r\n]/s);
+  if (!header) return null;
+  const paths = [];
+  const marker = header[3];
+  const body = command.slice(header[0].length).split(/\r?\n/);
+  const end = body.findIndex((line) => line.trim() === marker);
+  const shell = [header[1], ...(end < 0 ? [] : body.slice(end + 1))].join('\n');
+  if (!INTERPRETERS.test(header[1])) return { shell, paths, writes: false };
+  const source = body.slice(0, end < 0 ? body.length : end).join('\n');
+  for (const match of source.matchAll(/(['"])(.*?)\1/g)) {
+    const value = match[2];
+    if (/^(?:[A-Za-z]:[\\/]|[\\/]|\.\.?[\\/])/.test(value)
+      || /[\\/]/.test(value)
+      || /(?:^|[\\/])[^\\/]+\.[A-Za-z0-9_-]+$/.test(value)) addPath(paths, value);
+  }
+  return { header: header[1], paths, writes: true };
+}
+
+/** Returns `{ writes, paths }` for the deliberately obvious write forms this guard recognises. */
+export function shellWriteIntent(command) {
+  if (typeof command !== 'string' || !command.trim()) return { writes: false, paths: [] };
+  const paths = [];
+  const document = heredoc(command);
+  const shell = document?.header ?? command;
+  let writes = document?.writes ?? false;
+
+  for (const match of shell.matchAll(/(?<![<>=])(?:\d*)>>?(?![=>&])\s*("(?:\\.|[^"])*"|'[^']*'|[^\s;|&]+)/g)) {
+    writes = true;
+    addPath(paths, match[1]);
+  }
+
+  // A real output redirect identifies the writer's destination. Body text is only evidence when
+  // the interpreter itself is the writer, as in the 2026-08-16 python heredoc incident.
+  if (!paths.length && document?.writes) {
+    for (const candidate of document.paths) addPath(paths, candidate);
+  }
+
+  for (const segment of shell.split(/(?:&&|\|\||[;|\r\n])/)) {
+    const parts = tokens(segment);
+    const index = parts.findIndex((part) => COMMANDS.has(commandName(part)));
+    if (index < 0) continue;
+    const name = commandName(parts[index]);
+    const args = parts.slice(index + 1);
+    if (name === 'sed' && !args.some((arg) => /^-.*i/.test(arg))) continue;
+    writes = true;
+    const values = positional(args);
+    if (name === 'cp' || name === 'mv') {
+      if (values.length > 1) addPath(paths, values.at(-1));
+    } else if (name === 'sed') {
+      for (const value of values.slice(1)) addPath(paths, value);
+    } else {
+      for (const value of values) addPath(paths, value);
+    }
+  }
+
+  return { writes, paths };
+}

package/src/{hooks → home/hooks}/stop-guard.mjs

@@ -1,8 +1,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { STOP_TOOLS } from '../hook-definitions.mjs';
-import { runsRoot } from '../runner/runs-root.mjs';
-import { renderStopCommand, STOP_REASON } from '../stop-contract.mjs';
+import { STOP_TOOLS } from '../lib/hook-definitions.mjs';
+import { runsRoot } from '../lib/runner/runs-root.mjs';
+import { renderStopCommand, STOP_REASON } from '../lib/stop-contract.mjs';
 import { allLiveRuns, normalizePath } from './live-runs.mjs';
 import { takeTry } from './guard-tries.mjs';
 

package/src/home/hooks/worktree-lock.mjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse lock for file tools and plainly recognisable shell writes in the Claude Code host.
+ *
+ * A live codex-build runner snapshots its repository before and after editing. Letting the
+ * orchestrator write during that window folds unrelated work into the runner's result, exactly
+ * as the 2026-08-05 incident did. This hook denies only a recognised file path inside a live
+ * build run's repository; every malformed or unreadable input passes so diagnostics never break
+ * unrelated host work.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { formatSilence, heartbeatAge } from '../lib/heartbeat.mjs';
+import { SHELL_TOOLS, WRITE_TOOLS } from '../lib/hook-definitions.mjs';
+import { runsRoot } from '../lib/runner/runs-root.mjs';
+import { allLiveRuns, normalizePath } from './live-runs.mjs';
+import { shellWriteIntent } from './shell-write-intent.mjs';
+
+const WRITE_TOOL_NAMES = new Set(WRITE_TOOLS);
+const SHELL_TOOL_NAMES = new Set(SHELL_TOOLS);
+const pass = () => process.exit(0);
+
+let input;
+try {
+  input = JSON.parse(fs.readFileSync(0, 'utf8'));
+} catch {
+  pass();
+}
+
+if (!input || typeof input !== 'object' || Array.isArray(input)) pass();
+if (!WRITE_TOOL_NAMES.has(input.tool_name) && !SHELL_TOOL_NAMES.has(input.tool_name)) pass();
+
+const toolInput = input.tool_input;
+if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput)) pass();
+let rawPaths;
+if (WRITE_TOOL_NAMES.has(input.tool_name)) {
+  const pathField = input.tool_name === 'NotebookEdit' ? 'notebook_path' : 'file_path';
+  const rawPath = toolInput[pathField];
+  if (typeof rawPath !== 'string' || !rawPath.trim()) pass();
+  rawPaths = [rawPath];
+} else {
+  const intent = shellWriteIntent(toolInput.command);
+  if (!intent.writes || !intent.paths.length) pass();
+  rawPaths = intent.paths;
+}
+
+let liveRuns;
+try {
+  liveRuns = allLiveRuns(runsRoot());
+} catch {
+  pass();
+}
+let match;
+for (const rawPath of rawPaths) {
+  let targetPath;
+  try {
+    if (path.isAbsolute(rawPath)) targetPath = rawPath;
+    else if (typeof input.cwd === 'string' && input.cwd.trim()) targetPath = path.resolve(input.cwd, rawPath);
+    else continue;
+  } catch {
+    continue;
+  }
+  const target = normalizePath(targetPath);
+  if (!target) continue;
+  const owner = liveRuns.find(({ status }) => {
+    if (status.agent !== 'codex-build') return false;
+    const repository = normalizePath(status.repo);
+    return Boolean(repository) && (target === repository || target.startsWith(`${repository}/`));
+  });
+  if (owner) {
+    match = { owner, targetPath };
+    break;
+  }
+}
+if (!match) pass();
+
+const { status, dir } = match.owner;
+// A run is only ever failed for what `git status --porcelain` reports, and an ignored path never
+// appears there — the witness that grades a run does not see it either. Meanwhile the working
+// order for a live run is to touch exactly those files: plans and checklists live in ignored
+// folders. On 2026-08-23 this guard refused four such edits in five minutes, which is worse than
+// a miss: a miss has the witness behind it, a false refusal has nothing and reads as a broken
+// tool. Only a proven `ignored` passes — anything else (not a repository, git absent, any other
+// error) keeps the refusal, because "no proof it is ignored" is not "proof it is harmless".
+const repository = normalizePath(status.repo);
+const target = normalizePath(match.targetPath);
+const gitMetadata = target === `${repository}/.git` || target.startsWith(`${repository}/.git/`);
+if (!gitMetadata) {
+  const ignored = spawnSync('git', ['-C', status.repo, 'check-ignore', '--quiet', '--', match.targetPath], {
+    stdio: 'ignore',
+  });
+  if (ignored.status === 0) pass();
+}
+process.stdout.write(JSON.stringify({
+  hookSpecificOutput: {
+    hookEventName: 'PreToolUse',
+    permissionDecision: 'deny',
+    permissionDecisionReason: `Worktree lock denied ${input.tool_name}: ${match.targetPath} is inside repository `
+      + `${status.repo}, held by live run folder ${dir} (agent ${status.agent}, slug ${status.slug}). `
+      // "Working, last progress X ago" rather than "silent for X": this hook only ever denies a
+      // run whose heartbeat is still fresh — a stale one is not live here and the edit passes. The
+      // first live probe printed "silent for 10 seconds" next to a stop command on a perfectly
+      // healthy run, which reads as "it hung, kill it" and would cost the operator 20 minutes of
+      // work they meant to keep.
+      + `It is working; last progress ${formatSilence(heartbeatAge(dir))} ago. `
+      + `To take the repository back before it finishes: codex-bridge stop ${path.basename(dir)}.`,
+  },
+}));

package/src/home/hooks/worktree-witness.mjs

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+/**
+ * PostToolUse witness for shell writes into a live codex-build repository.
+ *
+ * A shell can write through Python, redirection, or any other command while bypassing the
+ * file-tool lock. That is how the orchestrator changed CHANGELOG.md during the 2026-08-16
+ * split-guard run and made an honest build appear out of scope. This hook compares the live
+ * run's recorded git state with the repository after every shell tool and directs the
+ * orchestrator to undo any change outside the run's declared scope.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { SHELL_TOOLS } from '../lib/hook-definitions.mjs';
+import { parseJsonText } from '../lib/json-file.mjs';
+import { globToRegExp } from '../lib/meta/paths.mjs';
+import { runsRoot } from '../lib/runner/runs-root.mjs';
+import { allLiveRuns, normalizePath } from './live-runs.mjs';
+
+const SHELL_TOOL_NAMES = new Set(SHELL_TOOLS);
+const pass = () => process.exit(0);
+
+function readRequired(file) {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+function statusMap(text) {
+  if (typeof text !== 'string') return null;
+  const result = new Map();
+  for (const line of text.split(/\r?\n/).filter(Boolean)) {
+    if (!/^.. /.test(line)) return null;
+    const rawPath = line.slice(3);
+    const file = rawPath.includes(' -> ') ? rawPath.slice(rawPath.lastIndexOf(' -> ') + 4) : rawPath;
+    if (!file.trim()) return null;
+    result.set(file, line.slice(0, 2));
+  }
+  return result;
+}
+
+let input;
+try {
+  input = parseJsonText('stdin', fs.readFileSync(0, 'utf8'));
+} catch {
+  pass();
+}
+
+if (!input || typeof input !== 'object' || Array.isArray(input)) pass();
+if (!SHELL_TOOL_NAMES.has(input.tool_name)) pass();
+const cwd = normalizePath(input.cwd);
+if (!cwd) pass();
+
+let liveRuns;
+try {
+  liveRuns = allLiveRuns(runsRoot());
+} catch {
+  pass();
+}
+const owner = liveRuns.find(({ status }) => {
+  if (status.agent !== 'codex-build') return false;
+  const repository = normalizePath(status.repo);
+  return Boolean(repository) && (cwd === repository || cwd.startsWith(`${repository}/`));
+});
+if (!owner) pass();
+
+const { dir, status } = owner;
+const beforeText = readRequired(path.join(dir, 'git-before.txt'));
+const scopeText = readRequired(path.join(dir, 'scope.txt'));
+if (beforeText === null || scopeText === null) pass();
+
+const before = statusMap(beforeText);
+let allowed;
+try {
+  const patterns = scopeText.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+  if (!patterns.length) pass();
+  allowed = patterns.map(globToRegExp);
+} catch {
+  pass();
+}
+if (!before) pass();
+
+let currentResult;
+try {
+  currentResult = spawnSync('git', ['-C', status.repo, 'status', '--porcelain'], {
+    encoding: 'utf8',
+  });
+} catch {
+  pass();
+}
+if (currentResult.error || currentResult.status !== 0 || typeof currentResult.stdout !== 'string') pass();
+const current = statusMap(currentResult.stdout);
+if (!current) pass();
+
+const changed = [];
+for (const [file, state] of current) if (before.get(file) !== state) changed.push(file);
+for (const file of before.keys()) if (!current.has(file)) changed.push(file);
+const outside = [...new Set(changed)].filter((file) => !allowed.some((pattern) => pattern.test(file)));
+if (!outside.length) pass();
+
+const folder = path.basename(dir);
+const paths = outside.join(', ');
+process.stdout.write(JSON.stringify({
+  hookSpecificOutput: {
+    hookEventName: 'PostToolUse',
+    additionalContext: `WORKTREE WITNESS — act now: the shell changed paths outside the scope of `
+      + `live run folder ${dir} (agent ${status.agent}, slug ${status.slug}): ${paths}. `
+      + `Revert those paths now, or run codex-bridge stop ${folder} to take the repository back `
+      + `before making further changes.`,
+  },
+}));

package/src/home/lib/dispatcher-order.mjs

@@ -0,0 +1,36 @@
+/** Reads and compares the order identity carried between dispatcher hook boundaries. */
+import fs from 'node:fs';
+import { parseJsonText } from './json-file.mjs';
+import { extractValue } from './required-inputs.mjs';
+
+/** The transcript is diagnostic evidence; malformed or unavailable evidence must fail open. */
+export function transcriptOrderId(transcriptPath) {
+  try {
+    const firstEntry = fs.readFileSync(transcriptPath, 'utf8').split(/\r?\n/, 1)[0];
+    const transcriptEntry = parseJsonText(transcriptPath, firstEntry);
+    const content = transcriptEntry?.message?.content;
+    const promptText = typeof content === 'string'
+      ? content
+      : Array.isArray(content)
+        ? content.filter((part) => part?.type === 'text').map((part) => part.text).join('\n')
+        : '';
+    return String(extractValue(promptText, 'order id') || '').trim();
+  } catch {
+    return '';
+  }
+}
+
+/** On 2026-08-15 another order's saved reply was returned as the current run's verdict. */
+export function runOrderMismatch(orderedOrderId, runStatus, runDir) {
+  const ordered = String(orderedOrderId ?? '').trim();
+  const recorded = String(runStatus?.order_id ?? '').trim();
+  if (!ordered || !recorded || ordered === recorded) return null;
+  return {
+    reason: `Contract violated: the dispatcher was ordered order id ${JSON.stringify(ordered)}, ` +
+      `but run folder ${runDir} records order_id ${JSON.stringify(recorded)}. Run the ordered ` +
+      'order id and return that run\'s stdout verbatim.',
+    observed: `The dispatcher transcript orders ${JSON.stringify(ordered)}, but status.json in ` +
+      `${runDir} records order_id=${JSON.stringify(recorded)}. Run the ordered order id and ` +
+      `return that run's stdout verbatim.`,
+  };
+}

package/src/{heartbeat.mjs → home/lib/heartbeat.mjs}

@@ -2,7 +2,10 @@
  * The one definition of run progress: a heartbeat file in the run folder, its age, and the
  * stale threshold. On 2026-08-06 run 2026-08-06_204007_build left a live worker waiting on
  * Codex's grandchild; a worker timer alone would have kept that dead run looking alive, so
- * the timer stops at exit.
+ * the timer stops at exit. The file's modification time is the run's best-effort sign of recent
+ * progress. A failed stamp is swallowed so this hint cannot prevent the run's normal verdict and
+ * artifacts. For an old record, a missing file is a legacy state that keeps its lock until its pid
+ * dies.
  */
 import fs from 'node:fs';
 import path from 'node:path';

package/src/{hook-definitions.mjs → home/lib/hook-definitions.mjs}

@@ -5,7 +5,7 @@
  * subagent, and the first host that renames it would leave a registered hook listening for a
  * tool that never fires — silence indistinguishable from approval, which is the exact failure
  * the gate exists to end. `cli/manifest.mjs` builds the settings matcher from SUBAGENT_TOOLS
- * and `src/hooks/order-gate.mjs` recognises the same names, so a matcher can never drift away
+ * and `src/home/hooks/order-gate.mjs` recognises the same names, so a matcher can never drift away
  * from what the hook actually checks.
  */
 
@@ -46,6 +46,14 @@ export const STOP_TOOLS = Object.freeze(['TaskStop']);
 /** A PreToolUse matcher is a regular expression over tool names, so the list remains authoritative. */
 export const STOP_TOOL_MATCHER = STOP_TOOLS.join('|');
 
+/**
+ * The lock listens to file tools and shells through one registration, not two. A second definition
+ * naming the same file lands twice in the installation record, and that record forbids duplicate
+ * files — 33 tests failed on it the day the shell side was added. One hook, one entry, one matcher
+ * wide enough for both.
+ */
+export const LOCKED_TOOL_MATCHER = [...WRITE_TOOLS, ...SHELL_TOOLS].join('|');
+
 /**
  * Stable CLI names live beside each event and file because the Plan_19 drift incident left
  * registration, diagnostics, and the guard itself carrying different hook identities. The
@@ -54,7 +62,8 @@ export const STOP_TOOL_MATCHER = STOP_TOOLS.join('|');
 export const HOOK_DEFINITIONS = Object.freeze([
   Object.freeze({ name: 'reply-guard', event: 'SubagentStop', matcher: '*', file: 'reply-guard.mjs' }),
   Object.freeze({ name: 'order-gate', event: 'PreToolUse', matcher: SUBAGENT_TOOL_MATCHER, file: 'order-gate.mjs' }),
-  Object.freeze({ name: 'worktree-lock', event: 'PreToolUse', matcher: WRITE_TOOL_MATCHER, file: 'worktree-lock.mjs' }),
+  Object.freeze({ name: 'worktree-lock', event: 'PreToolUse', matcher: LOCKED_TOOL_MATCHER, file: 'worktree-lock.mjs' }),
   Object.freeze({ name: 'prune-guard', event: 'PreToolUse', matcher: SHELL_TOOL_MATCHER, file: 'prune-guard.mjs' }),
+  Object.freeze({ name: 'worktree-witness', event: 'PostToolUse', matcher: SHELL_TOOL_MATCHER, file: 'worktree-witness.mjs' }),
   Object.freeze({ name: 'stop-guard', event: 'PreToolUse', matcher: STOP_TOOL_MATCHER, file: 'stop-guard.mjs' }),
 ]);

package/src/home/lib/host-refusal.mjs

@@ -0,0 +1,20 @@
+/** Recognises whether a dispatcher reply contains every required part of a host refusal. */
+
+const ORDER_ID_PATTERNS = [
+  /--order-id(?:=|\s+)[`"']?([a-z0-9][a-z0-9._-]*)/i,
+  /\border[\s_-]*id\s*(?::|=)\s*[`"']?([a-z0-9][a-z0-9._-]*)/i,
+  /\border[\s_-]*id\s+[`"']([^`"']+)[`"']/i,
+];
+
+export function recognizeHostRefusal(reply) {
+  const text = String(reply ?? '');
+  const declaresFailure = /(^|\n)\s*`*FAIL\b/i.test(text);
+  const namesOrderId = ORDER_ID_PATTERNS.some((pattern) => pattern.test(text));
+  const namesInstallRemedy = /\bcodex-bridge\s+install\b/i.test(text);
+  const missing = [
+    ...(!declaresFailure ? ['FAIL declaration'] : []),
+    ...(!namesOrderId ? ['order id'] : []),
+    ...(!namesInstallRemedy ? ['codex-bridge install remedy'] : []),
+  ];
+  return { recognized: missing.length === 0, declaresFailure, namesOrderId, namesInstallRemedy, missing };
+}

package/src/{json-file.mjs → home/lib/json-file.mjs}

@@ -7,7 +7,7 @@
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 
-function parseJson(file, raw) {
+export function parseJsonText(file, raw) {
   const text = raw.charCodeAt(0) === 0xfeff ? raw.slice(1) : raw;
   try {
     return JSON.parse(text);
@@ -17,14 +17,14 @@ function parseJson(file, raw) {
 }
 
 export async function readJsonFile(file) {
-  return parseJson(file, await fsp.readFile(file, 'utf8'));
+  return parseJsonText(file, await fsp.readFile(file, 'utf8'));
 }
 
 export async function readJsonFileWithRaw(file) {
   const raw = await fsp.readFile(file, 'utf8');
-  return { raw, value: parseJson(file, raw) };
+  return { raw, value: parseJsonText(file, raw) };
 }
 
 export function readJsonFileSync(file) {
-  return parseJson(file, fs.readFileSync(file, 'utf8'));
+  return parseJsonText(file, fs.readFileSync(file, 'utf8'));
 }

package/src/{meta → home/lib/meta}/paths.mjs

@@ -10,7 +10,26 @@ import fs from 'node:fs';
 import { readJsonFileSync } from '../json-file.mjs';
 
 /** One line, no newlines, bounded length — a five-line reply must stay five lines. */
-export const line = (value, max = 200) => String(value ?? '').replace(/\s+/g, ' ').trim().slice(0, max);
+export const line = (value, max = 200) => {
+  const text = String(value ?? '').replace(/\s+/g, ' ').trim();
+  if (text.length <= max) return text;
+
+  const ellipsis = '...';
+  if (max <= ellipsis.length) return text.slice(0, Math.max(0, max));
+
+  const contentLimit = max - ellipsis.length;
+  const boundary = text.lastIndexOf(' ', contentLimit);
+  // `All 298 tests pass` once became `All 29`; a reply must omit a whole word, not corrupt it.
+  // Retreating to a space is the whole fix, and it is enough on its own: what survives ends
+  // where a word ended. Dropping a trailing number here as well cost `All 298 12345678 rest`
+  // its 298 — a number that fitted whole — because the digit test compared the limit rather
+  // than the point the text was actually cut at.
+  if (boundary > 0) return `${text.slice(0, boundary)}${ellipsis}`;
+
+  // No space to retreat to: the limit lands inside a single long word. Only here can the cut
+  // land mid-number, so only here is a partial number dropped.
+  return `${text.slice(0, contentLimit).replace(/\d+$/, '')}${ellipsis}`;
+};
 
 export const readText = (file) => {
   try {

package/src/{meta → home/lib/meta}/reply.mjs

@@ -108,7 +108,7 @@ function buildReply(ctx) {
     : paths || 'worktree untouched';
   const retention = retentionReply(ctx.runDir);
   return [
-    `OK — ${line(r.summary, 160)}`,
+    `OK — ${line(r.summary, 300)}`,
     `Files: ${touchedPaths.length} changed · ${files}`,
     // Only when something outside the run wrote to the tree. Subtracting those paths from the
     // verdict without naming them would hide a real edit behind a pattern.

package/src/{meta → home/lib/meta}/verdict.mjs

@@ -356,7 +356,7 @@ export function resolveStatus({ resultOk, exit, agent, result, runDir, events })
       // Hooks on is the known cause of this exact failure, so the reason says so instead
       // of leaving the operator to rediscover it from the log.
       const hooks = readJson(path.join(runDir, 'env.json'))?.hooks
-        ? ' (hooks are enabled in run-config.json — a likely cause)'
+        ? ' (hooks are enabled in config.json — a likely cause)'
         : '';
       return { status: 'FAIL', reason: `${verdict.reason}${hooks}` };
     }

package/src/{no-self-execution.mjs → home/lib/no-self-execution.mjs}

@@ -2,12 +2,17 @@
  * Keeps the dispatcher's first rule identical across all three prompts.
  * On 2026-08-06 codex-build wrote 19 files using the Claude quota, which is why a failed
  * delegation must end in an explicit failure instead of inviting the dispatcher to continue.
+ *
+ * The runner is named here by its command, never by its file. This block used to say "start a run
+ * through run-codex.mjs", and on 2026-08-15 a dispatcher refused by the host did exactly that:
+ * called the file by absolute path, then through PowerShell, then asked its operator to grant a
+ * permission rule on it. The prompt was not merely failing to forbid the detour — it was naming it.
  */
 const NO_SELF_EXECUTION = `## No self-execution
 
-Your only job is to start a run through \`run-codex.mjs\` and report its result; you are not the one who performs the task.
+Your only job is to start a run with the \`codex-bridge run\` command and report its result; you are not the one who performs the task.
 
-- If \`run-codex.mjs\` is missing, does not start, exits without \`RUN=\`/\`ATTACH=\`, or the run fails to begin for any reason, immediately return \`FAIL — could not start the Codex run: <reason>\` and stop.
+- If the command is missing, is refused, does not start, exits without \`RUN=\`/\`ATTACH=\`, or the run fails to begin for any reason, immediately return \`FAIL — could not start the Codex run: <reason>\` and stop. Never reach for the runner file by path, an interpreter, or another shell to get around it.
 - Performing the task yourself when the run could not be started is prohibited: do not read code, write files, or fix tests. Doing it yourself spends the Claude Max quota on exactly what the delegation existed to avoid, and does so silently.
 - Claiming "files were created" without a run that actually happened is prohibited under all circumstances. No run, no result.