@lyupro/codex-bridge 0.6.2 → 0.6.5

package/src/home/hooks/shell-write-intent.mjs

@@ -1,154 +1,320 @@
-/**
- * Reports whether a shell command plainly intends to write files and the target paths it names.
- *
- * This is deliberately not a complete list, and it cannot become one. Enumerating every way a
- * shell can write would reproduce the original defect one level up: the 2026-08-16 incident is
- * why the worktree witness hook exists beside this cheap prevention check.
- */
-
-const COMMANDS = new Set(['cp', 'mv', 'rm', 'touch', 'truncate', 'tee', 'sed']);
-const INTERPRETERS = /\b(?:python(?:\d+(?:\.\d+)?)?|node|perl|ruby)(?:\.exe)?\b/i;
-
-function unquote(value) {
-  const trimmed = value.trim().replace(/[;,]+$/, '');
-  if ((trimmed.startsWith('"') && trimmed.endsWith('"'))
-    || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-    return trimmed.slice(1, -1);
-  }
-  return trimmed;
-}
-
-// A candidate holding a character no file name may contain is not a file name. The redirection
-// pattern cannot tell `>` the operator from `>` the redirect, so `node -e "i>0?'yes':'no'"` was
-// refused on 2026-08-23 naming the path `0?'yes` — a false refusal on a command that writes
-// nothing. Narrowing here costs nothing the witness does not already cover.
-const IMPOSSIBLE_IN_A_NAME = /[?*<>|"]/;
-
-function addPath(paths, value) {
-  const candidate = unquote(value);
-  if (candidate
-    && !['&', '$', '%', '`'].includes(candidate[0])
-    && !IMPOSSIBLE_IN_A_NAME.test(candidate)
-    && !paths.includes(candidate)) paths.push(candidate);
-}
-
-function tokens(segment) {
-  return segment.match(/"(?:\\.|[^"])*"|'[^']*'|[^\s]+/g) ?? [];
-}
-
-// A `>` inside a quoted argument is text, not a redirect. The 2026-08-28 worktree-lock refusal
-// named `#'` from `sed -E 's#(A ).*#\1<redacted>#'` because this scan previously read raw text.
-function quotedCharacters(command) {
-  const quoted = new Uint8Array(command.length);
-  let quote = null;
-  for (let index = 0; index < command.length; index += 1) {
-    const character = command[index];
-    if (quote === "'") {
-      if (character === "'") quote = null;
-      else quoted[index] = 1;
-    } else if (quote === '"') {
-      if (character === '\\' && index + 1 < command.length) {
-        quoted[index] = 1;
-        quoted[index + 1] = 1;
-        index += 1;
-      } else if (character === '"') quote = null;
-      else quoted[index] = 1;
-    } else if (character === '\\' && index + 1 < command.length) {
-      index += 1;
-    } else if (character === "'" || character === '"') {
-      quote = character;
-      quoted[index] = 1;
-    }
-  }
-  return quote ? null : quoted;
-}
-
-function positional(args) {
-  return args.filter((arg) => !arg.startsWith('-'));
-}
-
-/**
- * Strip the directory and the Windows executable suffix before matching the command name.
- * `INTERPRETERS` has always allowed `python.exe`; the command list did not, so `sed.exe -i` —
- * the spelling Git Bash and PowerShell hand over on this platform — walked past the guard while
- * the identical `sed -i` was refused (found accepting the 2026-08-17 smoke run, which had recorded
- * that gap as intended behaviour).
- */
-function commandName(token) {
-  return token.replace(/^.*[\\/]/, '').replace(/\.exe$/i, '').toLowerCase();
-}
-
-/**
- * Split a heredoc command into the shell around it and the document inside it.
- *
- * `shell` is everything the shell itself runs — the line opening the document AND every command
- * after its closing marker. Dropping that tail hid `… <<EOF … EOF; echo x >> README.md` from the
- * guard completely, and a live probe on 2026-08-23 wrote to a tracked file during a held run
- * exactly that way. `paths` holds only what the document body names, which the caller uses just
- * when the interpreter is itself the writer.
- */
-function heredoc(command) {
-  const header = command.match(/^(.*?<<-?\s*(['"]?)([A-Za-z_][\w-]*)\2[^\r\n]*)[\r\n]/s);
-  if (!header) return null;
-  const paths = [];
-  const marker = header[3];
-  const body = command.slice(header[0].length).split(/\r?\n/);
-  const end = body.findIndex((line) => line.trim() === marker);
-  const shell = [header[1], ...(end < 0 ? [] : body.slice(end + 1))].join('\n');
-  if (!INTERPRETERS.test(header[1])) return { shell, paths, writes: false };
-  const source = body.slice(0, end < 0 ? body.length : end).join('\n');
-  for (const match of source.matchAll(/(['"])(.*?)\1/g)) {
-    const value = match[2];
-    if (/^(?:[A-Za-z]:[\\/]|[\\/]|\.\.?[\\/])/.test(value)
-      || /[\\/]/.test(value)
-      || /(?:^|[\\/])[^\\/]+\.[A-Za-z0-9_-]+$/.test(value)) addPath(paths, value);
-  }
-  return { shell, paths, writes: true };
-}
-
-/** Returns `{ writes, paths }` for the deliberately obvious write forms this guard recognises. */
-export function shellWriteIntent(command) {
-  if (typeof command !== 'string' || !command.trim()) return { writes: false, paths: [] };
-  const paths = [];
-  const document = heredoc(command);
-  // The document body is prose until an interpreter makes it code. Reading `header` here while
-  // heredoc() returned `shell` meant the whole command, body included, went through shell parsing
-  // whenever the writer was plain `cat`: on 2026-09-06 the lock refused four harmless commands,
-  // the last of them because a sentence in a task file said "Do not touch the installer" and
-  // `touch` is in COMMANDS, so every following word became a write target under the repository.
-  const shell = document?.shell ?? command;
-  let writes = document?.writes ?? false;
-  const quoted = quotedCharacters(shell);
-
-  for (const match of shell.matchAll(/(?<![<>=])(?:\d*)>>?(?![=>&])\s*("(?:\\.|[^"])*"|'[^']*'|[^\s;|&]+)/g)) {
-    if (quoted && quoted[match.index]) continue;
-    writes = true;
-    addPath(paths, match[1]);
-  }
-
-  // A real output redirect identifies the writer's destination. Body text is only evidence when
-  // the interpreter itself is the writer, as in the 2026-08-16 python heredoc incident.
-  if (!paths.length && document?.writes) {
-    for (const candidate of document.paths) addPath(paths, candidate);
-  }
-
-  for (const segment of shell.split(/(?:&&|\|\||[;|\r\n])/)) {
-    const parts = tokens(segment);
-    const index = parts.findIndex((part) => COMMANDS.has(commandName(part)));
-    if (index < 0) continue;
-    const name = commandName(parts[index]);
-    const args = parts.slice(index + 1);
-    if (name === 'sed' && !args.some((arg) => /^-.*i/.test(arg))) continue;
-    writes = true;
-    const values = positional(args);
-    if (name === 'cp' || name === 'mv') {
-      if (values.length > 1) addPath(paths, values.at(-1));
-    } else if (name === 'sed') {
-      for (const value of values.slice(1)) addPath(paths, value);
-    } else {
-      for (const value of values) addPath(paths, value);
-    }
-  }
-
-  return { writes, paths };
-}
+/**
+ * Reports whether a shell command plainly intends to write files and the target paths it names.
+ *
+ * This is deliberately not a complete list, and it cannot become one. Enumerating every way a
+ * shell can write would reproduce the original defect one level up: the 2026-08-16 incident is
+ * why the worktree witness hook exists beside this cheap prevention check.
+ */
+
+const COMMANDS = new Set(['cp', 'mv', 'rm', 'touch', 'truncate', 'tee', 'sed']);
+const INTERPRETERS = /\b(?:python(?:\d+(?:\.\d+)?)?|node|perl|ruby)(?:\.exe)?\b/i;
+
+function unquote(value) {
+  const trimmed = value.trim().replace(/[;,]+$/, '');
+  if ((trimmed.startsWith('"') && trimmed.endsWith('"'))
+    || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+
+// A candidate holding a character no file name may contain is not a file name. The redirection
+// pattern cannot tell `>` the operator from `>` the redirect, so `node -e "i>0?'yes':'no'"` was
+// refused on 2026-08-23 naming the path `0?'yes` — a false refusal on a command that writes
+// nothing. Narrowing here costs nothing the witness does not already cover.
+const IMPOSSIBLE_IN_A_NAME = /[?*<>|"]/;
+
+function addPath(paths, candidate) {
+  // D4c: word values are already unquoted; raw redirects keep their separate unquote() call.
+  if (candidate
+    && !['&', '$', '%', '`'].includes(candidate[0])
+    && !IMPOSSIBLE_IN_A_NAME.test(candidate)
+    && !paths.includes(candidate)) paths.push(candidate);
+}
+
+// One quote reader owns redirects, command boundaries and words: the 2026-09-16 awk refusal
+// repeated the 2026-08-23 node, 2026-08-28 sed and 2026-09-06 heredoc text-as-shell incidents.
+function lexShell(command) {
+  const literal = new Uint8Array(command.length);
+  const state = () => ({ commands: [], words: [], word: '', started: false, escaped: false, previousLiteral: false });
+  let parsed = state();
+  const plain = state();
+  const stack = [];
+  let quote = null;
+  let doubleEscape = false;
+  let comment = false;
+
+  function finish(current, endCommand) {
+    if (current.word || (current !== plain && current.started)) {
+      current.words.push(current.word);
+      current.word = '';
+      current.started = false;
+    }
+    if (endCommand && current.words.length) {
+      current.commands.push(current.words);
+      current.words = [];
+    }
+  }
+
+  function append(current, index, isLiteral) {
+    const character = command[index];
+    if (current.escaped) {
+      current.escaped = false;
+      isLiteral = true;
+    } else if (!isLiteral && character === '\\'
+      && (/[;|&<>() \t'"\\]/.test(command[index + 1] ?? '')
+        || (current !== plain && /[#$]/.test(command[index + 1] ?? '')))) {
+      // Windows paths use backslashes too: Git Bash escapes shell metacharacters here,
+      // but consuming every backslash would corrupt C:\tools\sed.exe and its targets.
+      current.escaped = true;
+      current.previousLiteral = true;
+      current.started = true;
+      return true;
+    }
+    const pipeAmpersand = character === '&' && !current.previousLiteral && command[index - 1] === '|';
+    const operatorAmpersand = character === '&'
+      && ((!current.previousLiteral && /[<>|]/.test(command[index - 1] ?? ''))
+        || command[index + 1] === '>');
+    current.previousLiteral = isLiteral;
+    if (!isLiteral && pipeAmpersand) return false;
+    if (!isLiteral && (';|()\r\n'.includes(character)
+      || (character === '&' && !operatorAmpersand))) finish(current, true);
+    else if (!isLiteral && /\s/.test(character)) finish(current, false);
+    else {
+      current.word += character;
+      current.started = true;
+    }
+    return isLiteral;
+  }
+
+  for (let index = 0; index < command.length; index += 1) {
+    const character = command[index];
+    // Keep the original quote-blind fallback for malformed input (D4c review).
+    append(plain, index, false);
+    if (comment) {
+      if (!'\r\n'.includes(character)) {
+        literal[index] = 1;
+        continue;
+      }
+      comment = false;
+    }
+    let isLiteral = quote !== null || parsed.escaped || doubleEscape;
+    let quoteBoundary = false;
+    if (doubleEscape) doubleEscape = false;
+    else if (!parsed.escaped) {
+      if (quote === '"' && character === '\\' && index + 1 < command.length) {
+        doubleEscape = true;
+      } else if (quote) {
+        if (character === quote) {
+          quote = null;
+          quoteBoundary = true;
+        }
+      } else if (character === "'" || character === '"') {
+        quote = character;
+        isLiteral = true;
+        quoteBoundary = true;
+      }
+    }
+    // D4c: quote fragments belong to one word; their delimiters are not its value.
+    if (quoteBoundary) {
+      parsed.started = true;
+      parsed.previousLiteral = true;
+      literal[index] = 1;
+      continue;
+    }
+    if (!isLiteral && character === '#' && !parsed.started) {
+      comment = true;
+      literal[index] = 1;
+      continue;
+    }
+    if (!isLiteral && character === '(') {
+      const substitution = command[index - 1] === '$' && !parsed.previousLiteral;
+      if (!parsed.started || substitution) {
+        // D4c: suspend the outer command, retaining an unresolved $() in its word.
+        // Flattening parentheses made a substitution suffix look like a new command.
+        if (substitution) parsed.word += '()';
+        stack.push(parsed);
+        parsed = { ...state(), commands: parsed.commands };
+        continue;
+      }
+      isLiteral = true;
+    }
+    if (!isLiteral && character === ')') {
+      if (stack.length) {
+        finish(parsed, true);
+        parsed = stack.pop();
+        parsed.previousLiteral = false;
+        continue;
+      }
+      isLiteral = true;
+    }
+    literal[index] = append(parsed, index, isLiteral);
+  }
+  finish(parsed, true);
+  while (stack.length) {
+    parsed = stack.pop();
+    finish(parsed, true);
+  }
+  finish(plain, true);
+  return { literal: quote ? null : literal, commands: quote ? plain.commands : parsed.commands };
+}
+
+function positional(args) {
+  return args.filter((arg) => !arg.startsWith('-'));
+}
+
+/**
+ * Strip the directory and the Windows executable suffix before matching the command name.
+ * `INTERPRETERS` has always allowed `python.exe`; the command list did not, so `sed.exe -i` —
+ * the spelling Git Bash and PowerShell hand over on this platform — walked past the guard while
+ * the identical `sed -i` was refused (found accepting the 2026-08-17 smoke run, which had recorded
+ * that gap as intended behaviour).
+ */
+function commandName(token) {
+  return token.replace(/^.*[\\/]/, '').replace(/\.exe$/i, '').toLowerCase();
+}
+
+const COMMAND_PREFIXES = new Set(['if', 'then', 'else', 'elif', 'while', 'until', 'do', '!', '{', 'time']);
+const LAUNCHERS = new Set(['xargs', 'env', 'nohup', 'timeout', 'nice', 'command', 'exec', 'sudo']);
+
+// Plan_57 D11: `git log --grep rm` and `grep -rn touch` were refused because arguments became
+// commands. These launchers only move command position; unknown launchers leave a lock gap
+// covered after execution by worktree-witness.mjs, without falsely refusing a read.
+function* writingCommands(parts) {
+  // D4c review: 6000 nested find actions overflowed recursive yield*. Index ranges and
+  // precomputed terminators keep traversal iterative without repeatedly copying/scanning tails.
+  const terminators = new Array(parts.length);
+  let next = parts.length;
+  for (let index = parts.length - 1; index >= 0; index -= 1) {
+    if ([';', '+'].includes(parts[index])) next = index;
+    terminators[index] = next;
+  }
+  const pending = [{ start: 0, end: parts.length }];
+  while (pending.length) {
+    const { start, end } = pending.pop();
+    let launched = false;
+    for (let index = start; index < end; index += 1) {
+      const part = parts[index];
+      if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(part) || COMMAND_PREFIXES.has(part)) continue;
+      // A case pattern (`a)`, `*)`) precedes a command position the way `then` does. The lexer keeps
+      // an unmatched `)` literal because `echo ) rm x` runs nothing, which alone hid
+      // `case x in a) rm b.txt;; esac` — a write the scanner caught before D4c.
+      if (part === 'case') {
+        while (index + 1 < end && !parts[index].endsWith(')')) index += 1;
+        continue;
+      }
+      if (part.endsWith(')')) continue;
+      if (/^(?:\d*[<>]|&>)/.test(part)) {
+        if (/^(?:\d*[<>]+&?|&>>?)$/.test(part)) index += 1;
+        continue;
+      }
+      if (launched && (part.startsWith('-') || /^\d+[smhd]?$/.test(part))) {
+        if (launched === 'command' && /^-[^-]*[vV]/.test(part)) break;
+        continue;
+      }
+      const name = commandName(part);
+      if (LAUNCHERS.has(name)) {
+        launched = name;
+        continue;
+      }
+      if (COMMANDS.has(name)) yield parts.slice(index, end);
+      else if (name === 'find') {
+        const actions = [];
+        for (index += 1; index < end; index += 1) {
+          if (!['-exec', '-execdir', '-ok', '-okdir'].includes(parts[index])) continue;
+          const actionStart = index + 1;
+          index = Math.min(terminators[actionStart] ?? end, end);
+          // D11: terminators and later predicates are not action arguments.
+          actions.push({ start: actionStart, end: index });
+        }
+        for (let action = actions.length - 1; action >= 0; action -= 1) pending.push(actions[action]);
+      }
+      break;
+    }
+  }
+}
+
+/**
+ * Split a heredoc command into the shell around it and the document inside it.
+ *
+ * `shell` is everything the shell itself runs — the line opening the document AND every command
+ * after its closing marker. Dropping that tail hid `… <<EOF … EOF; echo x >> README.md` from the
+ * guard completely, and a live probe on 2026-08-23 wrote to a tracked file during a held run
+ * exactly that way. `paths` holds only what the document body names, which the caller uses just
+ * when the interpreter is itself the writer.
+ */
+function heredoc(command) {
+  const header = command.match(/^(.*?<<-?\s*(['"]?)([A-Za-z_][\w-]*)\2[^\r\n]*)[\r\n]/s);
+  if (!header) return null;
+  const paths = [];
+  const marker = header[3];
+  const body = command.slice(header[0].length).split(/\r?\n/);
+  const end = body.findIndex((line) => line.trim() === marker);
+  const shell = [header[1], ...(end < 0 ? [] : body.slice(end + 1))].join('\n');
+  if (!INTERPRETERS.test(header[1])) return { shell, paths, writes: false };
+  const source = body.slice(0, end < 0 ? body.length : end).join('\n');
+  for (const match of source.matchAll(/(['"])(.*?)\1/g)) {
+    const value = match[2];
+    if (/^(?:[A-Za-z]:[\\/]|[\\/]|\.\.?[\\/])/.test(value)
+      || /[\\/]/.test(value)
+      || /(?:^|[\\/])[^\\/]+\.[A-Za-z0-9_-]+$/.test(value)) addPath(paths, unquote(value));
+  }
+  return { shell, paths, writes: true };
+}
+
+/** Returns `{ writes, paths }` for the deliberately obvious write forms this guard recognises. */
+export function shellWriteIntent(command) {
+  if (typeof command !== 'string' || !command.trim()) return { writes: false, paths: [] };
+  const paths = [];
+  const document = heredoc(command);
+  // The document body is prose until an interpreter makes it code. Reading `header` here while
+  // heredoc() returned `shell` meant the whole command, body included, went through shell parsing
+  // whenever the writer was plain `cat`: on 2026-09-06 the lock refused four harmless commands,
+  // the last of them because a sentence in a task file said "Do not touch the installer" and
+  // `touch` is in COMMANDS, so every following word became a write target under the repository.
+  const shell = document?.shell ?? command;
+  let writes = document?.writes ?? false;
+  const { literal, commands } = lexShell(shell);
+
+  const redirects = /(?<![<=])(?:\d*)>>?(?![=>&])\s*("(?:\\.|[^"])*"|'[^']*'|[^\s;|&]+)/g;
+  let match;
+  while ((match = redirects.exec(shell))) {
+    if (literal?.[match.index]
+      || (shell[match.index - 1] === '>' && !literal?.[match.index - 1])) {
+      // D4c: a literal > must not consume the real redirect immediately after it.
+      redirects.lastIndex = match.index + 1;
+      continue;
+    }
+    writes = true;
+    addPath(paths, unquote(match[1]));
+  }
+
+  // A real output redirect identifies the writer's destination. Body text is only evidence when
+  // the interpreter itself is the writer, as in the 2026-08-16 python heredoc incident.
+  if (!paths.length && document?.writes) {
+    for (const candidate of document.paths) addPath(paths, unquote(candidate));
+  }
+
+  for (const parts of commands) {
+    // D11 keeps the pre-position fallback: an unfinished quote makes word positions untrusted.
+    const candidates = literal ? writingCommands(parts) : [parts];
+    for (const candidate of candidates) {
+      const index = literal ? 0 : candidate.findIndex((part) => COMMANDS.has(commandName(part)));
+      if (index < 0) continue;
+      const name = commandName(candidate[index]);
+      const args = candidate.slice(index + 1);
+      if (name === 'sed' && !args.some((arg) => /^-.*i/.test(arg))) continue;
+      writes = true;
+      const values = positional(args).map((value) => literal ? value : unquote(value));
+      if (name === 'cp' || name === 'mv') {
+        if (values.length > 1) addPath(paths, values.at(-1));
+      } else if (name === 'sed') {
+        for (const value of values.slice(1)) addPath(paths, value);
+      } else {
+        for (const value of values) addPath(paths, value);
+      }
+    }
+  }
+
+  return { writes, paths };
+}

package/src/home/hooks/worktree-lock.mjs

@@ -39,8 +39,15 @@ if (WRITE_TOOL_NAMES.has(input.tool_name)) {
   const rawPath = toolInput[pathField];
   if (typeof rawPath !== 'string' || !rawPath.trim()) pass();
   rawPaths = [rawPath];
-} else {
-  const intent = shellWriteIntent(toolInput.command);
+} else {
+  let intent;
+  try {
+    intent = shellWriteIntent(toolInput.command);
+  } catch {
+    // D4c review (2026-09-17_131740_plan-57-d4-review): deep find actions overflowed
+    // the scanner. Unrecognised input must fail open; the witness checks writes afterwards.
+    pass();
+  }
   if (!intent.writes || !intent.paths.length) pass();
   rawPaths = intent.paths;
 }

package/src/home/hooks/worktree-witness.mjs

@@ -7,13 +7,17 @@
  * split-guard run and made an honest build appear out of scope. This hook compares the live
  * run's recorded git state with the repository after every shell tool and directs the
  * orchestrator to undo any change outside the run's declared scope.
+ * The 2026-09-19 run accused itself of editing its own artifacts: the witness must use
+ * the verdict's snapshot and environment split, not a second definition of changed work.
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
 import { SHELL_TOOLS } from '../lib/hook-definitions.mjs';
 import { parseJsonText } from '../lib/json-file.mjs';
-import { globToRegExp } from '../lib/meta/paths.mjs';
+import { splitRunChanges } from '../lib/meta/environment.mjs';
+import { changedPaths } from '../lib/meta/paths.mjs';
+import { outOfScope } from '../lib/meta/verdict.mjs';
+import { git, worktreeSnapshot } from '../lib/runner/git-state.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
 import { allLiveRuns, normalizePath } from './live-runs.mjs';
 
@@ -28,19 +32,6 @@ function readRequired(file) {
   }
 }
 
-function statusMap(text) {
-  if (typeof text !== 'string') return null;
-  const result = new Map();
-  for (const line of text.split(/\r?\n/).filter(Boolean)) {
-    if (!/^.. /.test(line)) return null;
-    const rawPath = line.slice(3);
-    const file = rawPath.includes(' -> ') ? rawPath.slice(rawPath.lastIndexOf(' -> ') + 4) : rawPath;
-    if (!file.trim()) return null;
-    result.set(file, line.slice(0, 2));
-  }
-  return result;
-}
-
 let input;
 try {
   input = parseJsonText('stdin', fs.readFileSync(0, 'utf8'));
@@ -67,37 +58,26 @@ const owner = liveRuns.find(({ status }) => {
 if (!owner) pass();
 
 const { dir, status } = owner;
-const beforeText = readRequired(path.join(dir, 'git-before.txt'));
+const beforeText = readRequired(path.join(dir, 'state-before.txt'));
 const scopeText = readRequired(path.join(dir, 'scope.txt'));
 if (beforeText === null || scopeText === null) pass();
 
-const before = statusMap(beforeText);
-let allowed;
+let outside;
 try {
+  // changedPaths tolerates malformed rows; a hook must instead fail open on a damaged baseline.
+  if (beforeText.split(/\r?\n/).filter(Boolean).some((row) =>
+    !/^(?:\d+\t\d+|-\t-|U\t\d+)\t\S.*$/.test(row))) pass();
   const patterns = scopeText.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   if (!patterns.length) pass();
-  allowed = patterns.map(globToRegExp);
+  // The shared snapshot returns empty output on git errors; do not call that a restored tree.
+  const repository = git(status.repo, ['rev-parse', '--is-inside-work-tree']);
+  if (repository.error || repository.status !== 0 || repository.stdout?.trim() !== 'true') pass();
+  const current = worktreeSnapshot(status.repo);
+  const { work } = splitRunChanges(dir, changedPaths(beforeText, current));
+  outside = outOfScope(work, patterns);
 } catch {
   pass();
 }
-if (!before) pass();
-
-let currentResult;
-try {
-  currentResult = spawnSync('git', ['-C', status.repo, 'status', '--porcelain'], {
-    encoding: 'utf8',
-  });
-} catch {
-  pass();
-}
-if (currentResult.error || currentResult.status !== 0 || typeof currentResult.stdout !== 'string') pass();
-const current = statusMap(currentResult.stdout);
-if (!current) pass();
-
-const changed = [];
-for (const [file, state] of current) if (before.get(file) !== state) changed.push(file);
-for (const file of before.keys()) if (!current.has(file)) changed.push(file);
-const outside = [...new Set(changed)].filter((file) => !allowed.some((pattern) => pattern.test(file)));
 if (!outside.length) pass();
 
 const folder = path.basename(dir);
@@ -105,9 +85,10 @@ const paths = outside.join(', ');
 process.stdout.write(JSON.stringify({
   hookSpecificOutput: {
     hookEventName: 'PostToolUse',
-    additionalContext: `WORKTREE WITNESS — act now: the shell changed paths outside the scope of `
-      + `live run folder ${dir} (agent ${status.agent}, slug ${status.slug}): ${paths}. `
-      + `Revert those paths now, or run codex-bridge stop ${folder} to take the repository back `
+    additionalContext: `WORKTREE WITNESS — the run's own folder, environment paths and gitignored `
+      + `files are already excluded. These are the orchestrator's own edits inside the repository `
+      + `of live run folder ${dir} (agent ${status.agent}, slug ${status.slug}), outside its scope: ${paths}. `
+      + `Act now: revert those paths, or run codex-bridge stop ${folder} to take the repository back `
       + `before making further changes.`,
   },
 }));

package/src/home/lib/agents.mjs

@@ -1,5 +1,6 @@
 /**
  * Defines each delegated agent's role, wall-clock budget, write access and result file.
+ * D2: a budget declares positive minutes or named phases; budgets.mjs alone normalizes it.
  *
  * The three agents were listed four times: twice in run-config.mjs for budgets and models,
  * once in codex-args.mjs for role lookup, and once in order-gate.mjs for guarded names.
@@ -10,6 +11,8 @@ export const AGENTS = {
   'codex-scout': { role: 'scout', budget: 15, writes: false, result: 'result.json' },
   'codex-build': { role: 'build', budget: 25, writes: true, result: 'result.json' },
   'codex-review': { role: 'review', budget: 20, writes: false, result: 'review.json' },
+  // Plan_59: design advice needs a bounded scope pass before the continued decision pass.
+  'codex-advisor': { role: 'advisor', budget: { scope: 5, advise: 15 }, writes: false, result: 'result.json' },
 };
 
 export const agentRole = (agent) => AGENTS[agent]?.role;