@lyupro/codex-bridge 0.6.5 → 0.6.7

package/cli/settings-merge.mjs

@@ -57,44 +57,45 @@ export function commandReachable(name = 'codex-bridge', env = process.env) {
  * could decide anything, and the host refused Bash, PowerShell, file edits and agent launches.
  */
 export function reachableCommandVersion(name = 'codex-bridge', env = process.env) {
+  const result = runReachableCommand(name, ['--version'], env);
+  if (!result || result.status !== 0) return null;
+  return String(result.stdout || '').trim().split(/\r?\n/).pop()?.trim() || null;
+}
+
+export function runReachableCommand(name, args, env = process.env) {
   const shimPath = resolveCommand(name, env);
   if (!shimPath) return null;
   // Node 24 warned with DEP0190 during update (2026-09-07): invoke cmd explicitly for npm shims.
   // Live probes covered plain, bin with space, Program Files (x86), weird & name, and caret^dir.
-  // /d /s /c with path and --version as separate arguments only passed the plain directory:
+  // /d /s /c with path and fixed arguments as separate arguments only passed the plain directory:
   // Node adds quotes, then cmd's /s strips the first and last quote of the whole command line.
   // /d /c without /s failed on & and ^. This single, double-wrapped verbatim command passed all
   // five. Keep native path separators: forward-slash Windows paths do not work through cmd.
   // The interpreter is a property of the machine, not of the PATH handed in: resolving cmd.exe
-  // through the caller's PATH would return null on any env whose PATH omits System32, and a null
-  // version is exactly the silent failure this function exists to prevent.
+  // through the caller's PATH would return null on any env whose PATH omits System32, hiding the
+  // exact command outcome this probe exists to report.
   const shell = envValue(env, 'comspec') || process.env.ComSpec || 'cmd.exe';
+  const fixedArgs = args.map((argument) => ` ${argument}`).join('');
   const result = process.platform === 'win32'
-    ? spawnSync(shell, ['/d', '/s', '/c', `""${shimPath}" --version"`], {
-      encoding: 'utf8', env, shell: false, windowsVerbatimArguments: true,
+    ? spawnSync(shell, ['/d', '/s', '/c', `""${shimPath}"${fixedArgs}"`], {
+      encoding: 'utf8', env, shell: false, windowsVerbatimArguments: true, windowsHide: true,
+      timeout: 10000, maxBuffer: 64 * 1024,
     })
-    : spawnSync(shimPath, ['--version'], { encoding: 'utf8', env, shell: false });
-  if (result.error || result.status !== 0) return null;
-  return String(result.stdout || '').trim().split(/\r?\n/).pop()?.trim() || null;
+    : spawnSync(shimPath, args, {
+      encoding: 'utf8', env, shell: false, windowsHide: true, timeout: 10000, maxBuffer: 64 * 1024,
+    });
+  return { path: shimPath, status: result.status, stdout: String(result.stdout || '') };
 }
 
-export function hookRegistration(name, target, env = process.env, packageVersion = null) {
-  // Requiring the versions to match is stricter than asking whether `hook` exists, deliberately:
-  // a command of another version would run code this install has never seen, which is the hazard
-  // README describes when a global install and a clone coexist. Anything short of a match falls
-  // back to the copy this install placed itself.
-  const reachable = reachableCommandVersion('codex-bridge', env);
-  if (reachable && packageVersion && reachable === packageVersion) {
+export function hookRegistration(name, target, probe) {
+  if (probe.ok) {
     return {
       command: shortCommandFor(name),
       form: 'short',
-      reason: `codex-bridge ${reachable} on PATH matches this package; the global command will execute`,
+      reason: `codex-bridge on PATH launches guards from this home (${probe.homeRoot})`,
     };
   }
-  const reason = reachable
-    ? `codex-bridge on PATH reports ${reachable}, not ${packageVersion}; the installed copy will execute`
-    : 'codex-bridge is not reachable from PATH; the installed copy will execute';
-  return { command: commandFor(target), form: 'path', reason };
+  return { command: commandFor(target), form: 'path', reason: `${probe.reason}; the installed copy will execute` };
 }
 
 export function commandForm(command) {
@@ -163,7 +164,9 @@ const hasOwnCommand = (group, commands) => {
  * deleted file. Conversely, the 2026-08-17 host proved that finding alone is insufficient: its
  * worktree lock stayed under the pre-shell matcher, so Bash never reached the guard. The command
  * is this package's own absolute path, so it identifies our entry wherever the group ended up,
- * and merge can move it without creating a duplicate.
+ * and merge can move it without creating a duplicate. Alternate commands identify our entry, but
+ * do not prove it is in the launcher form selected for this operation. Update must rewrite stale
+ * forms, or unsafe registrations already in settings.json would survive every future update.
  */
 export async function inspectHook(settingsPath, specOrPath) {
   const state = await readSettings(settingsPath);
@@ -172,11 +175,15 @@ export async function inspectHook(settingsPath, specOrPath) {
   let matchedCommand;
   let matchedMatcher;
   let requiresMove = false;
+  let requiresRewrite = false;
+  let duplicates = 0;
   for (const group of groups(state.settings, spec.event)) {
     for (const hook of groupHooks(group)) {
       if (hook?.type !== 'command' || !commands.includes(hook.command)) continue;
       matchedCommand ??= hook.command;
       matchedMatcher ??= group?.matcher;
+      duplicates += 1;
+      if (hook.command !== spec.command) requiresRewrite = true;
       if (group?.matcher !== spec.matcher) requiresMove = true;
     }
   }
@@ -187,6 +194,9 @@ export async function inspectHook(settingsPath, specOrPath) {
     matchedCommand,
     matchedMatcher,
     requiresMove,
+    requiresRewrite,
+    duplicates: duplicates > 1,
+    current: Boolean(matchedCommand) && !requiresMove && !requiresRewrite && duplicates === 1,
   };
 }
 
@@ -258,15 +268,17 @@ export async function mergeHook(settingsPath, specOrPath, inspected) {
   return withMutationRun(settingsPath, async () => {
     const spec = normalizeSpec(specOrPath);
     const state = inspected || await inspectHook(settingsPath, spec);
-    if (state.present && !state.requiresMove) return { changed: false, createdGroup: false };
+    if (state.current) return { changed: false, createdGroup: false };
     const settings = structuredClone(state.settings);
     settings.hooks ??= {};
     if (!Array.isArray(settings.hooks[spec.event])) settings.hooks[spec.event] = [];
     if (state.present) {
       const eventGroups = settings.hooks[spec.event];
       const commands = [spec.command, ...spec.alternateCommands];
+      // The entry in the declared group wins, so a field the operator added there (a timeout)
+      // survives the rewrite; groups are walked from the end, which would otherwise pick a stale copy.
       let hookToMove;
-      let keptDeclaredHook = false;
+      let declaredHook;
       for (let index = eventGroups.length - 1; index >= 0; index -= 1) {
         const group = eventGroups[index];
         if (!Array.isArray(group?.hooks)) continue;
@@ -274,26 +286,21 @@ export async function mergeHook(settingsPath, specOrPath, inspected) {
         group.hooks = group.hooks.filter((hook) => {
           if (hook?.type !== 'command' || !commands.includes(hook.command)) return true;
           hookToMove ??= hook;
-          if (group.matcher === spec.matcher && !keptDeclaredHook) {
-            keptDeclaredHook = true;
-            return true;
-          }
+          if (group.matcher === spec.matcher) declaredHook ??= hook;
           return false;
         });
         if (hadOwnHook && group.hooks.length === 0) eventGroups.splice(index, 1);
       }
       let group = eventGroups.find((entry) => entry?.matcher === spec.matcher);
       const createdGroup = !group;
-      if (!keptDeclaredHook) {
-        if (!group) {
-          group = { matcher: spec.matcher, hooks: [] };
-          eventGroups.push(group);
-        }
-        if (!Array.isArray(group.hooks)) group.hooks = [];
-        group.hooks.push(hookToMove);
+      if (!group) {
+        group = { matcher: spec.matcher, hooks: [] };
+        eventGroups.push(group);
       }
+      if (!Array.isArray(group.hooks)) group.hooks = [];
+      group.hooks.push({ ...(declaredHook || hookToMove), command: spec.command });
       await atomicWrite(settingsPath, settings, state);
-      return { changed: true, createdGroup, moved: true };
+      return { changed: true, createdGroup, ...(state.requiresMove ? { moved: true } : {}), ...(state.requiresRewrite ? { rewritten: true } : {}) };
     }
     let group = settings.hooks[spec.event].find((entry) => entry?.matcher === spec.matcher);
     const createdGroup = !group;

package/cli/uninstall.mjs

@@ -10,6 +10,8 @@ import {
   recordTarget,
 } from './manifest.mjs';
 import { removePermissionRules } from './permissions.mjs';
+import { hostContractPath } from './host-contract.mjs';
+import { brandStateDir } from '../src/home/lib/brand-home.mjs';
 import {
   commandFor,
   removeHook,
@@ -33,6 +35,17 @@ function permissionOutput(host, removed, dryRun) {
   return `${verb} ${removed} permission rule ${plural} from ${host.settingsPath}.`;
 }
 
+// Plan_62 D22: uninstall removes only recorded files, and the message used to name only runs and
+// config.json — state/, the host measurement and conventions.md stayed behind unmentioned. Until
+// Plan_65 derives this from a registry, the sentence names every kind the package writes while working.
+function preservationText(host) {
+  return `Run artifacts in ${path.join(host.root, 'codex-runs')} are preserved, and so is what the package `
+    + `wrote into ${host.brandRoot} while working: the run configuration ${host.brandConfigPath}, the conventions `
+    + `${host.brandConventionsPath}, the host measurement ${hostContractPath(host)} and runtime state in `
+    + `${brandStateDir(host.brandRoot)} (dispatcher state, guard counters, the handback witness, dispatcher `
+    + 'contract verdicts, and hook diagnostics that hold the full hook input). Delete them by hand for a complete removal.';
+}
+
 function displayFile(file) {
   return `${file.root}/${file.path}`;
 }
@@ -62,8 +75,7 @@ async function uninstallInRun({ host, dryRun = false } = {}) {
   const permissionResult = await removePermissionRules(host.settingsPath, { dryRun });
   const permissionLine = permissionOutput(host, permissionResult.removed, dryRun);
   const record = await readInstallRecord(host);
-  const preservation = `Run artifacts in ${path.join(host.root, 'codex-runs')} and the run `
-    + `configuration in ${host.brandConfigPath} are preserved.`;
+  const preservation = preservationText(host);
   if (!record) {
     return { exitCode: 1, output: `${permissionLine}\ncodex-bridge is not installed.\n${preservation}` };
   }
@@ -92,7 +104,7 @@ async function uninstallInRun({ host, dryRun = false } = {}) {
     }
     for (const hook of record.hooks) {
       const definition = definitionForRecordedHook(hook);
-      lines.push(`Would remove the ${hook.event} hook for matcher ${definition.matcher}.`);
+      lines.push(`Would remove the ${hook.event} hook ${definition.name} for matcher ${definition.matcher}.`);
     }
     lines.push('Would remove the installation record from the brand root.');
     lines.push(preservation);

package/cli/update.mjs

@@ -17,11 +17,10 @@ import {
   rulesPlan,
 } from './manifest.mjs';
 import { targetMatches } from './copy.mjs';
-import { hookTargets } from './hook-targets.mjs';
+import { hookTargets, recordHasHooks } from './hook-targets.mjs';
 import { definitionForRecordedHook, fileEntry, fingerprintFor } from './install-record.mjs';
 import {
   commandFor,
-  hookRegistration,
   inspectHook,
   removeHook,
   withSettingsRun,
@@ -29,6 +28,12 @@ import {
 import { addRulesOwner, readRulesRegistry } from './rules-owners.mjs';
 import { claudeBoundary, removeEmptyLayout, removeEmptyParents } from './remove-layout.mjs';
 
+const LEGACY_GUARD_LOG_FILES = [
+  'codex-reply-guard.blocked.json',
+  'codex-order-gate.last.json',
+  'codex-reply-guard.last.json',
+];
+
 async function exists(target) {
   try {
     return (await fs.stat(target)).isFile();
@@ -45,6 +50,18 @@ async function retireLegacyLayout(host) {
   await removeEmptyLayout(host.legacyCommandsDir);
 }
 
+async function retireLegacyGuardLogs(host, { dryRun = false } = {}) {
+  const logDir = path.join(path.dirname(host.settingsPath), 'logs');
+  const lines = [];
+  for (const name of LEGACY_GUARD_LOG_FILES) {
+    const target = path.join(logDir, name);
+    if (!await exists(target)) continue;
+    if (!dryRun) await fs.rm(target, { force: true });
+    lines.push(`${dryRun ? 'Would remove' : 'Removed'} ${path.join('logs', name)}.`);
+  }
+  return lines.join('\n');
+}
+
 function displayFile(file) {
   const entry = fileEntry(file);
   return `${entry.root}/${entry.path}`;
@@ -64,12 +81,6 @@ function classifyOrphan(state) {
   return 'modified';
 }
 
-function recordHasHooks(record, targets) {
-  return Boolean(record)
-    && targets.every(({ definition, relative }) => record.hooks?.some((hook) =>
-      hook.event === definition.event && hook.root === 'brand' && hook.path === relative));
-}
-
 function appliedOutput(states) {
   const count = (status) => states.filter((state) => state.status === status).length;
   const parts = [
@@ -104,12 +115,14 @@ function dryRunOutput(states, hookStates, legacy, oldHooks) {
   // "the previous undefined hook registration" five times during the Plan_25 migration — the one
   // dry run where the operator most needed to see which registrations were about to be taken away.
   oldHooks.forEach(({ hook, definition }) => lines.push(
-    `Would remove the previous ${hook.event} hook registration for matcher ${definition.matcher}.`,
+    `Would remove the previous ${hook.event} hook registration ${definition.name} for matcher ${definition.matcher}.`,
   ));
   hookStates.forEach(({ state, target }) => {
     const { definition, registration } = target;
-    if (!state.present) {
-      lines.push(`Would register ${definition.event} hook for matcher ${definition.matcher} with ${registration.form} command.`);
+    if (state.present && !state.current) {
+      lines.push(`Would rewrite ${definition.event} hook ${definition.name} for matcher ${definition.matcher} to ${registration.form} command: ${registration.reason}.`);
+    } else if (!state.present) {
+      lines.push(`Would register ${definition.event} hook ${definition.name} for matcher ${definition.matcher} with ${registration.form} command.`);
     }
   });
   lines.push('Would write installation record with new fingerprints in both roots.');
@@ -210,7 +223,7 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
       + ' The home was updated from the copy that answered, not from that checkout'
       + ` (npm i -g ${currentPackage.name}@${elsewhere.version} changes which one that is).`
     : '';
-  const targets = hookTargets(host, env, currentPackage.version);
+  const targets = hookTargets(host, env);
   const inspectedHooks = await Promise.all(targets.map(async (target) => ({
     target,
     state: await inspectHook(host.settingsPath, target.spec),
@@ -220,8 +233,9 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
     new Map(plannedStates.map((state) => [recordFileKey(state.item), state.fingerprint])),
     { path: rule.target, fingerprint: ruleState.fingerprint });
   const changed = states.some((state) => state.status !== 'up-to-date') || oldHooks.length > 0;
-  if (!changed && inspectedHooks.every(({ state }) => state.present)
+  if (!changed && inspectedHooks.every(({ state }) => state.current)
     && recordHasHooks(record, targets) && recordCurrent) {
+    const legacyLogOutput = await retireLegacyGuardLogs(host, { dryRun });
     if (!dryRun) {
       await addRulesOwner(host);
       // An update that installed the new layout but stopped before retiring the old one used to
@@ -230,10 +244,20 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
       // it on this path costs nothing when there is nothing left to retire.
       await retireLegacyLayout(host);
     }
-    return { exitCode: 0, output: `codex-bridge is up to date with ${source}${mismatch}` };
+    return {
+      exitCode: 0,
+      output: [`codex-bridge is up to date with ${source}${mismatch}`, legacyLogOutput]
+        .filter(Boolean).join('\n'),
+    };
   }
   if (dryRun) {
-    return { exitCode: 0, output: `Would update codex-bridge with ${source}.${mismatch}\n${dryRunOutput(states, inspectedHooks, legacy, oldHooks)}` };
+    const legacyLogOutput = await retireLegacyGuardLogs(host, { dryRun: true });
+    return {
+      exitCode: 0,
+      output: [`Would update codex-bridge with ${source}.${mismatch}`,
+        dryRunOutput(states, inspectedHooks, legacy, oldHooks), legacyLogOutput]
+        .filter(Boolean).join('\n'),
+    };
   }
 
   for (const state of orphanStates) {
@@ -249,7 +273,12 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
   const installed = await install({ host, force: true, packageRoot, env });
   if (installed.exitCode !== 0) return installed;
   await retireLegacyLayout(host);
-  return { exitCode: 0, output: `${appliedOutput(states)}\nSource: ${source}${mismatch}` };
+  const legacyLogOutput = await retireLegacyGuardLogs(host);
+  return {
+    exitCode: 0,
+    output: [`${appliedOutput(states)}\nSource: ${source}${mismatch}`, legacyLogOutput]
+      .filter(Boolean).join('\n'),
+  };
 }
 
 export async function update(options = {}) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lyupro/codex-bridge",
-  "version": "0.6.5",
-  "description": "Claude Code-to-Codex delegation with 6 guards, 1491 tests, zero runtime dependencies, and zero build steps.",
+  "version": "0.6.7",
+  "description": "Claude Code-to-Codex delegation with 7 guards, 1636 tests, zero runtime dependencies, and zero build steps.",
   "keywords": [
     "claude-code",
     "codex",
@@ -23,8 +23,8 @@
   "homepage": "https://github.com/lyupro/codex-bridge#readme",
   "type": "module",
   "bin": {
-    "codex-bridge": "./bin/codex-bridge.mjs",
-    "codexb": "./bin/codex-bridge.mjs"
+    "codex-bridge": "bin/codex-bridge.mjs",
+    "codexb": "bin/codex-bridge.mjs"
   },
   "engines": {
     "node": ">=24.0.0"

package/src/agents/codex-advisor.md

@@ -103,10 +103,9 @@ differs — that refusal is the whole answer: return `FAIL` with the runner's te
 a different id of your own choosing; the order id is the orchestrator's.
 
 Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a
-report from memory. If an attaching call is killed by a time ceiling, repeat the identical command
-once with `--no-wait`. This only checks state; it is never a final answer. If stdout contains the
-ready reply, return it normally. If the call exits 4, return to the ordinary waiting call with the
-same order id and without `--no-wait`. A real run takes 20-25 minutes, which is normal, not a hang.
+report from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
+run and keeps waiting. Never add a flag — the host allows exactly the one command your
+order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang.
 Give the ordinary attaching call `timeout: 1800000` (30 minutes).
 
 **Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the

package/src/agents/codex-build.md

@@ -52,7 +52,8 @@ job is to report the run status honestly, including failure.
   operator's real check command contained `&&`, and a compound operator in an argument makes the
   host stop applying its permission rule, which is how a delegation dies on a refusal.
 - Every build task file must contain exactly one `advice:` line from the orchestrator: an absolute
-  path to an existing run folder whose `meta.json` identifies `codex-advisor`, or exactly
+  path to an existing run folder whose `meta.json` identifies a `codex-advisor` advise pass with
+  status `OK`, or exactly
   `mechanical`, `revert`, `docs-only`, or `test-only`. Anything else is refused before the run
   starts. Pass the task file as supplied; the orchestrator owns this line.
 
@@ -111,10 +112,9 @@ differs — that refusal is the whole answer: return `FAIL` with the runner's te
 remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
 
 Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a report
-from memory. If the attaching call is killed by a time ceiling, repeat the identical command once with
-`--no-wait`. This only checks state; it is never a final answer. If stdout contains the ready reply,
-return it normally. If the call exits 4, return to the ordinary waiting call with the same `--order-id`
-and without `--no-wait`. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
+from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
+run and keeps waiting. Never add a flag — the host allows exactly the one command your
+order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
 attaching call `timeout: 1800000` (30 minutes).
 
 **Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the

package/src/agents/codex-review.md

@@ -96,9 +96,9 @@ the runner parses it and issues the refusal. If no such grant line is present, t
 present in the command at all.
 
 Background execution (`run_in_background`, `&`, `nohup`) is prohibited. If the attaching call is killed
-by a time ceiling, repeat the identical command once with `--no-wait`. This only checks state; it is
-never a final answer. If stdout contains the ready reply, return it normally. If the call exits 4,
-return to the ordinary waiting call with the same `--order-id` and without `--no-wait`. A real run takes
+by a time ceiling, run the identical command again: it attaches to the same
+run and keeps waiting. Never add a flag — the host allows exactly the one command your
+order yields and refuses every other. A real run takes
 20-25 minutes, which is normal, not a hang. Give the ordinary attaching call `timeout: 1800000` (30
 minutes).
 

package/src/agents/codex-scout.md

@@ -107,10 +107,9 @@ differs — that refusal is the whole answer: return `FAIL` with the runner's te
 remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
 
 Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a report
-from memory. If the attaching call is killed by a time ceiling, repeat the identical command once with
-`--no-wait`. This only checks state; it is never a final answer. If stdout contains the ready reply,
-return it normally. If the call exits 4, return to the ordinary waiting call with the same `--order-id`
-and without `--no-wait`. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
+from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
+run and keeps waiting. Never add a flag — the host allows exactly the one command your
+order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
 attaching call `timeout: 1800000` (30 minutes).
 
 **Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the

package/src/home/hooks/dispatcher-gate.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+/** Enforces each dispatcher order at the host tool boundary and returns only the runner's verdict. */
+import fs from 'node:fs';
+import { AGENTS } from '../lib/agents.mjs';
+import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { sameCommand } from '../lib/dispatcher-command.mjs';
+import { parseJsonText } from '../lib/json-file.mjs';
+import {
+  decidePreToolUse,
+  gateOrder,
+  HANDBACK_TOOL,
+  isFinalOutput,
+  runnerOutput,
+} from '../lib/dispatcher-gate.mjs';
+import {
+  pruneDispatcherStates,
+  readDispatcherState,
+  updateDispatcherState,
+} from '../lib/dispatcher-state.mjs';
+import { hostSdkVersion, recordHandbackWitness } from '../lib/handback-witness.mjs';
+
+function emit(decision, toolInput) {
+  const hookSpecificOutput = {
+    hookEventName: 'PreToolUse',
+    permissionDecision: decision.kind,
+  };
+  if (decision.kind === 'deny') hookSpecificOutput.permissionDecisionReason = decision.reason;
+  if (decision.kind === 'allow') {
+    hookSpecificOutput.updatedInput = { ...toolInput, message: decision.message };
+  }
+  process.stdout.write(`${JSON.stringify({ hookSpecificOutput })}\n`);
+}
+
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+async function main() {
+  let payload;
+  try {
+    payload = parseJsonText('stdin', fs.readFileSync(0, 'utf8'));
+  } catch {
+    return;
+  }
+
+  if (!payload || !Object.prototype.hasOwnProperty.call(AGENTS, payload.agent_type)
+    || typeof payload.session_id !== 'string' || payload.session_id.length === 0
+    || typeof payload.agent_id !== 'string' || payload.agent_id.length === 0) return;
+
+  const ids = {
+    stateDir: BRAND_STATE_DIR,
+    sessionId: payload.session_id,
+    agentId: payload.agent_id,
+  };
+
+  if (payload.hook_event_name === 'PreToolUse') {
+    let decision;
+    let order;
+    try {
+      order = gateOrder(payload);
+      const stored = readDispatcherState(ids);
+      const state = stored?.corrupt ? {} : (stored || {});
+      decision = decidePreToolUse({ payload, order, state });
+      const toolUseId = typeof payload.tool_use_id === 'string' && payload.tool_use_id.length > 0
+        ? payload.tool_use_id
+        : null;
+      await updateDispatcherState(ids, (current) => {
+        const next = {
+          ...(current.corrupt ? {} : current),
+          ...(decision.stateUpdate || {}),
+        };
+        if (toolUseId) {
+          const seenToolUseIds = Array.isArray(next.seenToolUseIds) ? next.seenToolUseIds : [];
+          next.seenToolUseIds = [...seenToolUseIds, toolUseId].slice(-200);
+        }
+        return next;
+      });
+    } catch (error) {
+      decision = {
+        kind: 'deny',
+        reason: `codex-bridge dispatcher gate: internal error: ${errorMessage(error)}`,
+      };
+    }
+
+    if (payload.tool_name === HANDBACK_TOOL) {
+      try {
+        await recordHandbackWitness({
+          stateDir: BRAND_STATE_DIR,
+          kind: 'seen',
+          sdkVersion: hostSdkVersion(),
+        });
+      } catch {}
+      try {
+        pruneDispatcherStates({ stateDir: BRAND_STATE_DIR });
+      } catch {}
+    }
+
+    if (decision.kind !== 'pass') emit(decision, payload.tool_input || {});
+    return;
+  }
+
+  if ((payload.hook_event_name === 'PostToolUse' || payload.hook_event_name === 'PostToolUseFailure')
+    && payload.tool_name === 'Bash') {
+    try {
+      const order = gateOrder(payload);
+      if (!order.command || !sameCommand(payload.tool_input?.command, order.command)) return;
+      const result = runnerOutput(payload);
+      if (!result) return;
+      await updateDispatcherState(ids, (current) => ({
+        ...(current.corrupt ? {} : current),
+        runnerOutput: result.output,
+        runnerFinal: isFinalOutput(result.output),
+        runnerExitCode: result.exitCode,
+      }));
+    } catch {}
+  }
+}
+
+main().catch(() => {});

package/src/home/hooks/guard-tries.mjs

@@ -1,15 +1,14 @@
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
+import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 
-const LOG_DIR = path.join(os.homedir(), '.claude', 'logs');
 /**
- * The file keeps its reply-guard name although two guards now share it: renaming would abandon the
- * budgets already spent on hosts in the field, and a guard that forgets its refusals starts
- * refusing the same call again.
+ * Two guards share this budget (reply-guard and stop-guard). It lived in Claude Code's own
+ * `~/.claude/logs/` until Plan_62 D14 moved package state into the brand home; the move abandons
+ * budgets spent before it, which is harmless because they are keyed by agent ids that no longer run.
  */
-export const BLOCKED_FILE = path.join(LOG_DIR, 'codex-reply-guard.blocked.json');
+export const BLOCKED_FILE = path.join(BRAND_STATE_DIR, 'reply-guard-tries.json');
 export const FORM = 'form';
 export const STATE = 'state';
 export const MAX_FORM_BLOCKS = 3;

package/src/home/hooks/live-runs.mjs

@@ -129,6 +129,7 @@ export function recentRuns(runsDir, options = {}) {
     }
     if (!status || typeof status !== 'object' || Array.isArray(status)) return null;
     if (options.agent && status.agent !== options.agent) continue;
+    if (options.orderId && String(status.order_id ?? '').trim() !== options.orderId) continue;
     const timestamp = Date.parse(status.finished_at || status.started_at || '');
     if (!Number.isFinite(timestamp) || timestamp > now || now - timestamp > maxAgeMs) continue;
     result.push({ dir, status, timestamp });

package/src/home/hooks/order-gate.mjs

@@ -12,9 +12,9 @@
  * silently because a diagnostic guard must never break an unrelated tool call.
  */
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
+import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 import {
   diagnoseInput,
@@ -30,8 +30,7 @@ import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
 import { parseTaskDocument } from '../lib/runner/task-file.mjs';
 
-const HOME = os.homedir();
-const LOG_DIR = path.join(HOME, '.claude', 'logs');
+const DIAGNOSTICS_DIR = path.join(BRAND_STATE_DIR, 'diagnostics');
 const GUARDED = new Set(Object.keys(AGENTS));
 /**
  * Both spellings of the subagent-launching tool, from the same list the installer builds its
@@ -60,8 +59,8 @@ try {
 }
 
 try {
-  fs.mkdirSync(LOG_DIR, { recursive: true });
-  fs.writeFileSync(path.join(LOG_DIR, 'codex-order-gate.last.json'), `${JSON.stringify(input, null, 2)}\n`);
+  fs.mkdirSync(DIAGNOSTICS_DIR, { recursive: true });
+  fs.writeFileSync(path.join(DIAGNOSTICS_DIR, 'order-gate.last.json'), `${JSON.stringify(input, null, 2)}\n`);
 } catch {
   // Diagnostics are a convenience, never a reason to fail the turn.
 }
@@ -73,6 +72,22 @@ const toolInput = input.tool_input;
 if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput)) pass();
 if (!GUARDED.has(toolInput.subagent_type) || typeof toolInput.prompt !== 'string') pass();
 
+/**
+ * Plan_62 D7: with agent teams enabled, a registered dispatcher launched with `name` or `team_name`
+ * starts as a teammate — its `agent_type` becomes the teammate's name and it answers through
+ * SendMessage (live probe 2026-09-24, `docs/plans/Plan_62-probe/journal-run1.jsonl`), so the dispatcher
+ * gate never recognises it and every prohibition falls back to prompt text. Refused before it starts.
+ */
+const teammateField = ['name', 'team_name']
+  .find((key) => typeof toolInput[key] === 'string' && toolInput[key].trim());
+if (teammateField) {
+  deny(
+    `Order gate denied the Agent call because it passes \`${teammateField}\`: a dispatcher launched as a ` +
+      'teammate escapes the dispatcher gate, whose agent_type becomes the teammate name. Call ' +
+      `${toolInput.subagent_type} with subagent_type only, without name or team_name.`,
+  );
+}
+
 const missing = missingInputs(toolInput.subagent_type, toolInput.prompt);
 const unsafe = shellUnsafeInputs(toolInput.subagent_type, toolInput.prompt);
 if (missing.length || unsafe.length) {