@lyupro/codex-bridge 0.6.6 → 0.6.8

package/cli/uninstall.mjs

@@ -10,6 +10,8 @@ import {
   recordTarget,
 } from './manifest.mjs';
 import { removePermissionRules } from './permissions.mjs';
+import { hostContractPath } from './host-contract.mjs';
+import { brandStateDir } from '../src/home/lib/brand-home.mjs';
 import {
   commandFor,
   removeHook,
@@ -33,6 +35,18 @@ function permissionOutput(host, removed, dryRun) {
   return `${verb} ${removed} permission rule ${plural} from ${host.settingsPath}.`;
 }
 
+// Plan_62 D22: uninstall removes only recorded files, and the message used to name only runs and
+// config.json — state/, the host measurement and conventions.md stayed behind unmentioned. Until
+// Plan_65 derives this from a registry, the sentence names every kind the package writes while working.
+function preservationText(host) {
+  return `Run artifacts in ${path.join(host.root, 'codex-runs')} are preserved, and so is what the package `
+    + `wrote into ${host.brandRoot} while working: the run configuration ${host.brandConfigPath}, the conventions `
+    + `${host.brandConventionsPath}, the host measurement ${hostContractPath(host)} and runtime state in `
+    + `${brandStateDir(host.brandRoot)} (dispatcher state, guard counters, the handback witness, the host `
+    + 'observations, dispatcher contract verdicts, and hook diagnostics that hold the full hook input). Delete them by '
+    + 'hand for a complete removal.';
+}
+
 function displayFile(file) {
   return `${file.root}/${file.path}`;
 }
@@ -62,8 +76,7 @@ async function uninstallInRun({ host, dryRun = false } = {}) {
   const permissionResult = await removePermissionRules(host.settingsPath, { dryRun });
   const permissionLine = permissionOutput(host, permissionResult.removed, dryRun);
   const record = await readInstallRecord(host);
-  const preservation = `Run artifacts in ${path.join(host.root, 'codex-runs')} and the run `
-    + `configuration in ${host.brandConfigPath} are preserved.`;
+  const preservation = preservationText(host);
   if (!record) {
     return { exitCode: 1, output: `${permissionLine}\ncodex-bridge is not installed.\n${preservation}` };
   }
@@ -92,7 +105,7 @@ async function uninstallInRun({ host, dryRun = false } = {}) {
     }
     for (const hook of record.hooks) {
       const definition = definitionForRecordedHook(hook);
-      lines.push(`Would remove the ${hook.event} hook for matcher ${definition.matcher}.`);
+      lines.push(`Would remove the ${hook.event} hook ${definition.name} for matcher ${definition.matcher}.`);
     }
     lines.push('Would remove the installation record from the brand root.');
     lines.push(preservation);

package/cli/update.mjs

@@ -17,11 +17,10 @@ import {
   rulesPlan,
 } from './manifest.mjs';
 import { targetMatches } from './copy.mjs';
-import { hookTargets } from './hook-targets.mjs';
+import { hookTargets, recordHasHooks } from './hook-targets.mjs';
 import { definitionForRecordedHook, fileEntry, fingerprintFor } from './install-record.mjs';
 import {
   commandFor,
-  hookRegistration,
   inspectHook,
   removeHook,
   withSettingsRun,
@@ -29,6 +28,12 @@ import {
 import { addRulesOwner, readRulesRegistry } from './rules-owners.mjs';
 import { claudeBoundary, removeEmptyLayout, removeEmptyParents } from './remove-layout.mjs';
 
+const LEGACY_GUARD_LOG_FILES = [
+  'codex-reply-guard.blocked.json',
+  'codex-order-gate.last.json',
+  'codex-reply-guard.last.json',
+];
+
 async function exists(target) {
   try {
     return (await fs.stat(target)).isFile();
@@ -45,6 +50,18 @@ async function retireLegacyLayout(host) {
   await removeEmptyLayout(host.legacyCommandsDir);
 }
 
+async function retireLegacyGuardLogs(host, { dryRun = false } = {}) {
+  const logDir = path.join(path.dirname(host.settingsPath), 'logs');
+  const lines = [];
+  for (const name of LEGACY_GUARD_LOG_FILES) {
+    const target = path.join(logDir, name);
+    if (!await exists(target)) continue;
+    if (!dryRun) await fs.rm(target, { force: true });
+    lines.push(`${dryRun ? 'Would remove' : 'Removed'} ${path.join('logs', name)}.`);
+  }
+  return lines.join('\n');
+}
+
 function displayFile(file) {
   const entry = fileEntry(file);
   return `${entry.root}/${entry.path}`;
@@ -64,12 +81,6 @@ function classifyOrphan(state) {
   return 'modified';
 }
 
-function recordHasHooks(record, targets) {
-  return Boolean(record)
-    && targets.every(({ definition, relative }) => record.hooks?.some((hook) =>
-      hook.event === definition.event && hook.root === 'brand' && hook.path === relative));
-}
-
 function appliedOutput(states) {
   const count = (status) => states.filter((state) => state.status === status).length;
   const parts = [
@@ -104,12 +115,14 @@ function dryRunOutput(states, hookStates, legacy, oldHooks) {
   // "the previous undefined hook registration" five times during the Plan_25 migration — the one
   // dry run where the operator most needed to see which registrations were about to be taken away.
   oldHooks.forEach(({ hook, definition }) => lines.push(
-    `Would remove the previous ${hook.event} hook registration for matcher ${definition.matcher}.`,
+    `Would remove the previous ${hook.event} hook registration ${definition.name} for matcher ${definition.matcher}.`,
   ));
   hookStates.forEach(({ state, target }) => {
     const { definition, registration } = target;
-    if (!state.present) {
-      lines.push(`Would register ${definition.event} hook for matcher ${definition.matcher} with ${registration.form} command.`);
+    if (state.present && !state.current) {
+      lines.push(`Would rewrite ${definition.event} hook ${definition.name} for matcher ${definition.matcher} to ${registration.form} command: ${registration.reason}.`);
+    } else if (!state.present) {
+      lines.push(`Would register ${definition.event} hook ${definition.name} for matcher ${definition.matcher} with ${registration.form} command.`);
     }
   });
   lines.push('Would write installation record with new fingerprints in both roots.');
@@ -210,7 +223,7 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
       + ' The home was updated from the copy that answered, not from that checkout'
       + ` (npm i -g ${currentPackage.name}@${elsewhere.version} changes which one that is).`
     : '';
-  const targets = hookTargets(host, env, currentPackage.version);
+  const targets = hookTargets(host, env);
   const inspectedHooks = await Promise.all(targets.map(async (target) => ({
     target,
     state: await inspectHook(host.settingsPath, target.spec),
@@ -220,8 +233,9 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
     new Map(plannedStates.map((state) => [recordFileKey(state.item), state.fingerprint])),
     { path: rule.target, fingerprint: ruleState.fingerprint });
   const changed = states.some((state) => state.status !== 'up-to-date') || oldHooks.length > 0;
-  if (!changed && inspectedHooks.every(({ state }) => state.present)
+  if (!changed && inspectedHooks.every(({ state }) => state.current)
     && recordHasHooks(record, targets) && recordCurrent) {
+    const legacyLogOutput = await retireLegacyGuardLogs(host, { dryRun });
     if (!dryRun) {
       await addRulesOwner(host);
       // An update that installed the new layout but stopped before retiring the old one used to
@@ -230,10 +244,20 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
       // it on this path costs nothing when there is nothing left to retire.
       await retireLegacyLayout(host);
     }
-    return { exitCode: 0, output: `codex-bridge is up to date with ${source}${mismatch}` };
+    return {
+      exitCode: 0,
+      output: [`codex-bridge is up to date with ${source}${mismatch}`, legacyLogOutput]
+        .filter(Boolean).join('\n'),
+    };
   }
   if (dryRun) {
-    return { exitCode: 0, output: `Would update codex-bridge with ${source}.${mismatch}\n${dryRunOutput(states, inspectedHooks, legacy, oldHooks)}` };
+    const legacyLogOutput = await retireLegacyGuardLogs(host, { dryRun: true });
+    return {
+      exitCode: 0,
+      output: [`Would update codex-bridge with ${source}.${mismatch}`,
+        dryRunOutput(states, inspectedHooks, legacy, oldHooks), legacyLogOutput]
+        .filter(Boolean).join('\n'),
+    };
   }
 
   for (const state of orphanStates) {
@@ -249,7 +273,12 @@ async function updateInRun({ host, dryRun = false, force = false, packageRoot, e
   const installed = await install({ host, force: true, packageRoot, env });
   if (installed.exitCode !== 0) return installed;
   await retireLegacyLayout(host);
-  return { exitCode: 0, output: `${appliedOutput(states)}\nSource: ${source}${mismatch}` };
+  const legacyLogOutput = await retireLegacyGuardLogs(host);
+  return {
+    exitCode: 0,
+    output: [`${appliedOutput(states)}\nSource: ${source}${mismatch}`, legacyLogOutput]
+      .filter(Boolean).join('\n'),
+  };
 }
 
 export async function update(options = {}) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lyupro/codex-bridge",
-  "version": "0.6.6",
-  "description": "Claude Code-to-Codex delegation with 6 guards, 1501 tests, zero runtime dependencies, and zero build steps.",
+  "version": "0.6.8",
+  "description": "Claude Code-to-Codex delegation with 7 guards, 1667 tests, zero runtime dependencies, and zero build steps.",
   "keywords": [
     "claude-code",
     "codex",
@@ -23,8 +23,8 @@
   "homepage": "https://github.com/lyupro/codex-bridge#readme",
   "type": "module",
   "bin": {
-    "codex-bridge": "./bin/codex-bridge.mjs",
-    "codexb": "./bin/codex-bridge.mjs"
+    "codex-bridge": "bin/codex-bridge.mjs",
+    "codexb": "bin/codex-bridge.mjs"
   },
   "engines": {
     "node": ">=24.0.0"

package/scripts/run-tests.mjs

@@ -21,6 +21,13 @@ import { spawnSync } from 'node:child_process';
 import { ISOLATED_ROOTS } from './isolated-roots.mjs';
 import { readmeText, suiteCountMismatch } from './suite-count.mjs';
 
+// One pattern only: on 2026-09-25 three files passed as three arguments ran just the first, and a
+// verification reported green for two files it never touched. Refuse before any root is created.
+if (process.argv.length > 3) {
+  console.error('run-tests: takes ONE pattern; pass a glob such as "tests/cli/{doctor,install}.test.mjs"');
+  process.exit(2);
+}
+
 const created = ISOLATED_ROOTS.map((name) => [
   name,
   fs.mkdtempSync(path.join(os.tmpdir(), `codex-bridge-test-${name.toLowerCase()}-`)),

package/src/agents/codex-advisor.md

@@ -103,10 +103,9 @@ differs — that refusal is the whole answer: return `FAIL` with the runner's te
 a different id of your own choosing; the order id is the orchestrator's.
 
 Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a
-report from memory. If an attaching call is killed by a time ceiling, repeat the identical command
-once with `--no-wait`. This only checks state; it is never a final answer. If stdout contains the
-ready reply, return it normally. If the call exits 4, return to the ordinary waiting call with the
-same order id and without `--no-wait`. A real run takes 20-25 minutes, which is normal, not a hang.
+report from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
+run and keeps waiting. Never add a flag — the host allows exactly the one command your
+order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang.
 Give the ordinary attaching call `timeout: 1800000` (30 minutes).
 
 **Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the

package/src/agents/codex-build.md

@@ -52,7 +52,8 @@ job is to report the run status honestly, including failure.
   operator's real check command contained `&&`, and a compound operator in an argument makes the
   host stop applying its permission rule, which is how a delegation dies on a refusal.
 - Every build task file must contain exactly one `advice:` line from the orchestrator: an absolute
-  path to an existing run folder whose `meta.json` identifies `codex-advisor`, or exactly
+  path to an existing run folder whose `meta.json` identifies a `codex-advisor` advise pass with
+  status `OK`, or exactly
   `mechanical`, `revert`, `docs-only`, or `test-only`. Anything else is refused before the run
   starts. Pass the task file as supplied; the orchestrator owns this line.
 
@@ -111,10 +112,9 @@ differs — that refusal is the whole answer: return `FAIL` with the runner's te
 remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
 
 Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a report
-from memory. If the attaching call is killed by a time ceiling, repeat the identical command once with
-`--no-wait`. This only checks state; it is never a final answer. If stdout contains the ready reply,
-return it normally. If the call exits 4, return to the ordinary waiting call with the same `--order-id`
-and without `--no-wait`. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
+from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
+run and keeps waiting. Never add a flag — the host allows exactly the one command your
+order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
 attaching call `timeout: 1800000` (30 minutes).
 
 **Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the

package/src/agents/codex-review.md

@@ -96,9 +96,9 @@ the runner parses it and issues the refusal. If no such grant line is present, t
 present in the command at all.
 
 Background execution (`run_in_background`, `&`, `nohup`) is prohibited. If the attaching call is killed
-by a time ceiling, repeat the identical command once with `--no-wait`. This only checks state; it is
-never a final answer. If stdout contains the ready reply, return it normally. If the call exits 4,
-return to the ordinary waiting call with the same `--order-id` and without `--no-wait`. A real run takes
+by a time ceiling, run the identical command again: it attaches to the same
+run and keeps waiting. Never add a flag — the host allows exactly the one command your
+order yields and refuses every other. A real run takes
 20-25 minutes, which is normal, not a hang. Give the ordinary attaching call `timeout: 1800000` (30
 minutes).
 

package/src/agents/codex-scout.md

@@ -107,10 +107,9 @@ differs — that refusal is the whole answer: return `FAIL` with the runner's te
 remedy. Never retry under a different id of your own choosing; the order id is the orchestrator's.
 
 Background execution (`run_in_background`, `&`, `nohup`) is prohibited, and so is inventing a report
-from memory. If the attaching call is killed by a time ceiling, repeat the identical command once with
-`--no-wait`. This only checks state; it is never a final answer. If stdout contains the ready reply,
-return it normally. If the call exits 4, return to the ordinary waiting call with the same `--order-id`
-and without `--no-wait`. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
+from memory. If the attaching call is killed by a time ceiling, run the identical command again: it attaches to the same
+run and keeps waiting. Never add a flag — the host allows exactly the one command your
+order yields and refuses every other. A real run takes 20-25 minutes, which is normal, not a hang. Give the ordinary
 attaching call `timeout: 1800000` (30 minutes).
 
 **Never change `--order-id` or `--slug` to get a fresh run.** The order id is issued by the

package/src/home/hooks/dispatcher-gate.mjs

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+/** Enforces each dispatcher order at the host tool boundary and returns only the runner's verdict. */
+import fs from 'node:fs';
+import { AGENTS } from '../lib/agents.mjs';
+import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
+import { sameCommand } from '../lib/dispatcher-command.mjs';
+import { parseJsonText } from '../lib/json-file.mjs';
+import {
+  decidePreToolUse,
+  gateOrder,
+  HANDBACK_TOOL,
+  isFinalOutput,
+  runnerOutput,
+} from '../lib/dispatcher-gate.mjs';
+import {
+  pruneDispatcherStates,
+  readDispatcherState,
+  updateDispatcherState,
+} from '../lib/dispatcher-state.mjs';
+import { recordHandbackWitness, witnessHostVersion } from '../lib/handback-witness.mjs';
+import { observeSessionHost } from '../lib/host-observations.mjs';
+
+function emit(decision, toolInput) {
+  const hookSpecificOutput = {
+    hookEventName: 'PreToolUse',
+    permissionDecision: decision.kind,
+  };
+  if (decision.kind === 'deny') hookSpecificOutput.permissionDecisionReason = decision.reason;
+  if (decision.kind === 'allow') {
+    hookSpecificOutput.updatedInput = { ...toolInput, message: decision.message };
+  }
+  process.stdout.write(`${JSON.stringify({ hookSpecificOutput })}\n`);
+}
+
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+async function main() {
+  let payload;
+  try {
+    payload = parseJsonText('stdin', fs.readFileSync(0, 'utf8'));
+  } catch {
+    return;
+  }
+
+  if (payload?.hook_event_name === 'PreToolUse'
+    && typeof payload.session_id === 'string' && payload.session_id.length > 0
+    && typeof payload.transcript_path === 'string' && payload.transcript_path.length > 0) {
+    try {
+      await observeSessionHost({
+        stateDir: BRAND_STATE_DIR,
+        sessionId: payload.session_id,
+        transcriptPath: payload.transcript_path,
+      });
+    } catch {}
+  }
+
+  if (!payload || !Object.prototype.hasOwnProperty.call(AGENTS, payload.agent_type)
+    || typeof payload.session_id !== 'string' || payload.session_id.length === 0
+    || typeof payload.agent_id !== 'string' || payload.agent_id.length === 0) return;
+
+  const ids = {
+    stateDir: BRAND_STATE_DIR,
+    sessionId: payload.session_id,
+    agentId: payload.agent_id,
+  };
+
+  if (payload.hook_event_name === 'PreToolUse') {
+    let decision;
+    let order;
+    try {
+      order = gateOrder(payload);
+      const stored = readDispatcherState(ids);
+      const state = stored?.corrupt ? {} : (stored || {});
+      decision = decidePreToolUse({ payload, order, state });
+      const toolUseId = typeof payload.tool_use_id === 'string' && payload.tool_use_id.length > 0
+        ? payload.tool_use_id
+        : null;
+      await updateDispatcherState(ids, (current) => {
+        const next = {
+          ...(current.corrupt ? {} : current),
+          ...(decision.stateUpdate || {}),
+        };
+        if (toolUseId) {
+          const seenToolUseIds = Array.isArray(next.seenToolUseIds) ? next.seenToolUseIds : [];
+          next.seenToolUseIds = [...seenToolUseIds, toolUseId].slice(-200);
+        }
+        return next;
+      });
+    } catch (error) {
+      decision = {
+        kind: 'deny',
+        reason: `codex-bridge dispatcher gate: internal error: ${errorMessage(error)}`,
+      };
+    }
+
+    if (payload.tool_name === HANDBACK_TOOL) {
+      try {
+        await recordHandbackWitness({
+          stateDir: BRAND_STATE_DIR,
+          kind: 'seen',
+          hostVersion: await witnessHostVersion(payload),
+        });
+      } catch {}
+      try {
+        pruneDispatcherStates({ stateDir: BRAND_STATE_DIR });
+      } catch {}
+    }
+
+    if (decision.kind !== 'pass') emit(decision, payload.tool_input || {});
+    return;
+  }
+
+  if ((payload.hook_event_name === 'PostToolUse' || payload.hook_event_name === 'PostToolUseFailure')
+    && payload.tool_name === 'Bash') {
+    try {
+      const order = gateOrder(payload);
+      if (!order.command || !sameCommand(payload.tool_input?.command, order.command)) return;
+      const result = runnerOutput(payload);
+      if (!result) return;
+      await updateDispatcherState(ids, (current) => ({
+        ...(current.corrupt ? {} : current),
+        runnerOutput: result.output,
+        runnerFinal: isFinalOutput(result.output),
+        runnerExitCode: result.exitCode,
+      }));
+    } catch {}
+  }
+}
+
+main().catch(() => {});

package/src/home/hooks/guard-tries.mjs

@@ -1,15 +1,14 @@
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
+import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 
-const LOG_DIR = path.join(os.homedir(), '.claude', 'logs');
 /**
- * The file keeps its reply-guard name although two guards now share it: renaming would abandon the
- * budgets already spent on hosts in the field, and a guard that forgets its refusals starts
- * refusing the same call again.
+ * Two guards share this budget (reply-guard and stop-guard). It lived in Claude Code's own
+ * `~/.claude/logs/` until Plan_62 D14 moved package state into the brand home; the move abandons
+ * budgets spent before it, which is harmless because they are keyed by agent ids that no longer run.
  */
-export const BLOCKED_FILE = path.join(LOG_DIR, 'codex-reply-guard.blocked.json');
+export const BLOCKED_FILE = path.join(BRAND_STATE_DIR, 'reply-guard-tries.json');
 export const FORM = 'form';
 export const STATE = 'state';
 export const MAX_FORM_BLOCKS = 3;

package/src/home/hooks/live-runs.mjs

@@ -129,6 +129,7 @@ export function recentRuns(runsDir, options = {}) {
     }
     if (!status || typeof status !== 'object' || Array.isArray(status)) return null;
     if (options.agent && status.agent !== options.agent) continue;
+    if (options.orderId && String(status.order_id ?? '').trim() !== options.orderId) continue;
     const timestamp = Date.parse(status.finished_at || status.started_at || '');
     if (!Number.isFinite(timestamp) || timestamp > now || now - timestamp > maxAgeMs) continue;
     result.push({ dir, status, timestamp });

package/src/home/hooks/order-gate.mjs

@@ -12,9 +12,9 @@
  * silently because a diagnostic guard must never break an unrelated tool call.
  */
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
 import { AGENTS } from '../lib/agents.mjs';
+import { BRAND_STATE_DIR } from '../lib/brand-home.mjs';
 import { readJsonFileSync } from '../lib/json-file.mjs';
 import {
   diagnoseInput,
@@ -30,8 +30,7 @@ import { resolveProjectRunsDir } from '../lib/runner/project-dir.mjs';
 import { runsRoot } from '../lib/runner/runs-root.mjs';
 import { parseTaskDocument } from '../lib/runner/task-file.mjs';
 
-const HOME = os.homedir();
-const LOG_DIR = path.join(HOME, '.claude', 'logs');
+const DIAGNOSTICS_DIR = path.join(BRAND_STATE_DIR, 'diagnostics');
 const GUARDED = new Set(Object.keys(AGENTS));
 /**
  * Both spellings of the subagent-launching tool, from the same list the installer builds its
@@ -60,8 +59,8 @@ try {
 }
 
 try {
-  fs.mkdirSync(LOG_DIR, { recursive: true });
-  fs.writeFileSync(path.join(LOG_DIR, 'codex-order-gate.last.json'), `${JSON.stringify(input, null, 2)}\n`);
+  fs.mkdirSync(DIAGNOSTICS_DIR, { recursive: true });
+  fs.writeFileSync(path.join(DIAGNOSTICS_DIR, 'order-gate.last.json'), `${JSON.stringify(input, null, 2)}\n`);
 } catch {
   // Diagnostics are a convenience, never a reason to fail the turn.
 }
@@ -73,6 +72,22 @@ const toolInput = input.tool_input;
 if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput)) pass();
 if (!GUARDED.has(toolInput.subagent_type) || typeof toolInput.prompt !== 'string') pass();
 
+/**
+ * Plan_62 D7: with agent teams enabled, a registered dispatcher launched with `name` or `team_name`
+ * starts as a teammate — its `agent_type` becomes the teammate's name and it answers through
+ * SendMessage (live probe 2026-09-24, `docs/plans/Plan_62-probe/journal-run1.jsonl`), so the dispatcher
+ * gate never recognises it and every prohibition falls back to prompt text. Refused before it starts.
+ */
+const teammateField = ['name', 'team_name']
+  .find((key) => typeof toolInput[key] === 'string' && toolInput[key].trim());
+if (teammateField) {
+  deny(
+    `Order gate denied the Agent call because it passes \`${teammateField}\`: a dispatcher launched as a ` +
+      'teammate escapes the dispatcher gate, whose agent_type becomes the teammate name. Call ' +
+      `${toolInput.subagent_type} with subagent_type only, without name or team_name.`,
+  );
+}
+
 const missing = missingInputs(toolInput.subagent_type, toolInput.prompt);
 const unsafe = shellUnsafeInputs(toolInput.subagent_type, toolInput.prompt);
 if (missing.length || unsafe.length) {