@lyupro/codex-bridge 0.6.7 → 0.6.9

package/src/home/lib/meta/paths.mjs

@@ -3,11 +3,21 @@
  *
  * Two sides spell the same file differently — git prints repo-relative paths with forward
  * slashes, Codex writes whatever it likes — so nothing above this module compares a path
- * before it has been through here. This is also the only module that touches the
- * filesystem for reading artifacts: everything else receives text, JSON or a byte count from it.
+ * before it has been through here. Strict snapshot judgement belongs to run-snapshots.mjs.
  */
 import fs from 'node:fs';
 import { readJsonFileSync } from '../json-file.mjs';
+import { compareSnapshots, decodeSnapshot } from './snapshot-format.mjs';
+
+/**
+ * `slice` counts UTF-16 units and can leave half of an emoji or a rare CJK character at the cut;
+ * a lone surrogate in a reply is the same kind of broken text Plan_68 D6 refuses from the model.
+ */
+export const safeSlice = (value, max) => {
+  const text = String(value ?? '').toWellFormed();
+  const result = text.slice(0, max);
+  return result.isWellFormed() ? result : result.slice(0, -1);
+};
 
 /** One line, no newlines, bounded length — a five-line reply must stay five lines. */
 export const line = (value, max = 200) => {
@@ -15,7 +25,7 @@ export const line = (value, max = 200) => {
   if (text.length <= max) return text;
 
   const ellipsis = '...';
-  if (max <= ellipsis.length) return text.slice(0, Math.max(0, max));
+  if (max <= ellipsis.length) return safeSlice(text, Math.max(0, max));
 
   const contentLimit = max - ellipsis.length;
   const boundary = text.lastIndexOf(' ', contentLimit);
@@ -24,11 +34,11 @@ export const line = (value, max = 200) => {
   // where a word ended. Dropping a trailing number here as well cost `All 298 12345678 rest`
   // its 298 — a number that fitted whole — because the digit test compared the limit rather
   // than the point the text was actually cut at.
-  if (boundary > 0) return `${text.slice(0, boundary)}${ellipsis}`;
+  if (boundary > 0) return `${safeSlice(text, boundary)}${ellipsis}`;
 
   // No space to retreat to: the limit lands inside a single long word. Only here can the cut
   // land mid-number, so only here is a partial number dropped.
-  return `${text.slice(0, contentLimit).replace(/\d+$/, '')}${ellipsis}`;
+  return `${safeSlice(text, contentLimit).replace(/\d+$/, '')}${ellipsis}`;
 };
 
 export const readText = (file) => {
@@ -60,32 +70,22 @@ export const size = (file) => {
 };
 
 /**
- * Snapshot lines are `<added>\t<deleted>\t<path>` for tracked files and `U\t<bytes>\t<path>`
- * for untracked ones — see worktreeSnapshot() in runner/git-state.mjs. Path last, state first.
+ * Tolerant display reader for reply, run-state and write-meta; invalid snapshots display
+ * an empty Map. Strict judgement goes through run-snapshots.mjs.
  */
 export const snapshotMap = (text) => {
-  const map = new Map();
-  for (const row of text.split(/\r?\n/).filter(Boolean)) {
-    const parts = row.split('\t');
-    if (parts.length < 3) continue;
-    map.set(parts.slice(2).join('\t').trim(), `${parts[0]}\t${parts[1]}`);
-  }
-  return map;
+  const snapshot = decodeSnapshot(text);
+  return snapshot.ok ? snapshot.rows : new Map();
 };
 
 /**
- * Paths Codex actually touched, by content rather than by porcelain letter: a file that
- * was already ` M` stays ` M` after further edits, so status codes would report zero
- * work. Line counts (or size, for untracked files) do change.
+ * Tolerant display reader for reply, run-state and write-meta; invalid comparisons display
+ * no changes. Strict judgement goes through run-snapshots.mjs. Snapshot states measure
+ * edits even when a file's porcelain letter stays unchanged.
  */
 export const changedPaths = (before, after) => {
-  const was = snapshotMap(before);
-  const now = snapshotMap(after);
-  const paths = [];
-  for (const [file, state] of now) if (was.get(file) !== state) paths.push(file);
-  // A path that dropped out was touched too: Codex restored it to its committed state.
-  for (const file of was.keys()) if (!now.has(file)) paths.push(file);
-  return paths;
+  const comparison = compareSnapshots(before, after);
+  return comparison.ok ? comparison.changed : [];
 };
 
 /** Directories a delegated build has no business editing, whatever the task says. */

package/src/home/lib/meta/run-snapshots.mjs

@@ -0,0 +1,29 @@
+/**
+ * Read a run's before/after snapshots and compare them strictly.
+ * On 2026-09-30 git-quoted Cyrillic names made an in-scope edit look out of scope;
+ * missing or untrustworthy snapshots must refuse judgement, never imply a clean tree.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { compareSnapshots } from './snapshot-format.mjs';
+
+export function readSnapshot(file) {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+export function runSnapshotChanges(runDir) {
+  return compareSnapshots(
+    readSnapshot(path.join(runDir, 'state-before.txt')),
+    readSnapshot(path.join(runDir, 'state-after.txt')),
+  );
+}
+
+export function snapshotRefusal(comparison) {
+  const issue = comparison.side ? `${comparison.side} ${comparison.issue}` : comparison.issue;
+  return `worktree snapshots cannot be compared (${issue}): ${comparison.detail}`;
+}

package/src/home/lib/meta/snapshot-format.mjs

@@ -0,0 +1,96 @@
+/**
+ * Serialize, validate and compare worktree snapshots; owns the version rule.
+ *
+ * On 2026-09-30 git's quoted Cyrillic names made an in-scope edit look out of scope
+ * and hid a new Cyrillic file. JSON names preserve exact spelling; mixed versions
+ * must refuse comparison rather than repeat that incident.
+ */
+import { parseJsonText } from '../json-file.mjs';
+
+export const SNAPSHOT_V2_HEADER = '# codex-bridge-state-v2';
+
+// `unreadable`: listed but not readable (a Windows file held by another process gives EBUSY/EPERM).
+const STATE_RE = /^(?:\d+\t\d+|-\t-|U\t(?:\d+:[0-9a-fA-F]{64}|missing|unreadable))$/;
+const LEGACY_ROW_RE = /^(?:\d+\t\d+|-\t-|U\t\d+)\t\S.*$/;
+const validState = (state) => typeof state === 'string' && STATE_RE.exec(state)?.[0] === state;
+const malformed = (detail) => ({ ok: false, issue: 'malformed', detail });
+
+export function encodeSnapshot(rows) {
+  const paths = new Set();
+  const ordered = [];
+  for (const row of rows) {
+    if (!row || typeof row.path !== 'string' || !validState(row.state)) {
+      throw new TypeError('Snapshot rows require a string path and a valid v2 state.');
+    }
+    if (paths.has(row.path)) throw new TypeError(`Duplicate snapshot path: ${JSON.stringify(row.path)}`);
+    paths.add(row.path);
+    ordered.push({ path: row.path, state: row.state });
+  }
+  ordered.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return [SNAPSHOT_V2_HEADER, ...ordered.map(({ path, state }) => `${state}\t${JSON.stringify(path)}`)]
+    .join('\n') + '\n';
+}
+
+export function decodeSnapshot(text) {
+  if (text === null) return { ok: false, issue: 'missing', detail: 'Snapshot file is absent.' };
+  if (typeof text !== 'string') return malformed('Snapshot text must be a string or null.');
+  const lines = text.replace(/^\uFEFF/, '').split(/\r?\n/);
+  const version = lines[0] === SNAPSHOT_V2_HEADER ? 2 : 1;
+  if (version === 2) lines.shift();
+  // Only the final line terminator is framing; an empty interior row is damaged data.
+  if (lines.at(-1) === '') lines.pop();
+  const rows = new Map();
+  for (const [index, line] of lines.entries()) {
+    const location = `Snapshot line ${index + (version === 2 ? 2 : 1)}`;
+    let path;
+    let state;
+    if (version === 2) {
+      const fields = line.split('\t');
+      if (fields.length !== 3) return malformed(`${location} must have exactly three tab fields.`);
+      state = `${fields[0]}\t${fields[1]}`;
+      if (!validState(state)) return malformed(`${location} has an invalid v2 state.`);
+      try {
+        path = parseJsonText(location, fields[2]);
+      } catch {
+        return malformed(`${location} has an invalid JSON path.`);
+      }
+      if (typeof path !== 'string') return malformed(`${location} path must be a JSON string.`);
+    } else {
+      // The legacy launcher wrote `${snapshot}\n`, so a clean tree is the text "\n" and the old
+      // reader skipped blank rows. Refusing them failed every build that started on a clean tree.
+      if (line === '') continue;
+      if (!LEGACY_ROW_RE.test(line)) return malformed(`${location} has an invalid legacy row.`);
+      const fields = line.split('\t');
+      state = `${fields[0]}\t${fields[1]}`;
+      path = fields.slice(2).join('\t').trim();
+      if (path.startsWith('"')) {
+        return {
+          ok: false,
+          issue: 'legacy-quoted-name',
+          detail: `${location} contains a git-quoted legacy name whose original spelling is lost.`,
+        };
+      }
+    }
+    if (rows.has(path)) return malformed(`${location} repeats path ${JSON.stringify(path)}.`);
+    rows.set(path, state);
+  }
+  return { ok: true, version, rows };
+}
+
+export function compareSnapshots(beforeText, afterText) {
+  const before = decodeSnapshot(beforeText);
+  if (!before.ok) return { ...before, side: 'before' };
+  const after = decodeSnapshot(afterText);
+  if (!after.ok) return { ...after, side: 'after' };
+  if (before.version !== after.version) {
+    return {
+      ok: false,
+      issue: 'incompatible-versions',
+      detail: 'The run started under another package version; restart the run before comparing snapshots.',
+    };
+  }
+  const changed = [];
+  for (const [path, state] of after.rows) if (before.rows.get(path) !== state) changed.push(path);
+  for (const path of before.rows.keys()) if (!after.rows.has(path)) changed.push(path);
+  return { ok: true, changed };
+}

package/src/home/lib/meta/verdict.mjs

@@ -10,7 +10,6 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {
   SERVICE_RE,
-  changedPaths,
   declaredHits,
   displayPath,
   expandDeclared,
@@ -29,6 +28,8 @@ import { startupGap } from './startup.mjs';
 import { transportGap } from './transport.mjs';
 import { reasonFrom } from './reason.mjs';
 import { adviceGap } from './advice-status.mjs';
+import { compareSnapshots } from './snapshot-format.mjs';
+import { readSnapshot, runSnapshotChanges, snapshotRefusal } from './run-snapshots.mjs';
 
 // How much prose an answer must carry once coordinates and paths are subtracted. Measured
 // on the scout run of 2026-07-30 that replied with a table of `file.ts:60-79` rows: every
@@ -79,16 +80,14 @@ const WRONG_WORK = 'wrong work was done: ';
  */
 export function reportVersusWork(runDir, result, ctx) {
   const declared = (result?.changes || []).flatMap((c) => expandDeclared(c?.file));
-  const after = readText(path.join(runDir, 'state-after.txt'));
+  const comparison = runSnapshotChanges(runDir);
+  const broken = (reason) => ({ ok: false, carried: false, reason });
+  if (!comparison.ok) return broken(snapshotRefusal(comparison));
   // Only the run's own work is compared: a report that names nothing is honest when the sole
   // change in the tree was written by the tooling around the run.
-  const touched = splitRunChanges(
-    runDir,
-    changedPaths(readText(path.join(runDir, 'state-before.txt')), after),
-  ).work;
+  const touched = splitRunChanges(runDir, comparison.changed).work;
   const show = (list) => list.slice(0, 3).join(', ');
   const agreed = (carried = false) => ({ ok: true, carried, reason: null });
-  const broken = (reason) => ({ ok: false, carried: false, reason });
 
   if (!declared.length && !touched.length) return agreed();
   if (!declared.length) {
@@ -110,8 +109,11 @@ export function reportVersusWork(runDir, result, ctx) {
 
   const baseline = chainBaseline(ctx?.runsRoot, ctx?.repo, ctx?.slug, ctx?.taskHash, ctx?.orderId);
   if (baseline !== null) {
-    const accumulated = splitRunChanges(runDir, changedPaths(baseline, after)).work;
-    if (declared.some((d) => declaredHits(d, accumulated))) return agreed(true);
+    const chain = compareSnapshots(baseline, readSnapshot(path.join(runDir, 'state-after.txt')));
+    if (chain.ok) {
+      const accumulated = splitRunChanges(runDir, chain.changed).work;
+      if (declared.some((d) => declaredHits(d, accumulated))) return agreed(true);
+    }
   }
 
   return broken(
@@ -349,13 +351,9 @@ export function resolveStatus({ resultOk, exit, agent, result, runDir, events })
       // Environment writes are subtracted first: attributing them to the run failed an honest
       // pass for a file it never opened. What was subtracted is reported, not swallowed —
       // see the "Environment" line in reply.mjs and environment_changes in meta.json.
-      const { work } = splitRunChanges(
-        runDir,
-        changedPaths(
-          readText(path.join(runDir, 'state-before.txt')),
-          readText(path.join(runDir, 'state-after.txt')),
-        ),
-      );
+      const comparison = runSnapshotChanges(runDir);
+      if (!comparison.ok) return { status: 'FAIL', reason: snapshotRefusal(comparison) };
+      const { work } = splitRunChanges(runDir, comparison.changed);
       const strays = outOfScope(work, patterns);
       if (strays.length) {
         return {

package/src/home/lib/run-config.mjs

@@ -53,7 +53,16 @@ export function readRunConfig(file = CONFIG_PATH) {
   try {
     parsed = readJsonFileSync(file);
   } catch (err) {
-    if (err.code) return { ...DEFAULTS };
+    // Only a missing file means "no config". Every error code used to mean that, so a config the
+    // run could not open (EACCES, EISDIR, EPERM) ran every role on default models with nobody told
+    // (Plan_69 stage 0) — the one reader of an operator file that treated failure as absence.
+    if (err.code === 'ENOENT') return { ...DEFAULTS };
+    if (err.code) {
+      throw new Error(
+        `${file} cannot be read (${err.code}). Fix its permissions or type, or delete it — without it, ` +
+          'the default mode applies: hooks and plugins are disabled.',
+      );
+    }
     throw new Error(
       `${file} cannot be parsed as JSON (${err.cause?.message || err.message}). Fix or delete the file — without it, ` +
         'the default mode applies: hooks and plugins are disabled.',

package/src/home/lib/runner/git-paths.mjs

@@ -0,0 +1,74 @@
+/**
+ * One responsibility: every git call that lists repository paths runs here with `-z` and returns exact names.
+ * On 2026-09-30, quoted octal escapes for areas/tickets-и-notifier.md made scope preflight
+ * refuse both its literal path and an ASCII glob, blocking a vault with Cyrillic file names.
+ */
+import { spawnSync } from 'node:child_process';
+
+function pathRecords(repoRoot, args) {
+  const result = spawnSync(
+    'git',
+    ['-C', repoRoot, ...args],
+    { windowsHide: true, maxBuffer: 64 * 1024 * 1024 },
+  );
+  if (result.error || result.status !== 0) return null;
+
+  let output;
+  try {
+    // A leading BOM can be part of the first name, so decoding must preserve it too.
+    output = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(result.stdout);
+  } catch (cause) {
+    const error = new Error(`Repository ${repoRoot} contains a file name that is not UTF-8`, { cause });
+    error.code = 'ERR_GIT_PATH_NOT_UTF8';
+    throw error;
+  }
+  const names = output.split('\0');
+  if (names.at(-1) === '') names.pop();
+  return names;
+}
+
+export function listRepositoryPaths(repoRoot) {
+  return pathRecords(repoRoot, ['ls-files', '-z', '--cached', '--others', '--exclude-standard']);
+}
+
+export function listUntrackedPaths(repoRoot) {
+  return pathRecords(repoRoot, ['ls-files', '-z', '-o', '--exclude-standard']);
+}
+
+export function numstatRows(repoRoot) {
+  const records = pathRecords(repoRoot, ['diff', 'HEAD', '--numstat', '--no-renames', '-z']);
+  if (records === null) return null;
+  return records.map((record) => {
+    const firstTab = record.indexOf('\t');
+    const secondTab = record.indexOf('\t', firstTab + 1);
+    return {
+      added: record.slice(0, firstTab),
+      deleted: record.slice(firstTab + 1, secondTab),
+      path: record.slice(secondTab + 1),
+    };
+  });
+}
+
+// The owner spells each command whole: a caller that composes path-listing arguments itself is what
+// tests/git-path-listing-guard.test.mjs exists to catch.
+export function diffNames(repoRoot, range) {
+  return pathRecords(repoRoot, ['diff', '--name-only', '-z', range]);
+}
+
+export function commitNames(repoRoot, sha) {
+  return pathRecords(repoRoot, ['show', '--name-only', '--format=', '-z', sha]);
+}
+
+export function porcelainPaths(repoRoot) {
+  const records = pathRecords(repoRoot, ['status', '--porcelain', '-z']);
+  if (records === null) return null;
+  const names = new Set();
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index];
+    names.add(record.slice(3));
+    if (record[0] === 'R' || record[1] === 'R' || record[0] === 'C' || record[1] === 'C') {
+      names.add(records[++index]);
+    }
+  }
+  return [...names];
+}

package/src/home/lib/runner/git-state.mjs

@@ -10,7 +10,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { runsRoot } from './runs-root.mjs';
+import { commitNames, diffNames, listUntrackedPaths, numstatRows, porcelainPaths } from './git-paths.mjs';
+import { encodeSnapshot } from '../meta/snapshot-format.mjs';
 
 export const MAX_LOG = 256 * 1024 * 1024;
 
@@ -32,38 +35,48 @@ export function runsPrefixInside(repo) {
 
 /**
  * State of the worktree in terms of actual content, not porcelain letters: line counts
- * per tracked file plus sizes of untracked ones. A porcelain code stays ` M` when Codex
+ * per tracked file plus content hashes of untracked ones. A porcelain code stays ` M` when Codex
  * edits an already-modified file, so comparing codes would report "0 files changed" for
  * a run that did real work.
  */
 export function worktreeSnapshot(repo) {
   const skip = runsPrefixInside(repo);
-  // The path is the third tab-separated field in both git outputs used here.
-  const mine = (line) => Boolean(skip) && (line.split('\t')[2] || '').startsWith(skip);
   // `--no-renames` because every reader of this snapshot compares paths against a scope: with
   // rename detection on, numstat prints one row spelled `old => new` (or `dir/{a => b}/file`),
   // which is not a path and matches no pattern — an in-scope rename would be judged a stray, and
   // the witness named that token at the orchestrator on 2026-09-20. Without it a rename is a
   // deletion plus an addition: two rows, both real paths, both judged on their own merits.
-  const tracked = (git(repo, ['diff', 'HEAD', '--numstat', '--no-renames']).stdout || '')
-    .split(/\r?\n/)
-    .filter((line) => line.trim() && !mine(line))
-    .join('\n')
-    .trim();
-  const untracked = (git(repo, ['ls-files', '-o', '--exclude-standard']).stdout || '')
-    .split(/\r?\n/)
-    .filter(Boolean)
+  // Plan_73 D4 preserves the existing git-failure meaning: no rows from that listing.
+  const tracked = (numstatRows(repo) ?? [])
+    .filter((row) => !(skip && row.path.startsWith(skip)))
+    .map((row) => ({ path: row.path, state: `${row.added}\t${row.deleted}` }));
+  const untracked = (listUntrackedPaths(repo) ?? [])
     .filter((file) => !(skip && `${file}/`.startsWith(skip)))
-    .map((file) => {
-      let bytes = 0;
-      try {
-        bytes = fs.statSync(path.join(repo, file)).size;
-      } catch {
-        // Vanished between listing and stat: size 0 still marks it as present.
-      }
-      return `U\t${bytes}\t${file}`;
-    });
-  return [tracked, untracked.join('\n')].filter(Boolean).join('\n');
+    .map((file) => ({ path: file, state: untrackedState(path.join(repo, file)) }));
+  return encodeSnapshot([...tracked, ...untracked]);
+}
+
+/**
+ * Size plus sha256 of an untracked file, read in chunks so a large one does not have to fit in
+ * memory. A file that vanished after listing is `missing`; one that cannot be read (on Windows a
+ * file held by another process) is `unreadable` rather than an exception that stops the run.
+ */
+function untrackedState(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+    const hash = createHash('sha256');
+    const chunk = Buffer.alloc(1024 * 1024);
+    let bytes = 0;
+    for (let read; (read = fs.readSync(fd, chunk, 0, chunk.length, null)) > 0; bytes += read) {
+      hash.update(chunk.subarray(0, read));
+    }
+    return `U\t${bytes}:${hash.digest('hex')}`;
+  } catch (error) {
+    return error.code === 'ENOENT' ? 'U\tmissing' : 'U\tunreadable';
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
 }
 
 /**
@@ -94,9 +107,7 @@ export function findFakeDone(repo) {
   const hits = (git(repo, ['diff', '-U0']).stdout || '')
     .split(/\r?\n/)
     .filter((l) => l.startsWith('+') && FAKE_DONE_RE.test(l));
-  for (const file of (git(repo, ['ls-files', '-o', '--exclude-standard']).stdout || '')
-    .split(/\r?\n/)
-    .filter(Boolean)
+  for (const file of (listUntrackedPaths(repo) ?? [])
     // Same reason as in worktreeSnapshot: inside ~/.claude the run folder is part of the
     // worktree, and task.md spells out the very words this scans for ("do not leave TODOs,
     // test.skip"). A run flagged itself for quoting its own instructions.
@@ -123,9 +134,7 @@ export function reviewScope(repo, changeset) {
     return {
       label: `branch changes against base ${base}`,
       diffCommand: `git diff ${base}...HEAD`,
-      files: (git(repo, ['diff', '--name-only', `${base}...HEAD`]).stdout || '')
-        .split(/\r?\n/)
-        .filter(Boolean),
+      files: diffNames(repo, `${base}...HEAD`) ?? [],
     };
   }
   if (changeset.startsWith('commit:')) {
@@ -133,17 +142,12 @@ export function reviewScope(repo, changeset) {
     return {
       label: `commit ${sha}`,
       diffCommand: `git show ${sha}`,
-      files: (git(repo, ['show', '--name-only', '--format=', sha]).stdout || '')
-        .split(/\r?\n/)
-        .filter(Boolean),
+      files: commitNames(repo, sha) ?? [],
     };
   }
   return {
     label: 'uncommitted changes (staged, unstaged, untracked)',
     diffCommand: 'git status --porcelain && git diff HEAD',
-    files: (git(repo, ['status', '--porcelain']).stdout || '')
-      .split(/\r?\n/)
-      .filter(Boolean)
-      .map((l) => l.slice(3).trim()),
+    files: porcelainPaths(repo) ?? [],
   };
 }

package/src/home/lib/runner/launcher.mjs

@@ -327,8 +327,8 @@ export async function launcher(argv = process.argv.slice(2)) {
   if (opts.agent === 'codex-build') {
     fs.writeFileSync(path.join(runDir, 'head-before.txt'), `${isGitRepo ? headSha(repoRoot) : ''}\n`);
     fs.writeFileSync(path.join(runDir, 'branch-before.txt'), `${isGitRepo ? branchName(repoRoot) : ''}\n`);
-    fs.writeFileSync(path.join(runDir, 'git-before.txt'), git(repoRoot, ['status', '--porcelain']).stdout || '');
-    fs.writeFileSync(path.join(runDir, 'state-before.txt'), `${worktreeSnapshot(repoRoot)}\n`);
+    fs.writeFileSync(path.join(runDir, 'git-before.txt'), git(repoRoot, ['-c', 'core.quotepath=false', 'status', '--porcelain']).stdout || '');
+    fs.writeFileSync(path.join(runDir, 'state-before.txt'), worktreeSnapshot(repoRoot));
   }
 
   // The worker's entire order, on disk. Not passed as arguments: the launcher may be gone

package/src/home/lib/runner/preflight.mjs

@@ -70,6 +70,13 @@ export function scopeRunRefusal({ agent, phase, runsRoot, grantRun }) {
 
 /** D2: phase mistakes must refuse before even the sandbox probe can spend quota. */
 export function resolveRunPhase({ agent, phase, continue: isContinue }, budgets) {
+  // OW-040, 2026-09-30: continuing a failed scope spent the order's only continuation and blocked advise.
+  if (agent === 'codex-advisor' && phase === 'scope' && isContinue) {
+    die('codex-advisor --phase scope refuses --continue: a scope pass is never continued, and continuing one ' +
+      "spends the order's single continuation that its advise phase needs. Action: repeat the scope under a new order id " +
+      "without --continue and without a continue: grant, then run advise as that order's continuation. The run folder " +
+      'was not created; quota was not spent.');
+  }
   // Plan_59 D7: phase 2 must retain the scope run's predictions before quota is spent.
   if (agent === 'codex-advisor' && phase === 'advise' && !isContinue) {
     die('codex-advisor --phase advise requires --continue: phase 2 continues the scope run of the same order ' +

package/src/home/lib/runner/prompts.mjs

@@ -4,9 +4,35 @@
  * These are data, not comments: the wording IS the contract a run is graded against, and
  * every rule in it was added by an incident. Keyed by agent name, next to the matching
  * schema in schemas.mjs — one lookup picks both halves of an agent's strategy.
+ * Plan_68 D6 renders array bounds from schemas after recommendation truncations on 2026-09-27
+ * (`…cli/install.mjs:` + U+0000) and 2026-09-28 (`…(docs/plans/Plan_` + `恋`).
  */
 import { DEFAULTS } from '../run-config.mjs';
 import { RUN_ENV } from './run-env.mjs';
+import { advisorSchema, schemaFor } from './schemas.mjs';
+
+function boundedArrayRules(schema, path = '') {
+  if (schema.type === 'object') {
+    return Object.entries(schema.properties ?? {}).flatMap(([name, child]) =>
+      boundedArrayRules(child, path ? `${path}.${name}` : name));
+  }
+  if (schema.type !== 'array') return [];
+
+  const { minItems, maxItems } = schema;
+  const quantity = minItems !== undefined && maxItems !== undefined
+    ? `${minItems}-${maxItems}`
+    : minItems !== undefined ? `at least ${minItems}` : `at most ${maxItems}`;
+  const noun = (maxItems ?? minItems) === 1 ? 'item' : 'items';
+  const ownRule = minItems === undefined && maxItems === undefined
+    ? [] : [`- ${path}: ${quantity} ${noun}`];
+  return [...ownRule, ...boundedArrayRules(schema.items, `${path}[]`)];
+}
+
+function renderArrayBounds(schema) {
+  const rules = boundedArrayRules(schema);
+  return rules.length ? `Output-schema array bounds:\n${rules.join('\n')}` : '';
+}
+
 const BODIES = {
   // Plan_59 D3-D5/D7/D10: independent design advice needs explicit lenses and a risk ledger.
   'codex-advisor': (opts) => {
@@ -27,12 +53,13 @@ Rules for both phases:
   an opinion, not advice. Agreeing is fine when your own checks support it.
 ${opts.phase === 'scope' ? `
 Scope phase:
-- BEFORE reading in depth, name 3-5 predicted_risks with ids r1..r5: where this design most likely
+- BEFORE reading in depth, name predicted_risks with ids r1..r5: where this design most likely
   breaks. Record those predictions first, then read; do not replace them with hindsight.
 - Answer sufficient, missing_paths (concrete repository paths you still need), and taken_on_trust
   (facts accepted from the task without checking, never empty), together with predicted_risks.
 ` : `
 Advise phase:
+- Give a concise, complete recommendation that can stand on its own.
 - Settle every predicted risk listed under \`## Scope phase results\` in risk_outcomes with its
   risk_id, an outcome of confirmed or refuted, a \`note\` explaining it, and evidence.
 - Give ONE recommendation by task option_id, or none-of-these with a described unlisted_option.
@@ -142,5 +169,11 @@ const languageRule = () =>
   `${RUN_ENV?.answerLanguage || DEFAULTS.answerLanguage}, whatever language the task is written in.`;
 
 export const INSTRUCTIONS = Object.fromEntries(
-  Object.entries(BODIES).map(([agent, body]) => [agent, (...args) => `${body(...args)}\n${languageRule()}`]),
+  Object.entries(BODIES).map(([agent, body]) => [agent, (...args) => {
+    const opts = args[0] ?? {};
+    const instructions = body(...args);
+    const schema = agent === 'codex-advisor' ? advisorSchema(opts.phase) : schemaFor(agent);
+    const bounds = renderArrayBounds(schema);
+    return `${instructions}\n${languageRule()}${bounds ? `\n\n${bounds}` : ''}`;
+  }]),
 );

package/src/home/lib/runner/schemas.mjs

@@ -1,6 +1,8 @@
 /**
  * The shape each agent's answer must have, one JSON schema per agent.
  * Plan_59 D10 adds alternatives, rated assumptions, risk outcomes, pre-mortems and open questions.
+ * Plan_68 D6 removes recommendation.text's hidden character cap after the 2026-09-27
+ * `…cli/install.mjs:` + U+0000 and 2026-09-28 `…(docs/plans/Plan_` + `恋` truncation incidents.
  *
  * Handed to `codex exec --output-schema`, so a run that answers in the wrong shape is
  * rejected by Codex itself rather than discovered later by write-meta.mjs. Keyed by agent
@@ -222,7 +224,8 @@ export const PHASE_SCHEMAS = {
           required: ['option_id', 'text'],
           properties: {
             option_id: { type: 'string' },
-            text: { type: 'string', maxLength: 300, pattern: '^[^\\r\\n\\u2028\\u2029]*$' },
+            // Plan_68 D8: the 2026-10-01 runs hit control characters when prose line breaks were banned.
+            text: { type: 'string' },
           },
         },
         unlisted_option: { type: 'string' },