@nodii/dev 0.6.23 → 0.6.24

package/README.md

@@ -298,6 +298,8 @@ style check as a submit (`CHANGE_SET_IMAGE_STYLE`).
 ```bash
 nodii-dev hook claude-figma-pre       # reads Claude Code hook JSON on stdin
 nodii-dev hook claude-figma-post      # reads Claude Code hook JSON on stdin
+nodii-dev hook safety-pre             # silent safety decision; blocks with exit 2
+nodii-dev hook safety-post            # silently records resources created by successful commands
 nodii-dev hook print-settings         # prints managed-settings JSON; writes nothing
 
 nodii-dev lane start KEY --title TEXT --kind dev_fix|new_build|docs_change|uat_fix|prod_fix
@@ -354,6 +356,28 @@ nodii-dev harness check [--json]               # 0 current, 1 differs from Dev,
 nodii-dev harness update --check               # the same check
 ```
 
+`harness install` and `harness update` merge the two safety hooks into
+`.claude/settings.json`; every installed hook invokes only `nodii-dev`. The
+pre-hook blocks edits outside a lane's optional `ownedPaths`, generated UI/API
+files, unsafe Git operations, stale or missing review receipts, lane identity
+changes, production-secret/test-auth bypasses, cleanup of Docker resources the
+run did not create, and deploy/apply commands without an exact grant. Allowed
+calls produce no output.
+
+Until Dev exposes a lane's owned paths (AGENT-HARNESS-10), an edit with no
+ownership field emits a nudge instead of claiming it is safe or blocking an
+unproven violation. Likewise, a deploy with no `NODII_DEV_GO_FILE` source
+nudges for AGENT-HARNESS-13; when the source exists, a missing exact grant is
+blocked. A Compose project whose normalized name is the lane key counts as
+lane-owned, as does a project recorded by a successful `docker compose up`.
+
+`lane review` writes its receipt to private Git metadata, pinning both `HEAD`
+and `origin/main`; it never adds a repository file. Set `NODII_DEV_GO_FILE` to
+the coordinator grant file so an exact `GO deploy <HEAD>` line can authorize a
+deploy. A coordinator's exceptional `--no-verify` also requires
+`NODII_DEV_NO_VERIFY_REASON`; the CLI records the reason in private Git
+metadata. Lanes and subagents can never use `--no-verify`.
+
 ### DS conformance: `design roles` and `design check` (DEC-0034)
 
 Every UI role names exactly one DS component (MW6-14). Resolve your brief's

package/dist/cli.js

@@ -23,6 +23,7 @@ import {
 import { heartbeatCurrentLane, postHook, postHookFailure, preHook, settingsSnippet, workflowSuggestion } from "./hooks.js";
 import { setupCommand } from "./setup.js";
 import { harnessCommand } from "./harness.js";
+import { safetyPostHook, safetyPreHook } from "./safety.js";
 import { doctorCommand } from "./doctor.js";
 import {
   figmaChangeSetShow,
@@ -119,7 +120,7 @@ Usage: nodii-dev <command> [options] [--json]
   figma changeset show CHANGE_SET       # items, variants, round, decision and comment (with the previous round's)
   figma file add FILE_KEY --name TEXT --kind design-system|surfaces|prototype [--module M]
                                         # register a Figma file in Dev so it can be locked
-  hook claude-figma-pre|claude-figma-post|print-settings
+  hook claude-figma-pre|claude-figma-post|safety-pre|safety-post|print-settings
   setup [--yes|--check]                 # dry-run by default
   harness install|update [--include-drafts[=false]] [--adopt PATH,...] [--dry-run]
   harness check                         # 0 current, 1 differs from Dev, 2 not installed
@@ -771,6 +772,31 @@ export async function main(argv = process.argv.slice(2)) {
         );
       }
     }
+    if (action === "safety-pre") {
+      // A malformed or unavailable safety check must not turn into permission.
+      try {
+        const result = await safetyPreHook(JSON.parse(await stdinText()));
+        for (const nudge of result.nudges ?? []) console.log(nudge);
+        return;
+      } catch (error) {
+        throw new CliError(
+          error?.code ?? "SAFETY_HOOK_FAILED",
+          error?.message ?? String(error),
+          2,
+          error?.details,
+        );
+      }
+    }
+    if (action === "safety-post") {
+      try {
+        await safetyPostHook(JSON.parse(await stdinText()));
+      } catch (error) {
+        // A post-hook cannot undo a completed command; report state-tracking
+        // failure without making Claude treat the completed command as failed.
+        console.error(`nodii-dev safety post hook: ${error?.code ?? "ERROR"}: ${error?.message ?? String(error)}`);
+      }
+      return;
+    }
     if (action === "lane-heartbeat") {
       const result = await heartbeatCurrentLane();
       return emit(result, json, result.heartbeated ? `Heartbeat recorded for ${result.key}.` : "No current-branch lane; no heartbeat sent.");

package/dist/core.js

@@ -4,7 +4,7 @@ import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 
-export const VERSION = "0.6.23";
+export const VERSION = "0.6.24";
 export const configPath = () =>
   process.env.NODII_DEV_CONFIG_PATH ??
   join(homedir(), ".config/nodii-dev/config.json");

package/dist/harness.js

@@ -9,6 +9,7 @@ import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join, normalize, sep } from "node:path";
 import { promisify } from "node:util";
 import { CliError, devRequest, query } from "./core.js";
+import { safetySettingsSnippet } from "./safety.js";
 
 /** What this CLI wrote, per path: { mode, sha256 }, or for merge-json the hook entries it `added`. */
 export const STATE_PATH = ".nodii/harness-state.json";
@@ -141,6 +142,30 @@ export function checkHarness(harness) {
   });
 }
 
+// Safety enforcement is executable CLI behaviour, not methodology prose. Add
+// its nodii-dev-only hook entries to the settings fragment Dev generated so a
+// normal harness install/update always installs the matching CLI hooks.
+export function withSafetyHooks(harness) {
+  checkHarness(harness);
+  const copy = { ...harness, files: harness.files.map((file) => ({ ...file })) };
+  let settings = copy.files.find((file) => file.path === ".claude/settings.json");
+  if (!settings) {
+    settings = { path: ".claude/settings.json", mode: "merge-json", kind: "settings", content: "{}" };
+    copy.files.push(settings);
+  }
+  if (settings.mode !== "merge-json")
+    throw new CliError("HARNESS_INVALID", "Dev must generate .claude/settings.json as merge-json so nodii-dev can install safety hooks.", 1);
+  const parsed = JSON.parse(settings.content);
+  const hooks = { ...(parsed.hooks ?? {}) };
+  for (const [event, entries] of Object.entries(safetySettingsSnippet().hooks)) {
+    hooks[event] = [...(hooks[event] ?? [])];
+    for (const entry of entries) if (!hooks[event].some((existing) => stable(existing) === stable(entry))) hooks[event].push(entry);
+  }
+  settings.content = JSON.stringify({ ...parsed, hooks });
+  settings.sha256 = sha(settings.content);
+  return copy;
+}
+
 /**
  * Compare Dev's harness with the repository. `adopt` names existing files the
  * operator lets nodii-dev take over (on install, or when an update adds a file). Returns the planned
@@ -358,12 +383,16 @@ export async function harnessCommand(action, flags, { request = devRequest, cont
   const serviceId = flags.service && flags.service !== true ? String(flags.service) : (saved.serviceId ?? undefined);
   const includeDrafts = flags["include-drafts"] !== undefined ? flags["include-drafts"] !== "false" : Boolean(saved.includeDrafts);
   const params = { repo, serviceId, includeDrafts: includeDrafts ? "true" : undefined };
+  const fetchHarness = async () => {
+    const response = await request("GET", `/api/v1/harness${query(params)}`);
+    return { ...response, data: withSafetyHooks(response.data) };
+  };
 
   if (action === "install" && flags.check) throw new CliError("USAGE", "--check goes with `harness update`; to preview an install use --dry-run.", 2);
   if (action === "check" && (flags["dry-run"] || flags.adopt)) throw new CliError("USAGE", "harness check writes nothing; --dry-run and --adopt go with install and update.", 2);
-  if (action === "check" || (action === "update" && flags.check)) return checkCommand(ctx.root, repo, state, () => request("GET", `/api/v1/harness${query(params)}`));
+  if (action === "check" || (action === "update" && flags.check)) return checkCommand(ctx.root, repo, state, fetchHarness);
 
-  const harness = (await request("GET", `/api/v1/harness${query(params)}`)).data;
+  const harness = (await fetchHarness()).data;
   const plan = await planHarness(ctx.root, harness, { install: action === "install", adopt: flagList(flags.adopt), request: { ...(serviceId ? { serviceId } : {}), includeDrafts } });
   const summary = {
     repo: harness.repo, serviceId: harness.serviceId ?? null,

package/dist/hooks.js

@@ -2,6 +2,7 @@ import { CliError, devRequest } from "./core.js";
 import { FOUNDATIONS_ID, figmaLockCheck, outOfScopeText } from "./figma.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { safetySettingsSnippet } from "./safety.js";
 
 const execFileAsync = promisify(execFile);
 
@@ -177,8 +178,9 @@ export function postHookFailure(error) {
   return { exitCode: 0, message: `nodii-dev post hook: ${error?.code ?? "ERROR"}: ${error?.message ?? String(error)}` };
 }
 
-export const settingsSnippet = () => ({
-  hooks: {
+export const settingsSnippet = () => {
+  const safety = safetySettingsSnippet().hooks;
+  return { hooks: {
     PreToolUse: [
       {
         matcher: "^mcp__(figma|claude_ai_Figma|figma-dev-mode)__.*$",
@@ -186,6 +188,7 @@ export const settingsSnippet = () => ({
           { type: "command", command: "nodii-dev hook claude-figma-pre" },
         ],
       },
+      ...safety.PreToolUse,
     ],
     PostToolUse: [
       {
@@ -194,9 +197,10 @@ export const settingsSnippet = () => ({
           { type: "command", command: "nodii-dev hook claude-figma-post" },
         ],
       },
+      ...safety.PostToolUse,
     ],
-  },
-});
+  } };
+};
 
 export async function heartbeatCurrentLane(request = devRequest) {
   let branch;

package/dist/lanes.js

@@ -1,6 +1,7 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { CliError, encode, devRequest, query, readConfig, requireFlag } from "./core.js";
+import { recordReviewReceipt } from "./safety.js";
 
 const execFileAsync = promisify(execFile);
 const via = { via: "nodii-dev" };
@@ -98,7 +99,7 @@ export async function branchCommits(lane) {
   }
 }
 
-export async function laneCommand(action, args, flags, { request = devRequest, config = readConfig, gitContext = inferGitContext, commitsOf = branchCommits } = {}) {
+export async function laneCommand(action, args, flags, { request = devRequest, config = readConfig, gitContext = inferGitContext, commitsOf = branchCommits, reviewReceipt = recordReviewReceipt } = {}) {
   if (action === "list") {
     const c = flags.mine ? await config() : null;
     const payload = await request("GET", `/api/v1/lanes${query({ kind: flags.kind, status: flags.status, machine: flags.machine, agent: flags.mine ? c.agentId : flags.agent, "waiting-on": flags["waiting-on"], stuck: flags.stuck, cursor: flags.cursor, limit: flags.limit })}`);
@@ -168,7 +169,14 @@ export async function laneCommand(action, args, flags, { request = devRequest, c
     return { payload: await request("POST", `/api/v1/lanes/${encode(id)}/heartbeat`, { ...(flags.note !== undefined ? { note: flags.note } : {}), ...via }), human: `${ref}: heartbeat recorded.` };
   }
   if (action === "land") return { payload: await request("POST", `/api/v1/lanes/${encode(id)}/land`, via), human: `${ref}: recorded on main.` };
-  if (action === "review") return { payload: await request("POST", `/api/v1/lanes/${encode(id)}/review`, via), human: `${ref}: review recorded.` };
+  if (action === "review") {
+    const payload = await request("POST", `/api/v1/lanes/${encode(id)}/review`, via);
+    try { await reviewReceipt(); }
+    catch (error) {
+      throw new CliError("REVIEW_RECEIPT_FAILED", `${ref}: Dev recorded the review, but the local push receipt could not be written (${error?.message ?? error}). Re-run nodii-dev lane review ${ref} from its worktree.`, 1);
+    }
+    return { payload, human: `${ref}: review recorded for the current commit and origin/main.` };
+  }
   if (action === "verify") {
     const value = requireFlag(flags, "dev-check");
     return { payload: await request("POST", `/api/v1/lanes/${encode(id)}/verify`, { ...(URL.canParse(value) ? { url: value } : { ref: value }), ...via }), human: `${ref}: verified on dev.` };

package/dist/safety.js

@@ -0,0 +1,397 @@
+import { execFile } from "node:child_process";
+import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { promisify } from "node:util";
+import { CliError, configPath, devRequest, encode, readConfig } from "./core.js";
+
+const execFileAsync = promisify(execFile);
+const ACTIVE = new Set(["queued", "building", "built", "review", "on_main"]);
+const EDIT_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+const GENERATED_MARK = /(?:do not edit|auto-?generated|generated (?:file|code)|@generated)/i;
+const REVIEW_RECEIPT = "nodii-review-receipt.json";
+const SAFETY_STATE = "nodii-safety-state.json";
+const SAFETY_AUDIT = "nodii-safety-audit.jsonl";
+
+async function optional(path) {
+  try { return await readFile(path, "utf8"); }
+  catch (error) { if (error.code === "ENOENT") return null; throw error; }
+}
+
+async function git(cwd, ...args) {
+  return (await execFileAsync("git", args, { cwd, encoding: "utf8" })).stdout.trim();
+}
+
+async function gitPrivatePath(cwd, name) {
+  return git(cwd, "rev-parse", "--path-format=absolute", "--git-path", name);
+}
+
+const cleanPath = (path) => String(path).split(sep).join("/").replace(/^\.\//, "");
+const quotePattern = (value) => value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+function globPattern(glob) {
+  const source = quotePattern(cleanPath(glob)).replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").replace(/\0/g, ".*");
+  return new RegExp(`^${source}(?:/.*)?$`);
+}
+
+function words(command) {
+  const out = [];
+  const re = /"([^"\\]*(?:\\.[^"\\]*)*)"|'([^']*)'|([^\s]+)/g;
+  for (const match of command.matchAll(re)) out.push(match[1] ?? match[2] ?? match[3]);
+  return out;
+}
+
+function commandHas(tokens, ...sequence) {
+  return tokens.some((_, at) => sequence.every((part, offset) => tokens[at + offset] === part));
+}
+
+function commandAfter(tokens, ...sequence) {
+  const at = tokens.findIndex((_, index) => sequence.every((part, offset) => tokens[index + offset] === part));
+  return at === -1 ? [] : tokens.slice(at + sequence.length);
+}
+
+function composeProject(tokens, cwd) {
+  const after = commandAfter(tokens, "docker", "compose");
+  for (let i = 0; i < after.length; i += 1) {
+    if (["-p", "--project-name"].includes(after[i])) return after[i + 1] ?? null;
+    if (after[i].startsWith("--project-name=")) return after[i].slice("--project-name=".length);
+  }
+  const assigned = tokens.find((x) => x.startsWith("COMPOSE_PROJECT_NAME="));
+  return assigned?.slice("COMPOSE_PROJECT_NAME=".length) || basename(cwd).toLowerCase().replace(/[^a-z0-9_-]/g, "");
+}
+
+function gitInvocations(tokens) {
+  const commands = [];
+  for (let at = 0; at < tokens.length; at += 1) {
+    if (tokens[at] !== "git" && !tokens[at].endsWith("/git")) continue;
+    let cursor = at + 1;
+    while (cursor < tokens.length && tokens[cursor].startsWith("-")) {
+      const option = tokens[cursor];
+      cursor += 1;
+      if (["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"].includes(option)) cursor += 1;
+    }
+    if (tokens[cursor]) commands.push({ verb: tokens[cursor], args: tokens.slice(cursor + 1) });
+  }
+  return commands;
+}
+
+function commandRef(after, verb) {
+  if (!after.length) return null;
+  if (["checkout", "reset"].includes(verb) && after[0] === "--") return null;
+  let skip = false;
+  for (const item of after) {
+    if (skip) { skip = false; continue; }
+    if (["-b", "-B", "--orphan", "--pathspec-from-file"].includes(item)) { skip = true; continue; }
+    if (item.startsWith("-")) continue;
+    return item;
+  }
+  return null;
+}
+
+function createsBranch(after) {
+  return after.some((item) => ["-b", "-B", "-c", "-C", "--orphan", "--create", "--force-create"].includes(item));
+}
+
+const usesNoVerify = (command) => gitInvocations(words(command)).some((x) => x.args.includes("--no-verify"));
+
+function deployCommand(tokens, command) {
+  if (commandHas(tokens, "tofu", "apply")) return true;
+  if (commandHas(tokens, "terraform", "apply")) return true;
+  if (commandHas(tokens, "gh", "workflow", "run")) return /deploy|release|promote/i.test(command);
+  return /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?[^\s]*deploy[^\s]*\b/i.test(command) || /\b(?:make|just)\s+[^\s]*deploy[^\s]*\b/i.test(command);
+}
+
+function volumeNames(tokens) {
+  return commandAfter(tokens, "docker", "volume", "rm").filter((x) => !x.startsWith("-"));
+}
+
+function generatedByPath(path) {
+  const p = cleanPath(path);
+  return /(?:^|\/)(?:components\/ui|__generated__|generated)(?:\/|$)/i.test(p) ||
+    /(?:^|\/)(?:devops-)?openapi\.json$/i.test(p) ||
+    /(?:^|\/)[^/]*(?:\.gen|\.generated)\.[^/]+$/i.test(p);
+}
+
+async function generatedFile(path, context) {
+  const p = cleanPath(path);
+  if (generatedByPath(p) || context.generatedPaths.some((x) => globPattern(x).test(p))) return true;
+  const text = await optional(resolve(context.root, p));
+  return text !== null && GENERATED_MARK.test(text.slice(0, 4096));
+}
+
+function exactDeployGrant(context) {
+  return context.deployGrants.some((x) => x === context.head);
+}
+
+/** Data-dependent checks nudge, rather than silently passing, when their source is not available yet. */
+export function commandNudges(command, context) {
+  const tokens = words(command);
+  const nudges = [];
+  if (deployCommand(tokens, command) && !context.deployGrantKnown)
+    nudges.push("nodii-dev safety: can't verify deploy authorization: no GO grant source is configured (follow-up AGENT-HARNESS-13).");
+  return nudges;
+}
+
+/** Every costly or irreversible shell mistake AGENT-HARNESS-15 blocks. */
+export function commandViolations(command, context) {
+  const tokens = words(command);
+  const gitCommands = gitInvocations(tokens);
+  const violations = [];
+  const lane = context.role !== "coordinator";
+  const block = (code, message) => violations.push({ code, message });
+
+  if (gitCommands.some((x) => x.verb === "stash") && lane)
+    block("SAFETY_GIT_STASH", "git stash is shared by every worktree; lanes and subagents use a work-in-progress commit.");
+
+  for (const verb of ["checkout", "switch"]) {
+    const invocation = gitCommands.find((x) => x.verb === verb);
+    if (!invocation) continue;
+    if (createsBranch(invocation.args)) {
+      block("SAFETY_GIT_BRANCH", `git ${verb} would create and leave the lane branch ${context.branch}.`);
+      continue;
+    }
+    const ref = commandRef(invocation.args, verb);
+    if (ref && ref !== context.branch)
+      block("SAFETY_GIT_BRANCH", `git ${verb} would leave the lane branch ${context.branch}.`);
+  }
+  if (gitCommands.some((x) => x.verb === "add" && x.args.some((arg) => arg === "-A" || arg === "--all")))
+    block("SAFETY_GIT_ADD_ALL", "git add -A/--all can stage work the lane does not own; stage owned paths by name.");
+  const reset = gitCommands.find((x) => x.verb === "reset");
+  if (reset) {
+    const ref = commandRef(reset.args, "reset");
+    if (ref && !/^HEAD(?:[~^].*)?$/.test(ref) && ref !== context.branch)
+      block("SAFETY_GIT_RESET_BRANCH", `git reset onto ${ref} is not allowed from ${context.branch}.`);
+  }
+  if (gitCommands.some((x) => x.verb === "worktree" && x.args[0] === "remove" && x.args.some((arg) => arg === "-f" || arg === "--force")))
+    block("SAFETY_WORKTREE_FORCE", "git worktree remove --force is forbidden; the coordinator removes a proven-safe worktree without --force.");
+
+  if (usesNoVerify(command)) {
+    if (lane) block("SAFETY_NO_VERIFY", "--no-verify is forbidden in a lane or subagent.");
+    else if (!context.noVerifyReason) block("SAFETY_NO_VERIFY_REASON", "A coordinator may use --no-verify only with a recorded reason.");
+  }
+
+  if (gitCommands.some((x) => x.verb === "push")) {
+    const receipt = context.reviewReceipt;
+    if (!receipt) block("SAFETY_REVIEW_REQUIRED", `Push blocked: no review receipt for ${context.head}. Run nodii-dev lane review after the gates are green.`);
+    else if (receipt.commit !== context.head)
+      block("SAFETY_REVIEW_COMMIT", `Push blocked: review covers ${receipt.commit}, not ${context.head}.`);
+    else if (receipt.base !== context.base)
+      block("SAFETY_REVIEW_BASE", `Push blocked: review used base ${receipt.base}, but origin/main is ${context.base}. Re-review the current diff.`);
+  }
+
+  if (lane && /(?:^|[\s/])(?:nodii-dev|@nodii\/dev(?:@[^\s]+)?)\s+(?:login|logout|agent\s+register)(?:\s|$)/.test(command))
+    block("SAFETY_IDENTITY", "A lane never runs nodii-dev login, logout or agent register; ask the coordinator.");
+  if (/\bnodii\/prod(?:\/|\b)/i.test(command))
+    block("SAFETY_PROD_SECRET", "nodii/prod secrets are outside lane authority.");
+  if (/(?:^|[;&|]\s*)(?:(?:export|env)\s+)?NODE_ENV\s*=\s*["']?test\b/i.test(command))
+    block("SAFETY_NODE_ENV_TEST", "NODE_ENV=test disables production-shaped behaviour and is forbidden in lane tests.");
+  if (/(?:--skipAuth\b|\bskipAuth\s*=\s*(?:true|1)\b|["']skipAuth["']\s*:\s*true\b)/i.test(command))
+    block("SAFETY_SKIP_AUTH", "skipAuth is forbidden; real-stack tests keep production authentication on.");
+
+  if (commandHas(tokens, "docker", "compose") && commandAfter(tokens, "docker", "compose").includes("down") && tokens.some((x) => x === "-v" || x === "--volumes")) {
+    const project = composeProject(tokens, context.cwd);
+    if (!project || !context.createdStacks.includes(project))
+      block("SAFETY_COMPOSE_OWNERSHIP", `docker compose down -v is allowed only for a stack this run created${project ? `; ${project} is not recorded as owned` : ""}.`);
+  }
+  if (commandHas(tokens, "docker", "volume", "rm")) {
+    const foreign = volumeNames(tokens).filter((x) => !context.createdVolumes.includes(x));
+    if (!volumeNames(tokens).length || foreign.length)
+      block("SAFETY_VOLUME_OWNERSHIP", `Named-volume deletion is allowed only for volumes this run created${foreign.length ? `; not owned: ${foreign.join(", ")}` : ""}.`);
+  }
+  if (commandHas(tokens, "docker", "volume", "prune"))
+    block("SAFETY_VOLUME_OWNERSHIP", "docker volume prune cannot prove ownership of every volume; remove only a named volume this run created.");
+  if (deployCommand(tokens, command) && context.deployGrantKnown && !exactDeployGrant(context))
+    block("SAFETY_DEPLOY_GRANT", `Deploy/apply blocked: no recorded GO deploy ${context.head} grant.`);
+
+  return violations;
+}
+
+/** Edit-tool ownership and generated-file blocks. */
+export async function editViolations(paths, context) {
+  const violations = [];
+  for (const path of paths) {
+    const absolute = isAbsolute(path) ? resolve(path) : resolve(context.cwd, path);
+    const rel = cleanPath(relative(context.root, absolute));
+    if (rel === ".." || rel.startsWith("../") || isAbsolute(rel)) {
+      violations.push({ code: "SAFETY_EDIT_OUTSIDE_REPO", message: `Edit blocked outside the lane repository: ${path}.` });
+      continue;
+    }
+    if (context.ownedPaths.length && !context.ownedPaths.some((x) => globPattern(x).test(rel))) {
+      violations.push({ code: "SAFETY_EDIT_OUTSIDE_SCOPE", message: `Edit blocked outside the lane's owned paths: ${rel}.` });
+      continue;
+    }
+    if (await generatedFile(rel, context))
+      violations.push({ code: "SAFETY_EDIT_GENERATED", message: `Edit blocked for generated file ${rel}; change its source and regenerate it.` });
+  }
+  return violations;
+}
+
+function editPaths(payload) {
+  const input = payload.tool_input ?? {};
+  return [input.file_path, input.path, input.notebook_path, ...(Array.isArray(input.paths) ? input.paths : [])].filter((x) => typeof x === "string" && x);
+}
+
+async function harnessGenerated(root) {
+  const text = await optional(resolve(root, ".nodii/harness-state.json"));
+  if (!text) return [];
+  try { return Object.keys(JSON.parse(text).files ?? {}); }
+  catch { return [".nodii/harness-state.json"]; }
+}
+
+function laneOwnership(lane, root) {
+  const direct = lane && Object.hasOwn(lane, "ownedPaths");
+  const frozen = lane?.freeze?.boundaries && Object.hasOwn(lane.freeze.boundaries, "ownedPaths");
+  const candidates = direct ? lane.ownedPaths : frozen ? lane.freeze.boundaries.ownedPaths : [];
+  const paths = [candidates].flat().filter((x) => typeof x === "string" && x).map((x) => {
+    if (!isAbsolute(x)) return cleanPath(x);
+    const rel = cleanPath(relative(root, x));
+    return rel.startsWith("../") ? x : rel;
+  });
+  return { known: Boolean(direct || frozen), paths };
+}
+
+const laneStack = (key) => String(key ?? "").toLowerCase().replace(/[^a-z0-9_-]/g, "");
+
+async function currentLane(cwd, request, config) {
+  if (!config?.agentId) return null;
+  const branch = await git(cwd, "branch", "--show-current");
+  const root = await git(cwd, "rev-parse", "--show-toplevel");
+  const lanes = (await request("GET", "/api/v1/lanes?limit=200")).data ?? [];
+  return lanes.find((x) => x.agentId === config.agentId && x.branch === branch && resolve(x.worktree ?? root) === resolve(root) && ACTIVE.has(x.status)) ?? null;
+}
+
+function deployGrantsFrom(text) {
+  return String(text ?? "").split(/\r?\n/).map((line) => /^GO deploy ([0-9a-f]{7,64})\s*$/.exec(line)?.[1]).filter(Boolean);
+}
+
+/** Resolve the facts a hook needs without creating a second lane record. */
+export async function safetyContext(cwd = process.cwd(), { request = devRequest, configReader = readConfig, env = process.env } = {}) {
+  const root = await git(cwd, "rev-parse", "--show-toplevel");
+  const branch = await git(cwd, "branch", "--show-current");
+  const head = await git(cwd, "rev-parse", "HEAD");
+  const base = await git(cwd, "rev-parse", "origin/main");
+  let config = null;
+  try { config = await configReader(false); } catch {}
+  const configuredPath = env.NODII_DEV_CONFIG_PATH ?? configPath();
+  let role = basename(configuredPath).startsWith("lane-") ? "lane" : "unknown";
+  if (role === "unknown" && config?.agentId) {
+    try { role = (await request("GET", `/api/v1/agents/${encode(config.agentId)}`)).data?.role ?? role; } catch {}
+  }
+  let lane = null;
+  try { lane = await currentLane(cwd, request, config); } catch {}
+  const receiptPath = await gitPrivatePath(cwd, REVIEW_RECEIPT);
+  const statePath = await gitPrivatePath(cwd, SAFETY_STATE);
+  const receiptText = await optional(receiptPath);
+  const stateText = await optional(statePath);
+  const reviewReceipt = receiptText ? JSON.parse(receiptText) : null;
+  const state = stateText ? JSON.parse(stateText) : {};
+  const goText = env.NODII_DEV_GO_FILE ? await optional(env.NODII_DEV_GO_FILE) : null;
+  const ownership = laneOwnership(lane, root);
+  const laneProject = laneStack(lane?.key);
+  return {
+    cwd: payloadCwd(cwd), root, branch, head, base, role, lane,
+    ownedPaths: ownership.paths,
+    ownershipKnown: role === "coordinator" || ownership.known,
+    generatedPaths: [...await harnessGenerated(root), ...(state.generatedPaths ?? [])],
+    reviewReceipt,
+    createdStacks: [...new Set([...(state.createdStacks ?? []), ...(laneProject ? [laneProject] : [])])],
+    createdVolumes: state.createdVolumes ?? [],
+    deployGrants: deployGrantsFrom(goText),
+    deployGrantKnown: goText !== null,
+    noVerifyReason: env.NODII_DEV_NO_VERIFY_REASON?.trim() || null,
+  };
+}
+
+const payloadCwd = (cwd) => resolve(cwd);
+
+function blocked(violation) {
+  throw new CliError(violation.code, violation.message, 2);
+}
+
+/** Claude PreToolUse entrypoint. Silent return means allowed. */
+export async function safetyPreHook(payload, contextOrResolver = safetyContext) {
+  const tool = payload.tool_name ?? "";
+  if (tool !== "Bash" && !EDIT_TOOLS.has(tool)) return { allowed: true, ignored: true };
+  const cwd = payload.cwd ?? process.cwd();
+  const context = typeof contextOrResolver === "function" ? await contextOrResolver(cwd) : contextOrResolver;
+  context.cwd = resolve(cwd);
+  if (tool === "Bash") {
+    const command = String(payload.tool_input?.command ?? "");
+    const violation = commandViolations(command, context)[0];
+    if (violation) blocked(violation);
+    if (usesNoVerify(command) && context.role === "coordinator" && context.noVerifyReason)
+      await recordNoVerifyReason(cwd, context.noVerifyReason);
+    return { allowed: true, nudges: commandNudges(command, context) };
+  }
+  const paths = editPaths(payload);
+  if (!paths.length) blocked({ code: "SAFETY_EDIT_PATH_MISSING", message: `Edit blocked: ${tool} supplied no file path.` });
+  const violation = (await editViolations(paths, context))[0];
+  if (violation) blocked(violation);
+  return {
+    allowed: true,
+    nudges: context.role !== "coordinator" && !context.ownershipKnown
+      ? ["nodii-dev safety: can't verify owned paths: the lane has no Dev ownedPaths field yet (follow-up AGENT-HARNESS-10)."]
+      : [],
+  };
+}
+
+async function writeSafetyState(cwd, update) {
+  const path = await gitPrivatePath(cwd, SAFETY_STATE);
+  const before = await optional(path);
+  const state = before ? JSON.parse(before) : {};
+  const next = update({ createdStacks: [], createdVolumes: [], ...state });
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+  return next;
+}
+
+function successful(payload) {
+  const response = payload.tool_response ?? {};
+  const code = response.exitCode ?? response.exit_code ?? response.status;
+  return code === 0 || (code === undefined && response.interrupted === false && response.is_error !== true);
+}
+
+/** Record only successful resource creation; says nothing when satisfied. */
+export async function safetyPostHook(payload) {
+  if (payload.tool_name !== "Bash" || !successful(payload)) return { recorded: false };
+  const command = String(payload.tool_input?.command ?? "");
+  const tokens = words(command);
+  const cwd = payload.cwd ?? process.cwd();
+  if (commandHas(tokens, "docker", "compose") && commandAfter(tokens, "docker", "compose").includes("up")) {
+    const project = composeProject(tokens, cwd);
+    await writeSafetyState(cwd, (state) => ({ ...state, createdStacks: [...new Set([...state.createdStacks, project])] }));
+    return { recorded: true, kind: "stack", name: project };
+  }
+  if (commandHas(tokens, "docker", "volume", "create")) {
+    const name = commandAfter(tokens, "docker", "volume", "create").filter((x) => !x.startsWith("-")).at(-1);
+    if (name) {
+      await writeSafetyState(cwd, (state) => ({ ...state, createdVolumes: [...new Set([...state.createdVolumes, name])] }));
+      return { recorded: true, kind: "volume", name };
+    }
+  }
+  return { recorded: false };
+}
+
+/** Pin the exact commit and origin/main base Dev's review transition covers. */
+export async function recordReviewReceipt(cwd = process.cwd()) {
+  const path = await gitPrivatePath(cwd, REVIEW_RECEIPT);
+  const receipt = {
+    commit: await git(cwd, "rev-parse", "HEAD"),
+    base: await git(cwd, "rev-parse", "origin/main"),
+    recordedAt: new Date().toISOString(),
+  };
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify(receipt, null, 2)}\n`, { mode: 0o600 });
+  return receipt;
+}
+
+/** Record the exceptional coordinator reason without placing it in the repository. */
+export async function recordNoVerifyReason(cwd, reason) {
+  const path = await gitPrivatePath(cwd, SAFETY_AUDIT);
+  await appendFile(path, `${JSON.stringify({ at: new Date().toISOString(), action: "--no-verify", reason })}\n`, { mode: 0o600 });
+}
+
+export const safetySettingsSnippet = () => ({
+  hooks: {
+    PreToolUse: [{ matcher: "^(Bash|Edit|Write|MultiEdit|NotebookEdit)$", hooks: [{ type: "command", command: "nodii-dev hook safety-pre" }] }],
+    PostToolUse: [{ matcher: "^Bash$", hooks: [{ type: "command", command: "nodii-dev hook safety-post" }] }],
+  },
+});

package/dist/setup.js

@@ -1,6 +1,7 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { CliError, checkLogin } from "./core.js";
+import { safetySettingsSnippet } from "./safety.js";
 
 export const SKILL_PATH = ".claude/skills/nodii-build-workflow/SKILL.md";
 const START = "<!-- nodii-dev build workflow:start -->";
@@ -43,11 +44,18 @@ export const managedBlock = `${START}
 Follow [the nodii build workflow skill](${SKILL_PATH}) for all build work. Drive lane state, evidence, heartbeats, landing, dev verification, and Built acknowledgement through \`nodii-dev\`.
 ${END}`;
 
-export const workflowHooks = () => ({
-  SessionStart: [{ hooks: [{ type: "command", command: "nodii-dev lane list --mine --json" }] }],
-  Stop: [{ hooks: [{ type: "command", command: "nodii-dev hook lane-heartbeat" }] }],
-  PostToolUse: [{ matcher: "Bash", hooks: [{ type: "command", command: "nodii-dev hook workflow-post" }] }],
-});
+export const workflowHooks = () => {
+  const safety = safetySettingsSnippet().hooks;
+  return {
+    SessionStart: [{ hooks: [{ type: "command", command: "nodii-dev lane list --mine --json" }] }],
+    Stop: [{ hooks: [{ type: "command", command: "nodii-dev hook lane-heartbeat" }] }],
+    PreToolUse: safety.PreToolUse,
+    PostToolUse: [
+      ...safety.PostToolUse,
+      { matcher: "Bash", hooks: [{ type: "command", command: "nodii-dev hook workflow-post" }] },
+    ],
+  };
+};
 
 const stable = (x) => JSON.stringify(x);
 function mergeHookList(current = [], additions = []) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/dev",
-  "version": "0.6.23",
+  "version": "0.6.24",
   "description": "Agent CLI for Nodii Dev, reached through the platform edge",
   "type": "module",
   "bin": {