@nodii/dev 0.6.36 → 0.6.37

package/README.md

@@ -327,6 +327,29 @@ nodii-dev hook nudge-pre              # guideline nudges before a tool call; nev
 nodii-dev hook nudge-stop             # guideline nudges when a lane session stops; asks once
 nodii-dev figma checked CS-n --unused-properties --stale-placeholders --dialog-body
 nodii-dev hook print-settings         # prints managed-settings JSON; writes nothing
+```
+
+`hook safety-pre` (installed by `harness install` for Claude Code and Codex)
+blocks, silently when satisfied (AGENT-HARNESS-15):
+
+- **Everyone, in a lane or not:** pattern kills (`pkill`, `killall`,
+  `kill $(pgrep …)`, `ps … | xargs kill`, `kill -1`). Kill only a PID you
+  started and saved.
+- **In a lane:** `git stash`; checking out or creating another branch;
+  `git add -A`; `git reset` onto another branch; `git worktree remove --force`;
+  a force push (`-f`, `--force`, `--force-with-lease`, `+ref`); a push without
+  a review receipt for HEAD and origin/main; `--no-verify` and its aliases
+  (`LEFTHOOK=0`, `HUSKY=0`, `core.hooksPath`); `nodii-dev login`, `logout`,
+  `agent register`; `nodii/prod` secrets, `NODE_ENV=test`, `skipAuth`;
+  `docker compose down -v` or volume deletes on stacks the run didn't create;
+  deploy/apply without a `GO deploy <sha>` grant; shell writes outside the
+  worktree (redirects, `tee`, `cp`, `mv`, `rm`, `mkdir`, `touch` …; temp space
+  is fine) and mutating `git -C` into another checkout; Edit/Write outside the
+  worktree, outside owned paths or on generated files.
+- **A coordinator** may use `--no-verify` only with `NODII_DEV_NO_VERIFY_REASON`
+  set; the reason is recorded in private Git metadata.
+
+```bash
 
 nodii-dev lane start KEY --title TEXT --kind dev_fix|new_build|docs_change|uat_fix|prod_fix
                      --side backend|frontend|both [--repo REPO] [--issue ISSUE]
@@ -996,9 +1019,15 @@ nodii-dev requests resolve UUID --commit-sha abc1234 --resolution-md "shipped"
 nodii-dev open-questions answer UUID --decision-id D1420
 ```
 
-The CLI bundles Dev's OpenAPI document as the edge routes it (the edge does not
-serve Dev's own document), so `api list` works offline and lists only
-operations the edge exposes. The first-class resource families cover every tag: services,
+`api` and the resource commands read Dev's live catalog through the edge
+(`GET /devops/api/v1/openapi.json`), so an operation Dev adds after a CLI
+release is callable at once. The catalog is cached for 15 minutes in
+`~/.cache/nodii-dev/api-catalog.json` (`NODII_DEV_API_CATALOG_CACHE`),
+stamped with Dev's version and the document's sha256. When Dev cannot be read
+the CLI uses the last good copy, else the OpenAPI document bundled at release
+(the edge's routes only, so it works offline). `api catalog [--refresh]` shows
+which one is in use and why; `NODII_DEV_API_CATALOG=bundled` never asks Dev.
+The first-class resource families cover every tag: services,
 feature docs, contracts (gRPC, REST, outbox, sagas, tables), libraries,
 workers, projects, slices, SQL lookups, issues, backlogs, builds, changes,
 runtime, people, agents, inbox/gates, design, runbooks,

package/dist/api.js

@@ -1,16 +1,102 @@
-import { readFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 import { stdin } from "node:process";
-import { CliError, devRawRequest, encode } from "./core.js";
+import { CliError, VERSION, devExchange, devRawRequest, encode, readConfig } from "./core.js";
 
 const methods = new Set(["get", "post", "put", "patch", "delete", "head", "options"]);
-// The Dev API as the platform edge routes it, bundled with the package (the
-// edge does not serve Dev's own document). Refresh: `npm run openapi:snapshot`.
+// The Dev API as the platform edge routes it, bundled with the package: the
+// fallback when Dev's live catalog cannot be read. Refresh: `npm run openapi:snapshot`.
 let bundled;
 export async function loadOpenApi() {
   bundled ??= JSON.parse(await readFile(new URL("./devops-openapi.json", import.meta.url), "utf8"));
   return bundled;
 }
 
+// Dev issue 99: an operation Dev added after this release is still callable.
+// The live catalog is read through the edge, cached for CATALOG_TTL_MS per
+// edge and stamped with Dev's version and the document's sha256. A refused or
+// malformed read is cached too, so a Dev without the route costs one request
+// per TTL. Unreachable or signed out: the last good copy, else the bundled one.
+export const LIVE_CATALOG_PATH = "/api/v1/openapi.json";
+export const CATALOG_TTL_MS = 15 * 60 * 1000;
+const CATALOG_TIMEOUT_MS = 4000;
+const TRANSIENT = new Set(["DEV_UNREACHABLE", "DEV_TIMEOUT", "NOT_LOGGED_IN", "LOGIN_REQUIRED", "OAUTH_LOGIN_REQUIRED", "KEYCHAIN_UNAVAILABLE"]);
+export const catalogCachePath = (env = process.env) =>
+  env.NODII_DEV_API_CATALOG_CACHE || join(homedir(), ".cache", "nodii-dev", "api-catalog.json");
+
+const isSpec = (value) => value && typeof value === "object" && typeof value.openapi === "string" && value.paths && typeof value.paths === "object";
+// Only Dev's own API is reachable through the edge's /devops prefix.
+const edgeReachable = (spec) => ({ ...spec, paths: Object.fromEntries(Object.entries(spec.paths).filter(([path]) => path.startsWith("/api/v1/"))) });
+
+async function readCache(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+async function writeCache(path, value) {
+  try {
+    await mkdir(dirname(path), { recursive: true });
+    const tmp = `${path}.${process.pid}.tmp`;
+    await writeFile(tmp, JSON.stringify(value), { mode: 0o600 });
+    await rename(tmp, path);
+  } catch {
+    // A cache that cannot be written only costs a refetch next time.
+  }
+}
+
+const bundledCatalog = async (reason) => ({ spec: await loadOpenApi(), source: "bundled", version: `@nodii/dev ${VERSION}`, reason });
+const cachedCatalog = (good, source, reason) => ({ spec: good.spec, source, version: good.version, sha256: good.sha256, fetchedAt: good.fetchedAt, reason });
+
+/**
+ * The operation catalog: `{ spec, source: live|cache|stale|bundled, version, sha256?, fetchedAt?, reason? }`.
+ * NODII_DEV_API_CATALOG=bundled skips Dev; `refresh` ignores the TTL.
+ */
+export async function loadCatalog({ refresh = false, env = process.env, now = Date.now() } = {}) {
+  if (env.NODII_DEV_API_CATALOG === "bundled") return bundledCatalog("NODII_DEV_API_CATALOG=bundled");
+  const config = await readConfig(false).catch(() => null);
+  if (!config?.edgeUrl) return bundledCatalog("not signed in");
+  const path = catalogCachePath(env);
+  const cache = await readCache(path);
+  const mine = cache?.edgeUrl === config.edgeUrl ? cache : null;
+  const fresh = mine && now - Date.parse(mine.checkedAt) < CATALOG_TTL_MS;
+  if (fresh && !refresh)
+    return mine.failure
+      ? mine.good ? cachedCatalog(mine.good, "stale", mine.failure) : bundledCatalog(mine.failure)
+      : cachedCatalog(mine.good, "cache");
+
+  let failure;
+  try {
+    const { payload } = await devExchange("GET", LIVE_CATALOG_PATH, undefined, { signal: AbortSignal.timeout(CATALOG_TIMEOUT_MS) });
+    if (!isSpec(payload)) failure = `Dev's ${LIVE_CATALOG_PATH} is not an OpenAPI document`;
+    else {
+      const spec = edgeReachable(payload);
+      const sha256 = createHash("sha256").update(JSON.stringify(spec)).digest("hex");
+      const good = { spec, version: `Dev ${payload.info?.version ?? "unknown"}`, sha256, fetchedAt: new Date(now).toISOString() };
+      await writeCache(path, { edgeUrl: config.edgeUrl, checkedAt: good.fetchedAt, good, failure: null });
+      return cachedCatalog(good, "live");
+    }
+  } catch (error) {
+    const reason = `${error?.code ?? "ERROR"}: ${error?.message ?? String(error)}`;
+    // Signed out, offline, timed out or a 5xx says nothing about the route: not cached.
+    if (TRANSIENT.has(error?.code) || /^HTTP_5\d\d$/.test(error?.code ?? "") || !(error instanceof CliError))
+      return mine?.good ? cachedCatalog(mine.good, "stale", reason) : bundledCatalog(reason);
+    failure = reason;
+  }
+  await writeCache(path, { edgeUrl: config.edgeUrl, checkedAt: new Date(now).toISOString(), good: mine?.good ?? null, failure });
+  return mine?.good ? cachedCatalog(mine.good, "stale", failure) : bundledCatalog(failure);
+}
+
+export function describeCatalog(catalog) {
+  const stamp = [catalog.version, catalog.sha256 && `sha256 ${catalog.sha256.slice(0, 12)}`, catalog.fetchedAt && `fetched ${catalog.fetchedAt}`].filter(Boolean).join(", ");
+  const why = catalog.reason ? `; live catalog unavailable: ${catalog.reason}` : "";
+  return `catalog: ${catalog.source} (${stamp})${why}`;
+}
+
 export function operationsFrom(spec) {
   const out = [];
   for (const [path, item] of Object.entries(spec.paths ?? {}))

package/dist/cli.js

@@ -67,7 +67,8 @@ import {
   findFirstClass,
   flagsToOperation,
   refusePersonOnly,
-  loadOpenApi,
+  describeCatalog,
+  loadCatalog,
   operationsFrom,
   parseParams,
   readBody,
@@ -111,7 +112,7 @@ Usage: nodii-dev <command> [options] [--json]
                                         # blocked and wont_do need --reason; done needs --dev-check
   inbox list|show
   drift file | request file
-  decisions list|get|search
+  decisions list|get|search             # get DEC-n reads the AD decision with its amends
   design entries|entry|guide
   design guideline list [--drafted] [--all] | show ENTRY
   design guideline propose ENTRY --file FILE.md [--summary TEXT] [--dry-run]
@@ -232,6 +233,9 @@ Usage: nodii-dev <command> [options] [--json]
 
   api list [--tag TAG]                  # staff-only operations are marked (ratifyAdDocument:
                                         # agents get OPERATOR_REQUIRED by design)
+  api catalog [--refresh]               # which catalog api and resource commands use: Dev's live one
+                                        # (cached 15 min, version + sha256 stamped) or the bundled
+                                        # fallback, and why; NODII_DEV_API_CATALOG=bundled skips Dev
   api <operationId> [--param k=v] [--body @file|-|JSON]
   <resource> <action> [ID ...] [--field VALUE]
 
@@ -560,8 +564,14 @@ export async function main(argv = process.argv.slice(2)) {
   const [command, action, ...rest] = args;
   if (!command || f.help || command === "help") return console.log(HELP);
   if (command === "api") {
-    const operations = operationsFrom(await loadOpenApi());
+    const catalog = await loadCatalog({ refresh: action === "catalog" && f.refresh === true });
+    const operations = operationsFrom(catalog.spec);
+    if (action === "catalog") {
+      const { spec: _spec, ...stamp } = catalog;
+      return emit({ ...stamp, operations: operations.length }, json, `${describeCatalog(catalog)}\n${operations.length} operations`);
+    }
     if (action === "list") {
+      if (!json) console.error(`# ${describeCatalog(catalog)}`);
       const selected = f.tag === undefined || f.tag === true
         ? operations
         : operations.filter((x) => x.tags.some((t) => t.toLowerCase() === String(f.tag).toLowerCase()));
@@ -570,7 +580,7 @@ export async function main(argv = process.argv.slice(2)) {
     }
     if (!action) throw new CliError("USAGE", "api needs an operationId or list", 2);
     const entry = operations.find((x) => x.operationId === action);
-    if (!entry) throw new CliError("UNKNOWN_OPERATION", `No OpenAPI operationId: ${action}`, 2);
+    if (!entry) throw new CliError("UNKNOWN_OPERATION", `No OpenAPI operationId: ${action} (${describeCatalog(catalog)})`, 2);
     refusePersonOnly(entry.operationId);
     const parsed = await readBody(f.body);
     const request = buildOperationRequest(entry, parseParams(f.param), parsed?.value);
@@ -832,6 +842,21 @@ export async function main(argv = process.argv.slice(2)) {
     f.requestHash = requestHash({ toService: f.toService, kind: requireFlag(f, "kind"), specMd });
   }
   if (command === "decisions") {
+    // A DEC-* id is an AD-era decision: getAdDecision carries its amends; the
+    // pre-dev /decisions route knows none of them.
+    if (action === "get" && /^DEC-\d+$/i.test(rest[0] ?? ""))
+      return emit(
+        await devRequest("GET", `/api/v1/ad-decisions/${encode(rest[0].toUpperCase())}`),
+        json,
+        ({ data: d }) => [
+          `${d.id}\t${d.status}\t${d.title}`,
+          ...(d.ruling ? ["", d.ruling] : []),
+          "",
+          d.amends?.length
+            ? `Amends (${d.amends.length}):\n${d.amends.map((a) => `  ${a.clauseId ?? a.docCode}\t${a.effect}\t${a.docCode} ${a.previousVersion ?? "-"} -> ${a.version}${a.documentTitle ? `\t${a.documentTitle}` : ""}`).join("\n")}`
+            : "Amends: none",
+        ].join("\n"),
+      );
     if (action === "get")
       return emit(
         await devRequest("GET", `/api/v1/decisions/${encode(rest[0])}`),
@@ -1084,7 +1109,8 @@ export async function main(argv = process.argv.slice(2)) {
     }
   }
   if (Object.hasOwn(GROUPS, command)) {
-    const operations = operationsFrom(await loadOpenApi());
+    const catalog = await loadCatalog();
+    const operations = operationsFrom(catalog.spec);
     let entry = findFirstClass(operations, command, action);
     if (command === "drift" && action === "resolve" && f.status === "accepted-as-canonical")
       entry = operations.find((x) => x.operationId === "acceptDrift");
@@ -1099,7 +1125,7 @@ export async function main(argv = process.argv.slice(2)) {
     if (!entry) {
       const tags = Array.isArray(GROUPS[command]) ? GROUPS[command] : [GROUPS[command]];
       const available = operations.filter((x) => x.tags.some((t) => tags.includes(t))).map((x) => x.operationId).join(", ");
-      throw new CliError("USAGE", `Unknown ${command} action: ${action}. OpenAPI operations: ${available}`, 2);
+      throw new CliError("USAGE", `Unknown ${command} action: ${action}. OpenAPI operations: ${available} (${describeCatalog(catalog)})`, 2);
     }
     const built = flagsToOperation(entry, rest, f);
     if (command === "requests" && action === "answer")

package/dist/core.js

@@ -4,7 +4,7 @@ import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 
-export const VERSION = "0.6.36";
+export const VERSION = "0.6.37";
 export const configPath = () =>
   process.env.NODII_DEV_CONFIG_PATH ??
   join(homedir(), ".config/nodii-dev/config.json");

package/dist/nodii-dev.js

@@ -2,6 +2,9 @@
 import { fail, main } from "./cli.js";
 import { regroundCurrentLane, shouldReground } from "./freeze.js";
 import { isHookDenial } from "./hooks.js";
+import { drainStdout, routeStdout } from "./stdout.js";
+
+routeStdout();
 
 // Hooks run in the agent's environment, which may be incomplete or may not be
 // a git worktree. An unavailable hook must never turn into a refused tool call.
@@ -16,11 +19,13 @@ async function run() {
   await main(argv);
 }
 
-run().catch((error) => {
-  const denial = isHookDenial(error?.code);
-  if (argv[0] === "hook" && !denial) {
-    process.exitCode = 0;
-    return;
-  }
-  fail(error);
-});
+run()
+  .catch((error) => {
+    const denial = isHookDenial(error?.code);
+    if (argv[0] === "hook" && !denial) {
+      process.exitCode = 0;
+      return;
+    }
+    fail(error);
+  })
+  .finally(drainStdout);

package/dist/safety.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import { appendFile, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { CliError, configPath, devRequest, encode, readConfig } from "./core.js";
@@ -109,7 +110,103 @@ function createsBranch(after) {
   return after.some((item) => ["-b", "-B", "-c", "-C", "--orphan", "--create", "--force-create"].includes(item));
 }
 
-const usesNoVerify = (command) => gitInvocations(words(command)).some((x) => x.args.includes("--no-verify"));
+// A hook bypass by another name is still --no-verify: lefthook's and husky's
+// off switches, and pointing Git's hooks somewhere else.
+const HOOK_BYPASS = /(?:^|[\s;&|(])(?:export\s+|env\s+)?(?:LEFTHOOK\s*=\s*["']?(?:0|false|off)\b|HUSKY\s*=\s*["']?0\b)|\bcore\.hooks[Pp]ath\b/;
+const usesNoVerify = (command) => gitInvocations(words(command)).some((x) => x.args.includes("--no-verify")) || HOOK_BYPASS.test(command);
+
+// Operator, 29 Oct: a pattern kill on macOS once killed every agent on the
+// machine. Only a PID the caller started (and saved) may be killed.
+const AT_COMMAND = String.raw`(?:^|[;&|(\x60{\n]|\$\()\s*(?:(?:sudo|exec|nohup|time|command)(?:\s+-\S+)*\s+)*`;
+const PATTERN_KILLS = [
+  new RegExp(`${AT_COMMAND}(?:\\S*/)?(?:pkill|killall)\\b`),
+  /(?:^|[;&|(\s])kill\b[^;&|\n]*(?:\$\(|`)\s*(?:\S*\/)?(?:pgrep|pidof|ps|lsof|jobs)\b/,
+  /\b(?:pgrep|pidof|ps|lsof)\b[^;&\n]*\|(?:[^;&\n]*\|)?\s*xargs\b[^;&|\n]*\bkill\b/,
+  /(?:^|[;&|(\s])kill\s+(?:-(?:\d+|[A-Z]+|s\s+\S+)\s+)*(?:--\s+)?-1\b/,
+];
+
+/** Blocks that hold for every caller, in a lane or not, and before any lane discovery. */
+export function machineViolations(command) {
+  if (PATTERN_KILLS.some((pattern) => pattern.test(command)))
+    return [{ code: "SAFETY_PATTERN_KILL", message: "Pattern kills (pkill, killall, kill $(pgrep ...), ps | xargs kill, kill -1) can kill every agent on this machine. Kill only a PID you started and saved to a .pid file." }];
+  return [];
+}
+
+function forcePush(invocation) {
+  if (invocation.verb !== "push") return false;
+  return invocation.args.some((arg) => ["-f", "--force", "--force-if-includes", "--mirror"].includes(arg) || arg.startsWith("--force-with-lease") || /^-[a-zA-Z]*f[a-zA-Z]*$/.test(arg) || /^\+[^\s]/.test(arg));
+}
+
+// Writes a lane may make outside its worktree: temporary and scratch space.
+const WRITABLE_ELSEWHERE = () => [tmpdir(), "/tmp", "/private/tmp", "/var/folders", "/private/var/folders", "/dev/null", "/dev/stdout", "/dev/stderr", "/dev/fd", "/dev/tty"];
+const WRITE_COMMANDS = new Map([["cp", "last"], ["mv", "last"], ["ln", "last"], ["install", "last"], ["rsync", "last"], ["rm", "all"], ["rmdir", "all"], ["touch", "all"], ["mkdir", "all"], ["truncate", "all"], ["chmod", "rest"], ["chown", "rest"], ["tee", "all"]]);
+const READ_ONLY_GIT = new Set(["status", "diff", "log", "show", "rev-parse", "rev-list", "branch", "ls-files", "ls-tree", "cat-file", "describe", "blame", "grep", "merge-base", "config", "remote", "fetch", "worktree", "for-each-ref", "symbolic-ref", "shortlog", "reflog", "name-rev", "check-ignore", "var", "help", "version"]);
+
+/** Shell words with their quoting kept, split on control operators, for write detection. */
+function segments(command) {
+  const out = [[]];
+  const re = /"((?:[^"\\]|\\.)*)"|'([^']*)'|(&&|\|\||[;|\n])|([^\s"';|&]+(?:&(?![&])[^\s"';|&]*)*)|(&)/g;
+  for (const match of command.matchAll(re)) {
+    if (match[3] || match[5]) out.push([]);
+    else out.at(-1).push({ text: match[1] ?? match[2] ?? match[4], quoted: match[4] === undefined });
+  }
+  return out.filter((x) => x.length);
+}
+
+function writeTargets(command) {
+  const targets = [];
+  for (const segment of segments(command)) {
+    for (let i = 0; i < segment.length; i += 1) {
+      const { text, quoted } = segment[i];
+      if (quoted) continue;
+      const redirect = /^(?:\d*|&)>{1,2}\|?(.*)$/.exec(text);
+      if (redirect) {
+        const target = redirect[1] || segment[i + 1]?.text;
+        if (target && !target.startsWith("&")) targets.push(target);
+      }
+    }
+    const words = segment.filter((x, i) => !(i === 0 && /^[A-Z_][A-Z0-9_]*=/.test(x.text)));
+    const at = words.findIndex((x) => !["sudo", "command", "exec", "nohup"].includes(x.text));
+    const name = basename(words[at]?.text ?? "");
+    const mode = WRITE_COMMANDS.get(name);
+    if (!mode) continue;
+    const args = words.slice(at + 1).map((x) => x.text).filter((x) => !x.startsWith("-") && !/^\d*>/.test(x));
+    if (mode === "last") targets.push(...args.slice(-1));
+    else if (mode === "rest") targets.push(...args.slice(1));
+    else targets.push(...args);
+  }
+  return targets;
+}
+
+function outsideWorktree(target, context, relativeKnown) {
+  let path = target;
+  if (path === "~" || path.startsWith("~/")) path = join(homedir(), path.slice(1));
+  else if (/^\$\{?HOME\}?(?:\/|$)/.test(path)) path = join(homedir(), path.replace(/^\$\{?HOME\}?/, ""));
+  if (path.includes("$") || path.includes("`")) return false;
+  if (!isAbsolute(path)) {
+    if (!relativeKnown) return false;
+    path = resolve(context.cwd, path);
+  }
+  const inside = (root) => { const rel = relative(root, path); return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel)); };
+  return !inside(context.root) && !WRITABLE_ELSEWHERE().some(inside);
+}
+
+function gitOutsideWorktree(tokens, context) {
+  for (let at = 0; at < tokens.length; at += 1) {
+    if (tokens[at] !== "git" && !tokens[at].endsWith("/git")) continue;
+    let cursor = at + 1;
+    let target = null;
+    while (cursor < tokens.length && tokens[cursor].startsWith("-")) {
+      const option = tokens[cursor];
+      if (["-C", "--git-dir", "--work-tree"].includes(option)) target = tokens[cursor + 1] ?? null;
+      else if (/^--(?:git-dir|work-tree)=/.test(option)) target = option.slice(option.indexOf("=") + 1);
+      cursor += ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"].includes(option) ? 2 : 1;
+    }
+    const verb = tokens[cursor];
+    if (target && verb && !READ_ONLY_GIT.has(verb) && outsideWorktree(target, context, true)) return { target, verb };
+  }
+  return null;
+}
 
 function deployCommand(tokens, command) {
   if (commandHas(tokens, "tofu", "apply")) return true;
@@ -189,6 +286,16 @@ export function commandViolations(command, context) {
   }
   if (gitCommands.some((x) => x.verb === "worktree" && x.args[0] === "remove" && x.args.some((arg) => arg === "-f" || arg === "--force")))
     block("SAFETY_WORKTREE_FORCE", "git worktree remove --force is forbidden; the coordinator removes a proven-safe worktree without --force.");
+  if (gitCommands.some(forcePush))
+    block("SAFETY_FORCE_PUSH", "A force push rewrites history others may hold; a lane pushes fast-forward only. Ask the coordinator.");
+  if (context.root) {
+    const other = gitOutsideWorktree(tokens, context);
+    if (other) block("SAFETY_OTHER_WORKTREE", `git ${other.verb} in ${other.target} touches a checkout outside this lane's worktree ${context.root}.`);
+    const relativeKnown = !/(?:^|[;&|(\s])(?:cd|pushd)\s/.test(command);
+    const outside = writeTargets(command).filter((target) => outsideWorktree(target, context, relativeKnown));
+    if (outside.length)
+      block("SAFETY_WRITE_OUTSIDE_WORKTREE", `Write blocked outside the lane worktree ${context.root}: ${[...new Set(outside)].join(", ")}. Use the worktree or a temp/scratch directory.`);
+  }
 
   if (usesNoVerify(command)) {
     if (lane) block("SAFETY_NO_VERIFY", "--no-verify is forbidden in a lane or subagent.");
@@ -387,6 +494,10 @@ function blocked(violation) {
 export async function safetyPreHook(payload, contextOrResolver = safetyContext) {
   const tool = payload.tool_name ?? "";
   if (!SHELL_TOOLS.has(tool) && !EDIT_TOOLS.has(tool)) return { allowed: true, ignored: true };
+  if (SHELL_TOOLS.has(tool)) {
+    const machine = machineViolations(String(payload.tool_input?.command ?? ""))[0];
+    if (machine) blocked(machine);
+  }
   const cwd = payload.cwd ?? process.cwd();
   const context = typeof contextOrResolver === "function" ? await contextOrResolver(cwd) : contextOrResolver;
   context.cwd = await realpath(cwd).catch(() => resolve(cwd));

package/dist/stdout.js

@@ -0,0 +1,26 @@
+import { format } from "node:util";
+
+// Dev issue 37: on Bun, once any module imports from `node:process`,
+// console.log to a pipe stops at 65,536 bytes and the rest is lost at exit, so
+// a large `--json` reached `jq` cut off. process.stdout.write delivers it all.
+// The executable routes console.log through it and waits for the stream to
+// drain before it returns. A reader that closes early (`| head -c`) is not an
+// error.
+let installed = false;
+
+export function routeStdout(stream = process.stdout) {
+  if (installed) return;
+  installed = true;
+  stream.on("error", (error) => {
+    if (error?.code !== "EPIPE") throw error;
+    stream.destroy();
+  });
+  console.log = (...values) => {
+    if (!stream.destroyed) stream.write(`${format(...values)}\n`);
+  };
+}
+
+export function drainStdout(stream = process.stdout) {
+  if (stream.destroyed || !stream.writable) return Promise.resolve();
+  return new Promise((resolve) => stream.write("", () => resolve()));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/dev",
-  "version": "0.6.36",
+  "version": "0.6.37",
   "description": "Agent CLI for Nodii Dev, reached through the platform edge",
   "type": "module",
   "bin": {