@nurix/nustack 0.23.11 → 0.23.13

package/dist/commands/check.js

@@ -0,0 +1,73 @@
+import path from "node:path";
+import { resolveRepository } from "../lib/git-sync/core/repository.js";
+import { loadHarness } from "../lib/harness/vendor.js";
+import { readStoreDocumentationWaivers } from "../lib/harness/storeWaivers.js";
+import { runHookMode } from "../lib/harness/hookEntry.js";
+import { readProjectContract } from "../lib/project_contract.js";
+import { NUSTACK_JSON_VERSION } from "../lib/json_output.js";
+export const CHECK_EXIT = { PASS: 0, FAILED: 1, CANNOT_RUN: 2 };
+const COMMAND = "check";
+function cannotRun(json, rule, code, message) {
+    if (json)
+        console.log(JSON.stringify({ nustackJsonVersion: NUSTACK_JSON_VERSION, command: COMMAND, ok: false, error: { code, message }, data: { rule, verdict: null, findings: [] } }));
+    else
+        console.error(message);
+    process.exitCode = CHECK_EXIT.CANNOT_RUN;
+}
+function rootOf(dir) {
+    try {
+        return resolveRepository(dir).repositoryRoot;
+    }
+    catch {
+        return dir;
+    }
+}
+export async function runCheck(rule, options) {
+    if (options.hook !== undefined) {
+        await runHookMode(options.hook, options.protection === true);
+        return;
+    }
+    const json = options.json === true;
+    if (!rule) {
+        cannotRun(json, null, "VALIDATION_FAILED", "Name a rule: `nustack check <rule>`, or pass `--hook <event>`.");
+        return;
+    }
+    let rules;
+    let rulesNode;
+    try {
+        rules = await loadHarness("rules");
+        rulesNode = await loadHarness("rulesNode");
+    }
+    catch (error) {
+        cannotRun(json, rule, "HARNESS_UNAVAILABLE", `The rule library did not load: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+    }
+    if (!rules.isRuleId(rule)) {
+        cannotRun(json, rule, "UNKNOWN_RULE", `Unknown rule \`${rule}\`; this CLI serves ${rules.RULE_IDS.join(", ")}.`);
+        return;
+    }
+    const root = rootOf(path.resolve(process.cwd()));
+    let result;
+    try {
+        const waivers = rulesNode.readBookkeepingWaivers(root);
+        if (rule === "bookkeeping") {
+            const contract = await readProjectContract(root);
+            waivers.push(...(await readStoreDocumentationWaivers(contract.projectId)));
+        }
+        result = rules.runRule(rule, { ...rulesNode.nodeRuleContext({ root }), waivers });
+    }
+    catch (error) {
+        cannotRun(json, rule, "RULE_CANNOT_RUN", `${rule} could not run: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+    }
+    const exit = result.verdict === "pass" ? CHECK_EXIT.PASS : CHECK_EXIT.FAILED;
+    if (json) {
+        console.log(JSON.stringify({ nustackJsonVersion: NUSTACK_JSON_VERSION, command: COMMAND, ok: true, data: { rule, verdict: result.verdict, findings: result.findings } }));
+    }
+    else {
+        console.log(`${rule}: ${result.verdict}`);
+        for (const finding of result.findings)
+            console.log(`  ${finding.path ? `${finding.path}: ` : ""}${finding.message}`);
+    }
+    process.exitCode = exit;
+}

package/dist/commands/deploy.js

@@ -6,6 +6,7 @@ import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { resolveProjectId } from "../lib/project_context.js";
 import { projectOverviewJson, readProjectOverview } from "./project.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 const DEFAULT_TIMEOUT_MINUTES = 15;
 export function emitFail(command, json, code, message) {
     if (json)
@@ -173,7 +174,7 @@ export async function runStatus(options, globals) {
         return;
     }
     const baseUrl = resolveNuStackUrl(globals);
-    const auth = await ensureAccessToken().catch(() => null);
+    const auth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     const overview = await readProjectOverview(project.projectId, cwd, baseUrl, auth?.accessToken ?? null);
     let hosting = null;
     if (auth && overview.cloudProject) {

package/dist/commands/doctor.js

@@ -21,6 +21,7 @@ import { NotARepositoryError } from "../lib/git-sync/core/git_runner.js";
 import { listBundles, sweepExpiredBundles } from "../lib/git-sync/recovery/store.js";
 import { inspectRecoveryKey } from "../lib/git-sync/recovery/crypto.js";
 import { NUSTACK_JSON_VERSION } from "../lib/json_output.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 async function credentialStoreRows(environmentInUse) {
     if (environmentInUse)
         return [{ check: "Credential source", status: "ok", detail: "environment — no store is read" }];
@@ -58,7 +59,7 @@ export async function runDoctor(options) {
         rows.push({ area, check, status, detail });
     };
     const fromEnv = envToken();
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (fromEnv?.kind === "malformed")
         add("identity", "Device sign-in", "error", fromEnv.message);
     else if (fromEnv)

package/dist/commands/harness.js

@@ -1,10 +1,14 @@
 import path from "node:path";
-import { getProject, resolveNuStackUrl } from "../lib/nustack_client.js";
-import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
-import { resolveProjectId } from "../lib/project_context.js";
 import { resolveRepository } from "../lib/git-sync/core/repository.js";
-import { mountHarness, readMountState } from "../lib/harness/mount.js";
+import { isProjectVersionSummary, mountProjectHarness, projectOf, readMountState, readSummary } from "../lib/harness/mount.js";
+import { readLegacyMountRecord } from "../lib/harness/legacyMount.js";
+import { resolveProjectVersion } from "../lib/harness/versionsClient.js";
+import { HARNESS_CODES, STATUS_EXIT } from "../lib/harness/codes.js";
+import { installCommitTrailerHook, trailerHookLine } from "../lib/onboarding/commit_trailer_hook.js";
+import { readProjectContract } from "../lib/project_contract.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+const RUNTIMES = ["claude-code", "codex", "opencode", "copilot-cli"];
+const WRITE_CONTRACT_MODES = ["never", "when-unmodified"];
 function emitFail(command, json, code, message) {
     if (json)
         printJsonError(command, { code, message });
@@ -13,6 +17,10 @@ function emitFail(command, json, code, message) {
         process.exitCode = 1;
     }
 }
+function codeOf(error) {
+    const code = error?.code;
+    return typeof code === "string" ? code : HARNESS_CODES.HARNESS_MOUNT_FAILED;
+}
 function rootOf(dir) {
     try {
         return resolveRepository(dir).repositoryRoot;
@@ -21,70 +29,141 @@ function rootOf(dir) {
         return dir;
     }
 }
-async function resolveProjectHarness(command, json, root, options, globals) {
-    const project = await resolveProjectId(root, options);
-    if (!project.ok) {
-        emitFail(command, json, "PROJECT_CONTEXT_MISSING", project.message);
-        return null;
-    }
-    const baseUrl = resolveNuStackUrl(globals);
-    const auth = await ensureAuthWithRecovery(baseUrl, json);
-    if (!auth) {
-        const failure = lastAuthFailure();
-        emitFail(command, json, failure.code, failure.message);
-        return null;
-    }
-    const summary = await getProject(baseUrl, auth.accessToken, project.projectId);
-    return { projectId: project.projectId, harness: summary.harness ?? null };
+function contractView(contract) {
+    return {
+        projectId: contract.projectId,
+        harness: contract.harness,
+        origin: contract.origin,
+        door: contract.door ?? null,
+        docsRoot: contract.docsRoot,
+        branchPolicy: contract.branchPolicy,
+    };
 }
 export async function runHarnessMount(target, options, globals) {
     const json = options.json === true;
     const root = rootOf(path.resolve(target ?? process.cwd()));
-    let manifestUrl = options.manifest ?? null;
-    let projectId = null;
-    if (!manifestUrl) {
-        const cloud = await resolveProjectHarness("harness mount", json, root, options, globals);
-        if (!cloud)
-            return;
-        projectId = cloud.projectId;
-        manifestUrl = cloud.harness?.manifestUrl ?? null;
-        if (!manifestUrl) {
-            emitFail("harness mount", json, "HARNESS_UNAVAILABLE", `Project ${cloud.projectId} resolves no harness version with an uploaded manifest.`);
-            return;
-        }
+    const runtime = options.runtime ?? "claude-code";
+    if (!RUNTIMES.includes(runtime)) {
+        emitFail("harness mount", json, "VALIDATION_FAILED", `--runtime must be one of ${RUNTIMES.join(", ")}.`);
+        return;
     }
-    let mounted;
+    const writeContract = options.writeContract ?? "never";
+    if (!WRITE_CONTRACT_MODES.includes(writeContract)) {
+        emitFail("harness mount", json, "VALIDATION_FAILED", `--write-contract must be one of ${WRITE_CONTRACT_MODES.join(", ")}.`);
+        return;
+    }
+    let outcome;
     try {
-        mounted = await mountHarness(root, manifestUrl);
+        outcome = await mountProjectHarness(root, {
+            globals,
+            projectId: options.project,
+            runtime: runtime,
+            writeContract: writeContract,
+            log: (line) => console.error(line),
+        });
     }
     catch (error) {
-        emitFail("harness mount", json, "HARNESS_MOUNT_FAILED", `The harness mount failed: ${error instanceof Error ? error.message : String(error)}`);
+        emitFail("harness mount", json, codeOf(error), error instanceof Error ? error.message : String(error));
         return;
     }
+    const trailerHook = await installCommitTrailerHook(root);
+    const trailerLine = trailerHookLine(trailerHook);
+    if (trailerLine && trailerHook !== "skipped_not_git")
+        console.error(trailerLine);
     if (json) {
-        printJsonSuccess("harness mount", { projectId, root, manifestUrl, ...mounted });
+        const { lines: _lines, ...mounted } = outcome;
+        printJsonSuccess("harness mount", { ...mounted, root, trailerHook });
         return;
     }
-    console.log(`Mounted harness ${mounted.version} into ${root} (${mounted.written} written, ${mounted.kept} unchanged, digest ${mounted.digest.slice(0, 12)})`);
+    console.log(`Mounted harness ${outcome.version ?? "(unknown)"} for ${outcome.runtime} into ${root} from ${outcome.source} ` +
+        `(${outcome.written.length} written, ${outcome.kept.length} unchanged, ${outcome.removed.length} removed${outcome.digest ? `, digest ${outcome.digest.slice(0, 12)}` : ""})`);
 }
 export async function runHarnessStatus(options, globals) {
     const json = options.json === true;
     const root = rootOf(process.cwd());
-    const cloud = await resolveProjectHarness("harness status", json, root, options, globals);
-    if (!cloud)
+    const contract = await readProjectContract(root);
+    let projectId;
+    try {
+        projectId = await projectOf(root, options.project, contract.projectId);
+    }
+    catch (error) {
+        emitFail("harness status", json, codeOf(error), error instanceof Error ? error.message : String(error));
+        return;
+    }
+    const pinned = contract.harness && "digest" in contract.harness ? contract.harness : null;
+    let reading;
+    try {
+        const read = await readSummary(root, projectId, globals);
+        if (read.kind === "offline") {
+            if (read.guardRefusal) {
+                emitFail("harness status", json, read.guardRefusal.code, read.guardRefusal.message);
+                return;
+            }
+            reading = pinned
+                ? { expected: { version: pinned.pin, digest: pinned.digest }, source: "version", unreachable: null }
+                : { expected: null, source: "version", unreachable: read.reason };
+        }
+        else if (!isProjectVersionSummary(read.summary)) {
+            const version = read.summary.harness?.version ?? null;
+            if (version === null) {
+                emitFail("harness status", json, HARNESS_CODES.HARNESS_UNAVAILABLE, `Project ${projectId} resolves no harness version.`);
+                return;
+            }
+            reading = { expected: { version, digest: null }, source: "legacy", unreachable: null };
+        }
+        else if (pinned) {
+            reading = { expected: { version: pinned.pin, digest: pinned.digest }, source: "version", unreachable: null };
+        }
+        else {
+            try {
+                const resolved = await resolveProjectVersion(read.baseUrl, read.accessToken, projectId, { track: "latest" });
+                reading = { expected: { version: resolved.semver, digest: resolved.digest }, source: "version", unreachable: null };
+            }
+            catch (error) {
+                if (codeOf(error) === HARNESS_CODES.ORIGIN_MISMATCH) {
+                    emitFail("harness status", json, HARNESS_CODES.ORIGIN_MISMATCH, error instanceof Error ? error.message : String(error));
+                    return;
+                }
+                reading = { expected: null, source: "version", unreachable: error instanceof Error ? error.message : String(error) };
+            }
+        }
+    }
+    catch (error) {
+        emitFail("harness status", json, codeOf(error), error instanceof Error ? error.message : String(error));
         return;
-    const mounted = await readMountState(root);
-    const pinned = cloud.harness?.version ?? null;
-    const inStep = pinned === null || mounted?.version === pinned;
+    }
+    let mounted;
+    if (reading.source === "legacy") {
+        const legacy = await readLegacyMountRecord(root);
+        mounted = legacy ? { version: legacy.version, digest: legacy.digest, mountedAt: legacy.mountedAt, source: "legacy", origin: legacy.origin } : null;
+    }
+    else {
+        mounted = await readMountState(root);
+        if (mounted?.source === "legacy")
+            mounted = null;
+    }
+    const inStep = reading.expected === null
+        ? null
+        : reading.source === "legacy"
+            ? mounted !== null && mounted.version === reading.expected.version
+            : mounted !== null && mounted.digest === reading.expected.digest;
+    const exit = inStep === null ? STATUS_EXIT.UNREACHABLE : inStep ? STATUS_EXIT.IN_STEP : STATUS_EXIT.DIFFERING;
     if (json) {
-        printJsonSuccess("harness status", { projectId: cloud.projectId, mounted, cloud: cloud.harness, inStep });
+        printJsonSuccess("harness status", {
+            projectId,
+            contract: contractView(contract),
+            mounted,
+            expected: reading.expected,
+            inStep,
+            source: reading.source,
+            ...(reading.unreachable ? { unreachable: reading.unreachable } : {}),
+        });
     }
     else {
-        console.log(`Harness for Project ${cloud.projectId}`);
-        console.log(`  mounted:   ${mounted ? `${mounted.version} (digest ${mounted.digest.slice(0, 12)})` : "(nothing mounted)"}`);
-        console.log(`  cloud pin: ${cloud.harness ? `${cloud.harness.slug} ${cloud.harness.version}` : "(none)"}`);
-        console.log(`  verdict:   ${inStep ? "in step" : "DIFFERS — run `nustack harness mount`"}`);
+        console.log(`Harness for Project ${projectId} (${reading.source === "legacy" ? "legacy harness" : "project version"})`);
+        console.log(`  mounted:  ${mounted ? `${mounted.version} (digest ${mounted.digest.slice(0, 12)}, ${mounted.source ?? "unknown source"})` : "(nothing mounted)"}`);
+        console.log(`  expected: ${reading.expected ? `${reading.expected.version ?? "?"}${reading.expected.digest ? ` (digest ${reading.expected.digest.slice(0, 12)})` : ""}` : `(unreachable: ${reading.unreachable ?? "unknown"})`}`);
+        console.log(`  verdict:  ${inStep === null ? "UNKNOWN — the expected version could not be read" : inStep ? "in step" : "DIFFERS — run `nustack harness mount`"}`);
     }
-    if (!inStep)
-        process.exitCode = 1;
+    process.exitCode = exit;
 }

package/dist/commands/init.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import path from "node:path";
 import * as p from "@clack/prompts";
 import { createProjectViaAsk, createOrganization, getProject, listProjects, listOrganizations, resolveNuStackUrl, } from "../lib/nustack_client.js";
-import { ensureAccessToken } from "../lib/auth_grant.js";
+import { ensureAccessToken, envToken } from "../lib/auth_grant.js";
 import { getOrCreateDeviceId } from "../lib/device_identity.js";
 import { isInteractive } from "../lib/interactive.js";
 import { resolveOrganizationId } from "../lib/project_context.js";
@@ -15,9 +15,28 @@ import { attachExistingGit } from "../lib/onboarding/attach_existing_git.js";
 import { initFreshFolder } from "../lib/onboarding/init_fresh_folder.js";
 import { webFirstAttach } from "../lib/onboarding/web_first_attach.js";
 import { performDeviceLogin } from "./login.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { readProjectContract } from "../lib/project_contract.js";
+import { HARNESS_CODES } from "../lib/harness/codes.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 export async function runInit(options) {
     const cwd = process.cwd();
     const baseUrl = resolveNuStackUrl(options);
+    const isUnattended = options.yes === true && Boolean(options.project?.trim()) && Boolean(options.organization?.trim());
+    if (isUnattended) {
+        await runUnattendedInit(baseUrl, options);
+        return;
+    }
+    if (options.json || !isInteractive()) {
+        const message = "nustack init with no terminal needs `--yes --project <id> --organization <id>` (it never prompts, opens a browser or creates a Project); a credential comes from NUSTACK_TOKEN or `nustack login`.";
+        if (options.json)
+            printJsonError("init", { code: HARNESS_CODES.INIT_NEEDS_PROJECT, message });
+        else {
+            console.error(message);
+            process.exitCode = 1;
+        }
+        return;
+    }
     p.intro("nustack init");
     if (!isInteractive()) {
         p.log.error("nustack init needs an interactive terminal (browser sign-in + prompts).");
@@ -34,8 +53,87 @@ export async function runInit(options) {
         organization: options.organization,
     });
 }
+function initEnvelope(result) {
+    return {
+        projectId: result.projectId,
+        organizationId: result.organizationId,
+        contract: result.projectManifest,
+        sessionHook: result.sessionHook,
+        mount: result.mount,
+        trailerHook: result.trailerHook,
+    };
+}
+async function runUnattendedInit(baseUrl, options) {
+    const json = options.json === true;
+    const projectId = options.project.trim();
+    const organizationId = options.organization.trim();
+    const fail = (code, message) => {
+        if (json)
+            printJsonError("init", { code, message });
+        else {
+            console.error(message);
+            process.exitCode = 1;
+        }
+    };
+    if (envToken()?.kind === "ok") {
+        fail(HARNESS_CODES.INIT_NEEDS_DEVICE, "An unattended init binds this folder to the Project as this machine, which takes a device sign-in: run `nustack login` (or `nustack login --manual`) once, and unset NUSTACK_TOKEN for the init.");
+        return;
+    }
+    const auth = await ensureAccessToken(baseUrl).catch(nullUnlessOriginRefused);
+    if (!auth) {
+        fail("SIGNED_OUT", "This machine is not signed in: run `nustack login` (or `nustack login --manual`) once first. An unattended init never opens a browser, and a NUSTACK_TOKEN cannot bind a folder.");
+        return;
+    }
+    const cwd = process.cwd();
+    const bound = (await readProjectContract(cwd)).projectId;
+    if (bound && bound !== projectId) {
+        fail("REBIND_CONFIRMATION_REQUIRED", `This folder is bound to Project ${bound}. An unattended init never rebinds it to ${projectId}; run \`nustack init\` in a terminal to confirm a rebind.`);
+        return;
+    }
+    const store = await openLocalStore();
+    try {
+        const device = readDeviceState(store);
+        const ctx = {
+            store,
+            baseUrl,
+            accessToken: auth.accessToken,
+            deviceRef: device?.deviceRef ?? (await getOrCreateDeviceId()),
+            userId: device?.activeUserId ?? null,
+            cwd,
+            json,
+            yes: true,
+            interactive: false,
+        };
+        const state = classifyFolder(cwd);
+        let outcome;
+        if (state.class === "git_worktree" && state.repository && state.git) {
+            const root = state.repository.repositoryRoot;
+            if (!hasManifest(root))
+                await scaffoldManifest(root, deriveRepoName(path.basename(root)));
+            outcome = await attachExistingGit(ctx, { projectId, organizationId, confirmRebind: false });
+        }
+        else {
+            outcome = await webFirstAttach(ctx, { projectId, organizationId, confirmPopulated: true });
+        }
+        if (!outcome.ok) {
+            fail(outcome.code, outcome.message);
+            return;
+        }
+        if (json) {
+            printJsonSuccess("init", initEnvelope(outcome.result));
+            return;
+        }
+        for (const notice of outcome.result.notices)
+            console.error(notice);
+        console.log(`Bound to Project ${outcome.result.projectId} on branch ${outcome.result.boundBranch} (binding ${outcome.result.bindingId}).`);
+        console.log(`Harness: ${outcome.result.mount.status}${outcome.result.mount.version ? ` ${outcome.result.mount.version}` : ""} · session hook ${outcome.result.sessionHook} · trailer hook ${outcome.result.trailerHook}.`);
+    }
+    finally {
+        store.close();
+    }
+}
 export async function ensureSignedIn(baseUrl, cwd) {
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (deviceAuth) {
         p.log.success(`Signed in as ${deviceAuth.userEmail}`);
         return deviceAuth.accessToken;
@@ -45,7 +143,7 @@ export async function ensureSignedIn(baseUrl, cwd) {
         process.exitCode = 1;
         return null;
     }
-    const refreshed = await ensureAccessToken().catch(() => null);
+    const refreshed = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!refreshed) {
         p.outro("Sign-in did not complete — run `nustack login` and retry.");
         process.exitCode = 1;
@@ -253,6 +351,8 @@ async function confirm(message) {
     return !p.isCancel(answer) && answer === true;
 }
 function reportSuccess(result) {
+    for (const notice of result.notices)
+        p.log.warn(notice);
     p.log.success(`Bound to Project ${result.projectId} on branch ${result.boundBranch} (binding ${result.bindingId}).`);
     p.log.info(`Toolkit ${result.toolkit.name}@${result.toolkit.version}. No Git push, pull, or remote was created.`);
     p.outro("Ready — `nustack status` · `nustack docs list` · `nustack project sync now`.");

package/dist/commands/login.js

@@ -3,7 +3,8 @@ import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { launchBrowser } from "../lib/browser_opener.js";
 import { selectCredentialStore } from "../lib/credential_store.js";
 import { isInteractive } from "../lib/interactive.js";
-import { ensureAccessToken, ENV_TOKEN_VARIABLE, envToken, loginWithLoopback, loginWithPastedCode, prepareLogin, } from "../lib/auth_grant.js";
+import { ensureAccessToken, ENV_TOKEN_VARIABLE, envToken, loginWithLoopback, loginWithPastedCode, prepareLogin, readStoredCredential, } from "../lib/auth_grant.js";
+import { isContractOrigin, nullUnlessOriginRefused, originMismatchError, refusedContractOrigin } from "../lib/origin_guard.js";
 async function readStdinLine() {
     return new Promise((resolve) => {
         let buffered = "";
@@ -77,6 +78,12 @@ async function loopbackFlow(ctx, flags) {
     }
 }
 export async function performDeviceLogin(baseUrl, _cwd = process.cwd(), flags = {}) {
+    if (isContractOrigin(baseUrl)) {
+        const held = envToken() ? null : (await readStoredCredential().catch(() => null))?.credential ?? null;
+        const refused = refusedContractOrigin(held?.studioBaseUrl ?? null, baseUrl);
+        if (refused)
+            throw originMismatchError(refused, held?.studioBaseUrl ?? null, envToken() ? "pat" : held ? "device" : "none");
+    }
     if (envToken()) {
         p.log.info(`${ENV_TOKEN_VARIABLE} is set — this process authenticates with it, and no sign-in is stored on this machine. Unset it to sign in as a person.`);
         return true;
@@ -90,7 +97,7 @@ export async function performDeviceLogin(baseUrl, _cwd = process.cwd(), flags =
         return false;
     }
     if (!flags.force && !flags.reauthorize) {
-        const live = await ensureAccessToken().catch(() => null);
+        const live = await ensureAccessToken().catch(nullUnlessOriginRefused);
         if (live) {
             p.log.success(`Signed in as ${live.userEmail || "this account"} — already signed in on this machine (use --force to sign in again).`);
             return true;

package/dist/commands/mcp.js

@@ -1,3 +1,4 @@
+import { resolveAccessToken } from "../lib/auth_grant.js";
 import { ensureAuthWithRecovery } from "../lib/auth_recovery.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
 import { authorizedFetch, resolveNuStackUrl } from "../lib/nustack_client.js";
@@ -10,6 +11,12 @@ async function runServe(options, globals) {
     const bound = flag ? null : await resolveProjectId(process.cwd(), {});
     const defaultProjectId = flag ?? (bound?.ok ? bound.projectId : null);
     const doorUrl = doorUrlFor(baseUrl, process.env.NUSTACK_MCP_URL);
+    const outcome = await resolveAccessToken(baseUrl).catch(() => null);
+    if (outcome?.kind === "origin_mismatch") {
+        process.stderr.write(`nustack mcp: ${outcome.error.message}\n`);
+        process.exitCode = 1;
+        return;
+    }
     process.stderr.write(`nustack mcp: relaying to ${doorUrl}${defaultProjectId ? `, default project ${defaultProjectId}` : ""}\n`);
     await runRelay({
         doorUrl,

package/dist/commands/project-sync.js

@@ -12,6 +12,7 @@ import { listBundles, restoreBundle, deleteBundle, sweepExpiredBundles, } from "
 import { resolveRepository } from "../lib/git-sync/core/repository.js";
 import { registerOutbound, createUploadClient, deviceTokenProvider, describeHistoryDecision, publishCurrentState, adoptWithoutPublishing, } from "../lib/git-sync/outbound/index.js";
 import { latestAcceptedUpload } from "../lib/local_store/accepted_uploads.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 const ONBOARDING_POINTER = "No NuStack Project bindings on this machine. Run `nustack project attach` inside a Git repository to bind it.";
 function writeLine(line) {
     process.stdout.write(`${line}\n`);
@@ -92,7 +93,7 @@ export function registerProjectSyncCommands(projectCommand, getGlobalOptions) {
 }
 async function buildInboundRuntime(store, globals) {
     const baseUrl = resolveNuStackUrl(globals);
-    const auth = await ensureAccessToken().catch(() => null);
+    const auth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!auth)
         return null;
     const deviceState = readDeviceState(store);

package/dist/commands/records.js

@@ -3,6 +3,7 @@ import { readDesktopSettings } from "../lib/desktop_settings.js";
 import { openLocalStore } from "../lib/local_store/database.js";
 import { stateDbPath } from "../lib/local_store/paths.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { HARNESS_CODES } from "../lib/harness/codes.js";
 import { resolveProjectId } from "../lib/project_context.js";
 import { isEmitKind } from "../lib/records/door.js";
 import { acquireDrainLock, drainRecords, refreshDrainLock, releaseDrainLock, startDetachedDrain } from "../lib/records/drain.js";
@@ -177,6 +178,15 @@ export async function runRecordsSync(options, globals) {
         if (project.ok)
             releaseUnboundRows(store, root);
         const drained = await drainAs(store, globals, isFlagSet(DRAIN_CHILD_VARIABLE));
+        if (drained?.originRefusal) {
+            if (options.json)
+                printJsonError("records sync", { code: HARNESS_CODES.ORIGIN_MISMATCH, message: drained.originRefusal });
+            else {
+                process.stderr.write(`${drained.originRefusal}\n`);
+                process.exitCode = 1;
+            }
+            return;
+        }
         if (options.quiet)
             return;
         const counts = await countRecords(store);

package/dist/commands/review.js

@@ -2,6 +2,7 @@ import { ensureAccessToken } from "../lib/auth_grant.js";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { makeReviewClient, ReviewUnreachableError } from "../lib/review/client.js";
 import { printJsonSuccess } from "../lib/json_output.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 const EXIT_FOR = {
     signed: 0,
     refused: 1,
@@ -56,7 +57,7 @@ export async function runReviewCheck(options, globals) {
         process.exitCode = EXIT_FOR[state];
     };
     const baseUrl = resolveNuStackUrl(globals);
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!deviceAuth)
         return report("unreachable");
     try {
@@ -124,7 +125,7 @@ export async function runReviewMirror(options, globals) {
     if (!sessionId)
         return mirrorReport(json, "skipped", null, "--session is required");
     const baseUrl = resolveNuStackUrl(globals);
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!deviceAuth)
         return mirrorReport(json, "skipped", null, "signed out");
     const client = makeReviewClient(baseUrl, deviceAuth.accessToken);

package/dist/commands/sessions.js

@@ -5,17 +5,20 @@ import { ensureAccessToken } from "../lib/auth_grant.js";
 import { isInteractive } from "../lib/interactive.js";
 import { resolveNuStackUrl } from "../lib/nustack_client.js";
 import { makeSessionsClient, sessionsClientFromEnv } from "../lib/sessions/client.js";
+import { mountProjectHarness } from "../lib/harness/mount.js";
 import { recordOutsideSessions, } from "../lib/sessions/outsideSessions.js";
 import { inspectSession, readOrphanedWorktrees, reclaimSession, } from "../lib/session-engine/prune.js";
 import { readSessionRegistry, sessionRegistryPath } from "../lib/session-engine/registry.js";
 import { SessionSupervisor } from "../lib/session-engine/supervisor.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 export async function runSessionsServe(engineVersion) {
     const supervisor = new SessionSupervisor({
         input: process.stdin,
         output: process.stdout,
         engineVersion,
         sessions: sessionsClientFromEnv(process.env),
+        mountHarness: mountProjectHarness,
     });
     await supervisor.run();
     process.exit(0);
@@ -69,7 +72,7 @@ export async function runSessionsRecord(options, globals) {
     const transcripts = readTranscripts(payload?.sessions);
     if (transcripts.length === 0)
         return report("sessions record", EMPTY, json, "nothing to record");
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!deviceAuth)
         return report("sessions record", EMPTY, json, "signed out");
     const summary = await recordOutsideSessions(makeSessionsClient(baseUrl, deviceAuth.accessToken), {

package/dist/commands/sync.js

@@ -6,6 +6,7 @@ import { ensureAccessToken, signedOutCopy } from "../lib/auth_grant.js";
 import { resolveProjectId } from "../lib/project_context.js";
 import { readManagedValues, writeManagedValues } from "../lib/env_file.js";
 import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+import { nullUnlessOriginRefused } from "../lib/origin_guard.js";
 const COMMAND = "sync";
 const signedOut = () => signedOutCopy();
 export async function runSync(options) {
@@ -14,7 +15,7 @@ export async function runSync(options) {
     const json = options.json === true;
     if (!json)
         p.intro("nustack sync");
-    const deviceAuth = await ensureAccessToken().catch(() => null);
+    const deviceAuth = await ensureAccessToken().catch(nullUnlessOriginRefused);
     if (!deviceAuth)
         return failSync(json, "SIGNED_OUT", signedOut(), "The managed block was not touched.");
     const accessToken = deviceAuth.accessToken;

package/dist/index.js

@@ -5,6 +5,10 @@ if (command === "gate" && subcommand !== undefined && HOOK_SUBCOMMANDS.includes(
     const { runGateHook } = await import("./lib/gate/hook.js");
     await runGateHook(subcommand);
 }
+else if (command === "check" && process.argv.includes("--hook")) {
+    const { runHookMode } = await import("./lib/harness/hookEntry.js");
+    await runHookMode(process.argv[process.argv.indexOf("--hook") + 1] ?? "", process.argv.includes("--protection"));
+}
 else {
     await import("./program.js");
 }