create-harness-vibe-coding 0.8.2 → 0.8.3

package/templates/common/scripts/wf-mode-hook.mjs

@@ -1,128 +1,116 @@
 #!/usr/bin/env node
 /**
- * wf-mode-hook.mjs — Claude Code hook for WF-MAX / WF-REVIEW enforcement
+ * wf-mode-hook.mjs - Harness workflow hook for Claude Code/Codex.
  *
- * Three-layer architecture:
- *   Layer 1 — global mode:    mode = wf-max | wf-review | null
- *   Layer 2 — agent role:     agentRole = ceo | manager | worker | reviewer | null
- *   Layer 3 — dispatch perm:  writeSet / forbidden / verification
- *
- * Rules:
- *   - Top-level orchestrator is CEO. CEO reads, plans, dispatches. No source edits.
- *   - Manager scopes/reviews/coordinates. Default: no source edits.
- *   - Worker may edit only files in dispatch.writeSet.
- *   - Reviewer reads and reports. No writes.
- *   - Missing role or writeSet → source edits denied by default.
- *
- * Hook events:
- *   SessionStart    → reads mode file; auto-clears stale mode (>30 min old);
- *                      injects context only for fresh/active mode
- *   UserPromptSubmit→ detects /wf-max, /wf-review; writes mode state;
- *                      emits per-turn role-aware reinforcement
- *   PreToolUse      → enforces by agentRole + writeSet
- *
- * Security: symlink-safe I/O, atomic write, size caps, whitelist validation.
- * Exit 0 = allow. Exit 2 = block with stderr message.
+ * Authority model:
+ * - Harness/.runtime/current-mode.json is observable workflow state only.
+ * - Per-agent dispatch context is the authority for source-write permissions.
+ * - Dispatch context may arrive on the hook event or via HARNESS_* env vars.
  */
 
-import { constants, openSync, readSync, writeSync, closeSync, readFileSync, writeFileSync, existsSync, mkdirSync, lstatSync, renameSync, unlinkSync } from 'node:fs';
-import { join, dirname, basename, relative, resolve } from 'node:path';
+import {
+  closeSync,
+  constants,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readSync,
+  renameSync,
+  writeFileSync,
+  writeSync,
+} from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { randomBytes } from 'node:crypto';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const RUNTIME_DIR = join(__dirname, '..', '.runtime');
 const MODE_FILE = join(RUNTIME_DIR, 'current-mode.json');
-const MAX_MODE_BYTES = 16384; // Expanded for writeSet/forbidden/verification fields
-const STALE_MODE_MS = 30 * 60 * 1000; // 30 min — clear modes from prior sessions
 const GOALS_FILE = join(RUNTIME_DIR, 'goals.json');
-const MAX_GOAL_BYTES = 65536;
-const MAX_GOAL_DESC = 500;
 
-const VALID_MODES = ['wf', 'wf-max', 'wf-auto', 'wf-auto-spark', 'wf-review', 'wf-learn', null];
-const VALID_ROLES = ['ceo', 'ceo-escalated', 'manager', 'worker', 'reviewer', null];
-const MAX_ESCALATION_COUNT = 3; // Worker failures before CEO can escalate
-const MAX_ESCALATION_FILES = 3; // Max files CEO can touch while escalated
-const VALID_PHASES = ['W0_EXPLORE', 'W1_ARCHITECTURE', 'W2_IMPLEMENT', 'W2R_REVIEW', 'W3_DEPENDENT', 'INTEGRATION', 'CLOSEOUT', 'REVIEW', 'SPARK', 'AUTO', 'LEARN', null];
-const BLOCKED_TOOLS = ['Edit', 'Write', 'MultiEdit', 'Bash'];
+const MAX_MODE_BYTES = 16 * 1024;
+const MAX_GOAL_BYTES = 64 * 1024;
+const MAX_GOAL_DESC = 500;
 const MAX_TASKID_BYTES = 128;
-
-// ── Symlink-safe I/O ───────────────────────────────────────────────────────
-
-function safeResolveHarnessPath(filePath) {
-  try {
-    const parts = filePath.replace(/\\/g, '/').split('/').filter(Boolean);
-    let resolved = '';
-    for (const part of parts) {
-      if (part === '..') return null;
-      resolved = resolved ? join(resolved, part) : (resolved || part);
-      try {
-        const st = lstatSync(resolved);
-        if (st.isSymbolicLink()) return null;
-      } catch (e) {
-        if (e.code === 'ENOENT' && part !== parts[parts.length - 1]) return null;
-      }
+const MAX_ESCALATION_FILES = 1;
+const STALE_MODE_MS = 30 * 60 * 1000;
+
+const VALID_MODES = new Set(['wf', 'wf-max', 'wf-auto', 'wf-auto-spark', 'wf-review', 'wf-learn', null]);
+const VALID_ROLES = new Set(['ceo', 'ceo-escalated', 'manager', 'worker', 'reviewer', null]);
+const VALID_PHASES = new Set([
+  'W0_EXPLORE',
+  'W1_ARCHITECTURE',
+  'W2_IMPLEMENT',
+  'W2R_REVIEW',
+  'W3_DEPENDENT',
+  'INTEGRATION',
+  'CLOSEOUT',
+  'REVIEW',
+  'SPARK',
+  'AUTO',
+  'LEARN',
+  null,
+]);
+const GUARDED_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'Bash']);
+const SAFE_BASH = /^(ls|dir|tree|git\s+status|git\s+diff|git\s+log|git\s+branch|node\s+Harness\/scripts\/[a-z0-9_.-]+\.mjs|which|echo|type|codex|claude|npm\s+test|npm\s+run|npx\s+playwright\s+test)(\s+[^;&|>`$]*)?$/i;
+
+const PROJECT_ROOT = findProjectRoot();
+
+function findProjectRoot() {
+  let current = resolve(__dirname);
+  for (let i = 0; i < 12; i++) {
+    if (existsSync(join(current, 'CLAUDE.md')) || existsSync(join(current, 'package.json'))) {
+      return current;
     }
-    const normalized = resolved.replace(/\\/g, '/');
-    if (!normalized.includes('Harness/')) return null;
-    return resolved;
-  } catch {
-    return null;
+    const parent = dirname(current);
+    if (parent === current) break;
+    current = parent;
   }
+  return resolve(__dirname, '..', '..');
 }
 
-function safeReadJSON(filePath, maxBytes = MAX_MODE_BYTES) {
-  try {
-    const safe = safeResolveHarnessPath(filePath);
-    if (!safe) return null;
+function hasTraversal(rawPath) {
+  return String(rawPath || '')
+    .replace(/\\/g, '/')
+    .split('/')
+    .some((part) => part === '..');
+}
+
+function normalizeProjectPath(filePath) {
+  if (!filePath || typeof filePath !== 'string') return null;
+  if (hasTraversal(filePath)) return null;
 
-    const st = lstatSync(safe);
-    if (!st.isFile()) return null;
-    if (st.size > maxBytes) return null;
+  const absolutePath = isAbsolute(filePath) ? resolve(filePath) : resolve(PROJECT_ROOT, filePath);
+  const relativePath = relative(PROJECT_ROOT, absolutePath).replace(/\\/g, '/');
+  if (!relativePath || relativePath === '.') return '';
+  if (relativePath === '..' || relativePath.startsWith('../') || isAbsolute(relativePath)) return null;
+  return relativePath;
+}
+
+function isSafeRuntimeTarget(filePath) {
+  const normalized = normalizeProjectPath(filePath);
+  return normalized === 'Harness/.runtime/current-mode.json' || normalized === 'Harness/.runtime/goals.json';
+}
 
-    const O_NOFOLLOW = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
+function readJSONFile(filePath, maxBytes = MAX_MODE_BYTES) {
+  try {
+    const normalized = normalizeProjectPath(filePath);
+    if (!normalized) return null;
+    const absolutePath = resolve(PROJECT_ROOT, normalized);
+    const stat = lstatSync(absolutePath);
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+
+    const noFollow = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
     let fd;
     try {
-      fd = openSync(safe, constants.O_RDONLY | O_NOFOLLOW);
-      const buf = Buffer.alloc(maxBytes);
-      const n = readSync(fd, buf, 0, maxBytes, 0);
-      const raw = buf.slice(0, n).toString('utf8').trim();
+      fd = openSync(absolutePath, constants.O_RDONLY | noFollow);
+      const buffer = Buffer.alloc(maxBytes);
+      const bytes = readSync(fd, buffer, 0, maxBytes, 0);
+      const raw = buffer.subarray(0, bytes).toString('utf8').trim();
       if (!raw) return null;
-      const parsed = JSON.parse(raw);
-      // Whitelist validation
-      if (!VALID_MODES.includes(parsed.mode)) return null;
-      // Normalize: agentRole takes precedence; fall back to legacy 'role' field
-      if (parsed.agentRole !== undefined && parsed.agentRole !== '' && !VALID_ROLES.includes(parsed.agentRole)) return null;
-      if (parsed.role !== undefined && parsed.role !== '' && !VALID_ROLES.includes(parsed.role)) return null;
-      // Treat empty string agentRole as "not set"
-      if (parsed.agentRole === '') parsed.agentRole = undefined;
-      if (parsed.role === '') parsed.role = undefined;
-      if (!parsed.agentRole && parsed.role) {
-        parsed.agentRole = parsed.role;
-      }
-      // If no role at all, still allow the mode object — enforcement will deny source edits
-      if (parsed.agentRole === undefined && parsed.role === undefined) {
-        parsed.agentRole = null;
-      }
-      if (parsed.active !== undefined && typeof parsed.active !== 'boolean') return null;
-      if (parsed.phase !== undefined && !VALID_PHASES.includes(parsed.phase)) return null;
-      if (parsed.explicitInvocation !== undefined && typeof parsed.explicitInvocation !== 'boolean') return null;
-      // Sanitize free-text fields
-      if (parsed.taskId && typeof parsed.taskId === 'string') {
-        parsed.taskId = parsed.taskId.replace(/[^\w-]/g, '').slice(0, MAX_TASKID_BYTES);
-        if (!parsed.taskId) parsed.taskId = 'current';
-      }
-      // Validate writeSet if present
-      if (parsed.writeSet !== undefined) {
-        if (!Array.isArray(parsed.writeSet)) return null;
-        if (!parsed.writeSet.every(e => typeof e === 'string' && e.length > 0 && e.length < 1024)) return null;
-      }
-      // Validate forbidden if present
-      if (parsed.forbidden !== undefined) {
-        if (!Array.isArray(parsed.forbidden)) return null;
-        if (!parsed.forbidden.every(e => typeof e === 'string' && e.length < 1024)) return null;
-      }
-      return parsed;
+      return JSON.parse(raw);
     } finally {
       if (fd !== undefined) closeSync(fd);
     }
@@ -131,750 +119,511 @@ function safeReadJSON(filePath, maxBytes = MAX_MODE_BYTES) {
   }
 }
 
-function safeWriteJSON(filePath, obj) {
+function writeJSONFile(filePath, value) {
   try {
-    mkdirSync(dirname(filePath), { recursive: true });
-
+    if (!isSafeRuntimeTarget(filePath)) return false;
+    const normalized = normalizeProjectPath(filePath);
+    const absolutePath = resolve(PROJECT_ROOT, normalized);
+    mkdirSync(dirname(absolutePath), { recursive: true });
     try {
-      if (lstatSync(filePath).isSymbolicLink()) return;
-    } catch (e) {
-      if (e.code !== 'ENOENT') return;
+      if (lstatSync(absolutePath).isSymbolicLink()) return false;
+    } catch (error) {
+      if (error.code !== 'ENOENT') return false;
     }
 
-    const tmp = join(dirname(filePath),
-      `.${basename(filePath)}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`);
-    const O_NOFOLLOW = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
+    const tmpPath = join(dirname(absolutePath), `.${basename(absolutePath)}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`);
+    const noFollow = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
     let fd;
     try {
-      fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | O_NOFOLLOW, 0o600);
-      const content = JSON.stringify(obj, null, 2) + '\n';
-      writeSync(fd, content);
+      fd = openSync(tmpPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollow, 0o600);
+      writeSync(fd, JSON.stringify(value, null, 2) + '\n');
     } finally {
       if (fd !== undefined) closeSync(fd);
     }
-    renameSync(tmp, filePath);
+    renameSync(tmpPath, absolutePath);
+    return true;
   } catch {
-    // Silent-fail
+    return false;
   }
 }
 
-// ── Goal persistence (survives Claude Code goal auto-clear) ───────────────
+function validateMode(rawMode) {
+  if (!rawMode || typeof rawMode !== 'object') return null;
+  const mode = { ...rawMode };
+  if (!VALID_MODES.has(mode.mode ?? null)) return null;
+  if (mode.active !== undefined && typeof mode.active !== 'boolean') return null;
+  if (!VALID_PHASES.has(mode.phase ?? null)) return null;
+  if (mode.agentRole !== undefined && mode.agentRole !== '' && !VALID_ROLES.has(mode.agentRole)) return null;
+  if (mode.role !== undefined && mode.role !== '' && !VALID_ROLES.has(mode.role)) return null;
+  if (mode.explicitInvocation !== undefined && typeof mode.explicitInvocation !== 'boolean') return null;
+
+  if (mode.agentRole === '') delete mode.agentRole;
+  if (mode.role === '') delete mode.role;
+  if (!mode.agentRole && mode.role) mode.agentRole = mode.role;
+
+  if (typeof mode.taskId === 'string') {
+    mode.taskId = sanitizeTaskId(mode.taskId);
+  }
+  if (mode.writeSet !== undefined) {
+    const writeSet = parseList(mode.writeSet);
+    if (!writeSet) return null;
+    mode.writeSet = writeSet;
+  }
+  if (mode.forbidden !== undefined) {
+    const forbidden = parseList(mode.forbidden);
+    if (!forbidden) return null;
+    mode.forbidden = forbidden;
+  }
+  return mode;
+}
 
-function readGoals() {
-  try {
-    if (!existsSync(GOALS_FILE)) return { goals: [] };
-    const st = lstatSync(GOALS_FILE);
-    if (!st.isFile() || st.size > MAX_GOAL_BYTES) return { goals: [] };
-    const raw = readFileSync(GOALS_FILE, 'utf8').trim();
-    if (!raw) return { goals: [] };
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed.goals)) return { goals: [] };
-    parsed.goals = parsed.goals.filter(g =>
-      typeof g.id === 'string' && g.id.length > 0 && g.id.length < 128 &&
-      typeof g.description === 'string' && g.description.length > 0 &&
-      ['active', 'completed', 'abandoned'].includes(g.status)
-    );
-    return parsed;
-  } catch { return { goals: [] }; }
-}
-
-function writeGoals(goalsObj) {
-  try {
-    mkdirSync(dirname(GOALS_FILE), { recursive: true });
-    const tmp = join(dirname(GOALS_FILE),
-      `.${basename(GOALS_FILE)}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`);
-    const O_NOFOLLOW = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
-    let fd;
-    try {
-      fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | O_NOFOLLOW, 0o600);
-      writeSync(fd, JSON.stringify(goalsObj, null, 2) + '\n');
-    } finally {
-      if (fd !== undefined) closeSync(fd);
-    }
-    renameSync(tmp, GOALS_FILE);
-  } catch {}
+function readMode() {
+  return validateMode(readJSONFile(MODE_FILE, MAX_MODE_BYTES));
 }
 
-function getActiveGoals() {
-  const data = readGoals();
-  return data.goals.filter(g => g.status === 'active');
+function clearMode() {
+  writeJSONFile(MODE_FILE, {
+    active: false,
+    mode: null,
+    agentRole: null,
+    phase: null,
+    clearedAt: new Date().toISOString(),
+  });
 }
 
-// ── Path normalization (fixed for Windows absolute paths) ──────────────────
+function sanitizeTaskId(value) {
+  const sanitized = String(value).replace(/[^\w-]/g, '').slice(0, MAX_TASKID_BYTES);
+  return sanitized || 'current';
+}
 
-function getProjectRoot() {
-  // Walk up from __dirname to find the repo root (where CLAUDE.md lives)
-  try {
-    let dir = resolve(__dirname);
-    for (let i = 0; i < 10; i++) {
-      if (existsSync(join(dir, 'CLAUDE.md'))) return dir;
-      const parent = dirname(dir);
-      if (parent === dir) break;
-      dir = parent;
+function parseList(value) {
+  if (value === undefined || value === null || value === '') return [];
+  if (Array.isArray(value)) {
+    if (!value.every((item) => typeof item === 'string' && item.length > 0 && item.length < 1024)) return null;
+    return value.map((item) => item.trim()).filter(Boolean);
+  }
+  if (typeof value !== 'string' || value.length >= 8192) return null;
+  const trimmed = value.trim();
+  if (!trimmed) return [];
+  if (trimmed.startsWith('[')) {
+    try {
+      return parseList(JSON.parse(trimmed));
+    } catch {
+      return null;
     }
-  } catch {}
-  // Fallback: assume Harness/scripts/ is two levels below root
-  return resolve(__dirname, '..', '..');
+  }
+  return trimmed.split(/[\n,]/).map((item) => item.trim()).filter(Boolean);
 }
 
-function normalizePath(filePath) {
-  try {
-    // Resolve to absolute, then make relative to project root
-    const abs = resolve(filePath);
-    const root = getProjectRoot();
-    const rel = relative(root, abs).replace(/\\/g, '/');
-    if (rel.startsWith('..')) return null; // Outside project
-    if (rel.includes('..')) return null;   // Traversal
-    // Prefix with / so patterns match uniformly
-    return '/' + rel;
-  } catch { return null; }
-}
-
-function isTaskFile(filePath) {
-  const normalized = normalizePath(filePath);
-  if (!normalized) return false;
-  return /^\/Harness\/tasks\/[^/]+\/(PLAN|PROGRESS|ARTIFACTS|NOTES)\.md$/.test(normalized);
-}
-
-function isHarnessMeta(filePath, agentRole) {
-  const normalized = normalizePath(filePath);
-  if (!normalized) return false;
-  const isMeta = /^\/Harness\/(memory\/|MEMORY\.md$|PROGRESS\.md$|\.runtime\/)/.test(normalized);
-  if (!isMeta) return false;
-  // .runtime/ writes (current-mode.json) — CEO only (prevents privilege escalation)
-  if (/^\/Harness\/\.runtime\//.test(normalized) && agentRole !== 'ceo') return false;
-  return true;
+function normalizeRole(role) {
+  if (role === undefined || role === null || role === '') return null;
+  const normalized = String(role).trim().toLowerCase();
+  return VALID_ROLES.has(normalized) ? normalized : null;
 }
 
-/**
- * Check if filePath is within the agent's writeSet.
- * writeSet entries are relative paths from project root (e.g., "CLAUDE.md", "Harness/scripts/wf-mode-hook.mjs").
- */
-function isInWriteSet(filePath, writeSet) {
-  if (!writeSet || writeSet.length === 0) return false;
-  try {
-    const abs = resolve(filePath);
-    const root = getProjectRoot();
-    const rel = relative(root, abs).replace(/\\/g, '/');
-    if (rel.startsWith('..')) return false;
-    return writeSet.some(entry => {
-      const normalizedEntry = entry.replace(/\\/g, '/');
-      // Exact match only — list each file explicitly (e.g., both "CLAUDE.md" and "templates/common/CLAUDE.md")
-      return rel === normalizedEntry;
-    });
-  } catch { return false; }
+function pickObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
 
-// ── stdin ─────────────────────────────────────────────────────────────────
+function readDispatchContext(event) {
+  const toolInput = pickObject(event.tool_input || event.input);
+  const candidates = [
+    pickObject(event.dispatch),
+    pickObject(event.harness),
+    pickObject(event.permission),
+    pickObject(event.context),
+    pickObject(toolInput.dispatch),
+    pickObject(toolInput.harness),
+    pickObject(toolInput.permission),
+    event,
+  ];
 
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(chunk);
-  }
-  const raw = Buffer.concat(chunks).toString().trim();
-  if (!raw) return {};
-  try { return JSON.parse(raw); } catch { return {}; }
-}
-
-// ── Event handlers ─────────────────────────────────────────────────────────
-
-function handleSessionStart() {
-  // ── Goal persistence: re-inject active goals even if Claude Code cleared them ──
-  const activeGoals = getActiveGoals();
-  if (activeGoals.length > 0) {
-    const goalLines = activeGoals.map((g, i) => `${i + 1}. [${g.id}] ${g.description}`);
-    process.stdout.write([
-      `ACTIVE GOALS (${activeGoals.length}) — Harness-persisted, will NOT auto-clear:`,
-      ...goalLines,
-      'To complete a goal: "goal complete <id>" or "goal done <id>".',
-      'To abandon: "goal abandon <id>".',
-      '',
-    ].join('\n'));
+  const merged = {};
+  for (const candidate of candidates) {
+    for (const key of ['agentRole', 'role', 'writeSet', 'forbidden', 'verification', 'taskId', 'phase']) {
+      if (candidate[key] !== undefined && merged[key] === undefined) {
+        merged[key] = candidate[key];
+      }
+    }
   }
 
-  let mode;
-  try { mode = safeReadJSON(MODE_FILE); } catch {}
-
-  if (!mode?.active) return;
-
-  // Auto-clear stale modes. Missing startedAt → treat as stale (legacy/manual mode files)
-  if (!mode.startedAt) {
-    safeWriteJSON(MODE_FILE, { active: false });
-    return;
+  if (process.env.HARNESS_AGENT_ROLE || process.env.HARNESS_ROLE) {
+    merged.agentRole = process.env.HARNESS_AGENT_ROLE || process.env.HARNESS_ROLE;
   }
-  try {
-    const age = Date.now() - new Date(mode.startedAt).getTime();
-    if (age > STALE_MODE_MS) {
-      safeWriteJSON(MODE_FILE, { active: false });
-      return;
-    }
-  } catch {
-    // Invalid date → treat as stale
-    safeWriteJSON(MODE_FILE, { active: false });
-    return;
+  if (process.env.HARNESS_WRITE_SET !== undefined) merged.writeSet = process.env.HARNESS_WRITE_SET;
+  if (process.env.HARNESS_FORBIDDEN !== undefined) merged.forbidden = process.env.HARNESS_FORBIDDEN;
+  if (process.env.HARNESS_VERIFICATION !== undefined) merged.verification = process.env.HARNESS_VERIFICATION;
+  if (process.env.HARNESS_TASK_ID !== undefined) merged.taskId = process.env.HARNESS_TASK_ID;
+  if (process.env.HARNESS_PHASE !== undefined) merged.phase = process.env.HARNESS_PHASE;
+
+  const agentRole = normalizeRole(merged.agentRole ?? merged.role);
+  if (!agentRole) return null;
+
+  const writeSet = parseList(merged.writeSet);
+  const forbidden = parseList(merged.forbidden);
+  const verification = parseList(merged.verification);
+  if (!writeSet || !forbidden || !verification) return null;
+
+  return {
+    agentRole,
+    writeSet,
+    forbidden,
+    verification,
+    taskId: typeof merged.taskId === 'string' ? sanitizeTaskId(merged.taskId) : undefined,
+    phase: VALID_PHASES.has(merged.phase ?? null) ? merged.phase : undefined,
+    source: 'dispatch',
+  };
+}
+
+function readEmergencyEscalation(mode) {
+  if (mode?.active && mode.agentRole === 'ceo-escalated') {
+    return {
+      agentRole: 'ceo-escalated',
+      writeSet: mode.writeSet || [],
+      forbidden: mode.forbidden || [],
+      verification: [],
+      taskId: mode.taskId,
+      phase: mode.phase,
+      source: 'escalation',
+    };
   }
+  return null;
+}
 
-  const agentRole = mode.agentRole || mode.role || null;
-  // If no valid role, don't inject — enforcement will deny source edits
-  if (!agentRole) return;
-  const phase = mode.phase || 'W0_EXPLORE';
+function isModeActive(mode) {
+  return Boolean(mode?.active && mode.mode);
+}
 
-  if (mode.mode === 'wf-max') {
-    if (agentRole === 'ceo') {
-      process.stdout.write([
-        '═══ WF-MAX CEO MODE — YOU ARE THE ORCHESTRATOR, NOT AN IMPLEMENTER ═══',
-        `Task: ${mode.taskId || 'current'} | Phase: ${phase}`,
-        '',
-        'YOUR IDENTITY: You are CEO. You do NOT write code. You THINK, PLAN, and DELEGATE.',
-        'Every line of source code must be written by a Worker subagent — never by you.',
-        '',
-        'WHAT YOU DO:',
-        '  • Read docs and plan architecture',
-        '  • Grep/Glob to scope the problem',
-        '  • Spawn Workers via Agent tool to implement changes',
-        '  • Write PLAN.md and PROGRESS.md (your ONLY file writes)',
-        '  • Run verification commands via Bash',
-        '',
-        'WHAT YOU NEVER DO:',
-        '  ✗ Edit / Write / MultiEdit any source file',
-        '  ✗ Write code directly — even "just one line"',
-        '  ✗ Bash commands with side effects (npm install, git commit, etc.)',
-        '  ✗ Read source files deeply (delegate to Worker)',
-        '',
-        'IF YOU CATCH YOURSELF about to edit a source file → STOP IMMEDIATELY.',
-        'Say "Delegating to Worker" and spawn an Agent with explicit writeSet.',
-        '',
-        'PreToolUse hook ENFORCES this. You WILL be blocked if you try to write code.',
-        'Save tokens. Save time. Delegate from the start.',
-      ].join('\n'));
-    } else if (agentRole === 'worker') {
-      const ws = mode.writeSet ? ` [writeSet: ${mode.writeSet.join(', ')}]` : ' [no writeSet]';
-      process.stdout.write([
-        `WF-MAX WORKER ACTIVE — Edit only assigned writeSet.${ws}`,
-        `Task: ${mode.taskId || 'current'} | Phase: ${phase}`,
-        '',
-        'WORKER RULES:',
-        '1. Edit only files in your dispatch writeSet.',
-        '2. Do NOT edit files outside writeSet.',
-        '3. If writeSet is empty/missing, source edits are blocked.',
-      ].join('\n'));
-    } else if (agentRole === 'manager') {
-      process.stdout.write([
-        'WF-MAX MANAGER ACTIVE — Scope, review, coordinate.',
-        `Task: ${mode.taskId || 'current'} | Phase: ${phase}`,
-        '',
-        'MANAGER RULES:',
-        '1. Partition domain, dispatch Workers, synthesize results.',
-        '2. Do NOT edit source files directly.',
-        '3. Report to CEO with synthesized findings.',
-      ].join('\n'));
-    } else if (agentRole === 'reviewer') {
-      process.stdout.write([
-        'WF-MAX REVIEWER ACTIVE — Read and report only.',
-        `Task: ${mode.taskId || 'current'} | Phase: ${phase}`,
-        '',
-        'REVIEWER RULES:',
-        '1. Read files, analyze, report findings.',
-        '2. Do NOT edit any files.',
-      ].join('\n'));
-    } else if (agentRole === 'ceo-escalated') {
-      const ws = mode.writeSet ? ` [writeSet: ${mode.writeSet.join(', ')}]` : '';
-      process.stdout.write([
-        '═══ CEO ESCALATED — Workers failed, CEO stepping in ═══',
-        `Task: ${mode.taskId || 'current'} | Phase: ${phase}`,
-        `Reason: ${mode.escalationReason || 'Worker retry limit exceeded'}`,
-        '',
-        `WRITE ONLY: ${mode.writeSet ? mode.writeSet.join(', ') : 'NONE SPECIFIED'}`,
-        'Fix the specific issue, then IMMEDIATELY say "ceo deescalate".',
-        'De-escalation returns you to normal CEO (no source writes).',
-      ].join('\n'));
-    }
-  } else if (mode.mode === 'wf-review') {
-    process.stdout.write([
-      'WF-REVIEW MODE ACTIVE — Cross-model peer review.',
-      'Use Bash to invoke the OTHER CLI (codex/claude). NEVER self-review.',
-      'Your role: prepare context, invoke peer, synthesize findings.',
-    ].join('\n'));
-  } else if (mode.mode === 'wf') {
-    process.stdout.write([
-      'WF MODE ACTIVE — Task-bounded workflow with heartbeat and recovery loop.',
-    ].join('\n'));
-  } else if (mode.mode === 'wf-auto') {
-    process.stdout.write([
-      'WF-AUTO MODE ACTIVE — Perpetual auto-optimization. Never stops until 8-angle exhaustion.',
-    ].join('\n'));
-  } else if (mode.mode === 'wf-auto-spark') {
-    process.stdout.write([
-      'WF-AUTO-SPARK MODE ACTIVE — Perpetual inspiration. External spark search. Roadmap-anchored.',
-    ].join('\n'));
-  } else if (mode.mode === 'wf-learn') {
-    process.stdout.write([
-      'WF-LEARN MODE ACTIVE — Force learning cycle: context-master -> memory-master.',
-    ].join('\n'));
-  }
+function isTaskArtifact(relativePath) {
+  return /^Harness\/tasks\/[^/]+\/(PLAN|PROGRESS|ARTIFACTS|NOTES)\.md$/.test(relativePath)
+    || relativePath === 'Harness/PROGRESS.md'
+    || relativePath === 'Harness/MEMORY.md'
+    || /^Harness\/memory\/[^/]+\.md$/.test(relativePath);
 }
 
-function handleUserPromptSubmit(event) {
-  const prompt = (event.prompt || event.input || '').toString();
-  const lower = prompt.toLowerCase();
+function isForbiddenPath(relativePath, forbidden) {
+  return forbidden.some((entry) => pathMatches(relativePath, entry));
+}
 
-  // ── Goal command detection (Harness-persisted, NOT pattern-match auto-clear) ──
-  const goalSetMatch = prompt.match(/(?:^|\n)\s*(?:goal\s+set|goal\s+add|\/goal)\s+(.+?)(?:\n|$)/i);
-  const goalCompleteMatch = prompt.match(/(?:^|\n)\s*goal\s+(?:complete|done)\s+(\S+)/i);
-  const goalAbandonMatch = prompt.match(/(?:^|\n)\s*goal\s+abandon\s+(\S+)/i);
+function isInWriteSet(relativePath, writeSet) {
+  return writeSet.some((entry) => pathMatches(relativePath, entry));
+}
 
-  if (goalSetMatch) {
-    const desc = goalSetMatch[1].trim().slice(0, MAX_GOAL_DESC);
-    const data = readGoals();
-    const id = 'g' + Date.now().toString(36);
-    data.goals.push({ id, description: desc, status: 'active', createdAt: new Date().toISOString(), completedAt: null });
-    writeGoals(data);
-  }
+function pathMatches(relativePath, pattern) {
+  const normalizedPattern = normalizeProjectPath(pattern);
+  if (!normalizedPattern) return false;
+  return relativePath === normalizedPattern || relativePath.startsWith(normalizedPattern + '/');
+}
 
-  if (goalCompleteMatch) {
-    const id = goalCompleteMatch[1];
-    const data = readGoals();
-    const g = data.goals.find(g => g.id === id && g.status === 'active');
-    if (g) { g.status = 'completed'; g.completedAt = new Date().toISOString(); writeGoals(data); }
-  }
+function isGuardedSourcePath(relativePath) {
+  if (!relativePath) return false;
+  if (relativePath.startsWith('Harness/.runtime/')) return true;
+  if (isTaskArtifact(relativePath)) return false;
+  return true;
+}
 
-  if (goalAbandonMatch) {
-    const id = goalAbandonMatch[1];
-    const data = readGoals();
-    const g = data.goals.find(g => g.id === id && g.status === 'active');
-    if (g) { g.status = 'abandoned'; g.completedAt = new Date().toISOString(); writeGoals(data); }
-  }
+function isSafeBash(command) {
+  const trimmed = String(command || '').trim();
+  if (!trimmed) return true;
+  if (/[\r\n\0]/.test(trimmed)) return false;
+  if (/[;&|>`$]/.test(trimmed)) return false;
+  return SAFE_BASH.test(trimmed);
+}
 
-  // ── CEO escalation / de-escalation ──
-  const escalateMatch = prompt.match(/(?:^|\n)\s*ceo\s+escalate\s+(\S+(?:\s*,\s*\S+)*)(?:\s+"(.+?)")?/i);
-  const deescalateMatch = prompt.match(/(?:^|\n)\s*ceo\s+deescalate/i);
+function outputContext(hookEventName, additionalContext) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName,
+      additionalContext,
+    },
+  }));
+}
 
-  if (escalateMatch) {
+function readEvent() {
+  if (process.argv[3]) {
     try {
-      const mode = safeReadJSON(MODE_FILE);
-      if (mode && mode.agentRole === 'ceo') {
-        const files = escalateMatch[1].split(',').map(f => f.trim()).filter(Boolean);
-        const reason = (escalateMatch[2] || 'Worker retry limit exceeded').slice(0, 200);
-        if (files.length <= MAX_ESCALATION_FILES) {
-          safeWriteJSON(MODE_FILE, {
-            ...mode,
-            agentRole: 'ceo-escalated',
-            writeSet: files,
-            escalationReason: reason,
-            escalatedAt: new Date().toISOString(),
-          });
-        }
-      }
-    } catch {}
+      return JSON.parse(process.argv[3]);
+    } catch {
+      return {};
+    }
   }
-
-  if (deescalateMatch) {
+  if (process.argv[2] && process.argv[2].trim().startsWith('{')) {
     try {
-      const mode = safeReadJSON(MODE_FILE);
-      if (mode && mode.agentRole === 'ceo-escalated') {
-        const { escalationReason, escalatedAt, ...rest } = mode;
-        safeWriteJSON(MODE_FILE, {
-          ...rest,
-          agentRole: 'ceo',
-          writeSet: undefined,
-        });
-      }
-    } catch {}
-  }
-
-  // ── Mode activation detection ──
-  try {
-    const modeConfigs = [
-      { trigger: ['/wf-auto-spark', 'wf auto spark', 'spark mode'], mode: 'wf-auto-spark', taskId: 'wf-auto-spark-current', phase: 'SPARK' },
-      { trigger: ['/wf-max', 'wf max'], mode: 'wf-max', taskId: 'wf-max-current-task', phase: 'W0_EXPLORE' },
-      { trigger: ['/wf-auto', 'wf auto', 'auto mode'], mode: 'wf-auto', taskId: 'wf-auto-current', phase: 'AUTO' },
-      { trigger: ['/wf-review', 'wf review'], mode: 'wf-review', taskId: 'wf-review-current', phase: 'REVIEW' },
-      { trigger: ['/wf-learn', 'wf learn'], mode: 'wf-learn', taskId: 'wf-learn-current', phase: 'LEARN' },
-      { trigger: ['/wf', 'wf mode', 'workflow mode', 'wk mode'], mode: 'wf', taskId: 'wf-current-task', phase: 'W0_EXPLORE' },
-    ];
-    for (const cfg of modeConfigs) {
-      if (cfg.trigger.some(t => lower.includes(t))) {
-        safeWriteJSON(MODE_FILE, {
-          active: true,
-          mode: cfg.mode,
-          agentRole: 'ceo',
-          role: 'ceo',
-          taskId: cfg.taskId,
-          phase: cfg.phase,
-          explicitInvocation: true,
-          startedAt: new Date().toISOString(),
-        });
-        break;
-      }
+      return JSON.parse(process.argv[2]);
+    } catch {
+      return {};
     }
-  } catch {}
-
-  // ── Per-turn reinforcement ──
+  }
   try {
-    // Active goal reminder (always shown, independent of mode)
-    const activeGoals = getActiveGoals();
-    if (activeGoals.length > 0) {
-      const goalReminder = activeGoals.length === 1
-        ? `Active goal: [${activeGoals[0].id}] ${activeGoals[0].description}`
-        : `Active goals (${activeGoals.length}): ` + activeGoals.map(g => `[${g.id}] ${g.description}`).join(' | ');
-      process.stdout.write(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: `GOAL TRACKING: ${goalReminder}. Say "goal complete <id>" when done, "goal abandon <id>" to drop.`,
-        },
-      }));
-    }
-
-    const mode = safeReadJSON(MODE_FILE);
-    if (!mode?.active) return;
-
-    const agentRole = mode.agentRole || mode.role;
-    if (!agentRole) return;
-
-    if (mode.mode === 'wf-max') {
-      const roleText = agentRole === 'ceo'
-        ? `═══ WF-MAX CEO (${mode.phase || 'W0_EXPLORE'}) ═══ YOU ARE CEO, NOT IMPLEMENTER. Do NOT write code. Do NOT edit files. Spawn Workers via Agent tool for ALL source changes. Only write: PLAN.md, PROGRESS.md. Bash: ls/dir/tree/git only. You WILL be blocked if you attempt Edit/Write/MultiEdit.`
-        : agentRole === 'worker'
-        ? `WF-MAX WORKER — Edit only files in dispatch writeSet${mode.writeSet ? ': ' + mode.writeSet.join(', ') : ' (none)'}.`
-        : agentRole === 'manager'
-        ? `WF-MAX MANAGER — Coordinate and synthesize. No source edits.`
-        : agentRole === 'reviewer'
-        ? `WF-MAX REVIEWER — Read and report only. No edits.`
-        : agentRole === 'ceo-escalated'
-        ? `═══ CEO ESCALATED — Fix the issue in ${mode.writeSet ? mode.writeSet.join(',') : 'escalated files'}, then deescalate. ═══`
-        : `WF-MAX ACTIVE — Role: ${agentRole}.`;
-
-      process.stdout.write(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: roleText,
-        },
-      }));
-    } else if (mode.mode === 'wf-review') {
-      process.stdout.write(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: 'WF-REVIEW ACTIVE. Use Bash to invoke the OTHER CLI. NEVER self-review.',
-        },
-      }));
-    } else if (mode.mode === 'wf') {
-      process.stdout.write(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: 'WF MODE ACTIVE — Task-bounded workflow with heartbeat and recovery loop.',
-        },
-      }));
-    } else if (mode.mode === 'wf-auto') {
-      process.stdout.write(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: 'WF-AUTO MODE ACTIVE — Perpetual auto-optimization. Never stops until 8-angle exhaustion.',
-        },
-      }));
-    } else if (mode.mode === 'wf-auto-spark') {
-      process.stdout.write(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: 'WF-AUTO-SPARK MODE ACTIVE — Perpetual inspiration. External spark search. Roadmap-anchored.',
-        },
-      }));
-    } else if (mode.mode === 'wf-learn') {
-      process.stdout.write(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: 'WF-LEARN MODE ACTIVE — Force learning cycle: context-master -> memory-master.',
-        },
-      }));
-    }
-  } catch {}
+    const raw = readFileSync(0, 'utf8').trim();
+    return raw ? JSON.parse(raw) : {};
+  } catch {
+    return {};
+  }
 }
 
-function handlePreToolUse(event) {
-  let mode;
-  try { mode = safeReadJSON(MODE_FILE); } catch {}
-  if (!mode?.active) return;
+function eventName(event) {
+  return event.hook_event_name || event.event || event.type || process.argv[2] || '';
+}
 
-  const toolName = event.tool_name || event.tool || '';
-  if (!BLOCKED_TOOLS.includes(toolName)) return;
+function goalData() {
+  const parsed = readJSONFile(GOALS_FILE, MAX_GOAL_BYTES);
+  if (!parsed || !Array.isArray(parsed.goals)) return { goals: [] };
+  parsed.goals = parsed.goals.filter((goal) =>
+    goal
+    && typeof goal.id === 'string'
+    && typeof goal.description === 'string'
+    && ['active', 'completed', 'abandoned'].includes(goal.status)
+  );
+  return parsed;
+}
 
-  const input = event.tool_input || event.input || {};
-  const filePath = input.file_path || '';
-  const command = input.command || '';
+function writeGoals(data) {
+  writeJSONFile(GOALS_FILE, data);
+}
 
-  const agentRole = mode.agentRole || mode.role || null;
+function activeGoalText() {
+  const goals = goalData().goals.filter((goal) => goal.status === 'active');
+  if (goals.length === 0) return '';
+  if (goals.length === 1) return `GOAL TRACKING: Active goal [${goals[0].id}] ${goals[0].description}.`;
+  return `GOAL TRACKING: Active goals ${goals.map((goal) => `[${goal.id}] ${goal.description}`).join(' | ')}.`;
+}
 
-  // ── No role → deny source edits by default ──
-  if (!agentRole) {
-    if (filePath && (isTaskFile(filePath) || isHarnessMeta(filePath, agentRole))) return; // allow meta
-    if (toolName === 'Bash') {
-      const trimmed = command.trim();
-      if (/^((ls|dir|tree|git\s+status|git\s+diff|git\s+log|git\s+branch|node\s+Harness\/scripts\/[a-z0-9_.-]+\.mjs|which|echo|type|codex|claude)(\s+[^;&|>`$]*)?)$/.test(trimmed)) return;
+function handleSessionStart(event) {
+  let mode = readMode();
+  if (mode?.active) {
+    const startedAt = Date.parse(mode.startedAt || '');
+    if (!startedAt || Date.now() - startedAt > STALE_MODE_MS) {
+      clearMode();
+      mode = null;
     }
-    process.stderr.write(`[WF-MAX BLOCK] ${toolName} blocked: no agentRole set. Define agentRole and writeSet before editing.\n`);
-    process.exit(2);
   }
+  if (!isModeActive(mode)) return;
 
-  // ── CEO: block all source edits ──
-  if (agentRole === 'ceo') {
-    if (toolName === 'Bash') {
-      const trimmed = command.trim();
-      if (/[\r\n\0]/.test(trimmed)) {
-        process.stderr.write('[CEO BLOCK] Bash command contains newlines or control characters.\n');
-        process.exit(2);
-      }
-      if (/[;&|>`$]/.test(trimmed)) {
-        process.stderr.write('[CEO BLOCK] Bash command contains shell metacharacters. Use a Worker.\n');
-        process.exit(2);
-      }
-      const allowed = /^(ls|dir|tree|git\s+status|git\s+diff|git\s+log|git\s+branch|node\s+Harness\/scripts\/[a-z0-9_.-]+\.mjs|which|echo|type|codex|claude)(\s+[^;&|>`$]*)?$/;
-      if (allowed.test(trimmed)) return;
-    }
+  const dispatch = readDispatchContext(event);
+  const role = dispatch?.agentRole || mode.agentRole || mode.role || 'observer';
+  const phase = dispatch?.phase || mode.phase || 'W0_EXPLORE';
+  const taskId = dispatch?.taskId || mode.taskId || 'current';
 
-    if (filePath) {
-      if (isTaskFile(filePath) || isHarnessMeta(filePath, agentRole)) return;
-    }
-
-    process.stderr.write(`[WF-MAX CEO BLOCK] ${toolName} on source files is forbidden for CEO. Delegate to a Worker via Agent tool. File: ${filePath || command}\n`);
-    process.exit(2);
+  if (mode.mode === 'wf-review') {
+    outputContext('SessionStart', `WF-REVIEW MODE ACTIVE\nTask: ${taskId} | Phase: ${phase}\nUse the OTHER CLI. Never self-review.`);
+    return;
   }
 
-  // ── Worker: allow writeSet files only ──
-  if (agentRole === 'worker') {
-    const writeSet = mode.writeSet || [];
-
-    if (toolName === 'Bash') {
-      const trimmed = command.trim();
-      if (/[\r\n\0]/.test(trimmed)) {
-        process.stderr.write('[WORKER BLOCK] Bash command contains control characters.\n');
-        process.exit(2);
-      }
-      // Block shell chaining and redirects (same as CEO)
-      if (/[;&|>`$]/.test(trimmed)) {
-        process.stderr.write('[WORKER BLOCK] Bash command contains shell metacharacters.\n');
-        process.exit(2);
-      }
-      return; // Allow safe bash for workers (test running, build, etc.)
-    }
-
-    if (filePath) {
-      if (isTaskFile(filePath) || isHarnessMeta(filePath, agentRole)) return;
-      if (isInWriteSet(filePath, writeSet)) return;
-      process.stderr.write(`[WF-MAX WORKER BLOCK] ${toolName} on "${filePath}" is outside writeSet [${writeSet.join(', ')}].\n`);
-      process.exit(2);
-    }
-
-    // No filePath? Allow (tool call without file target)
+  if (mode.mode === 'wf-max') {
+    const writeSet = dispatch?.writeSet?.length ? `\nwriteSet: ${dispatch.writeSet.join(', ')}` : '';
+    outputContext('SessionStart', `WF-MAX ACTIVE\nTask: ${taskId} | Phase: ${phase}\nRole: ${role}${writeSet}\nMode file is status only; dispatch context grants source-write authority.`);
     return;
   }
 
-  // ── Manager: no source edits (like CEO but can run more bash) ──
-  if (agentRole === 'manager') {
-    if (toolName === 'Bash') {
-      const trimmed = command.trim();
-      if (/[\r\n\0]/.test(trimmed)) {
-        process.stderr.write('[MANAGER BLOCK] Bash command contains control characters.\n');
-        process.exit(2);
-      }
-      if (/[;&|>`$]/.test(trimmed)) {
-        process.stderr.write('[MANAGER BLOCK] Bash command contains shell metacharacters.\n');
-        process.exit(2);
-      }
-      const allowed = /^(ls|dir|tree|git\s+status|git\s+diff|git\s+log|git\s+branch|node\s+Harness\/scripts\/[a-z0-9_.-]+\.mjs|which|echo|type|codex|claude)(\s+[^;&|>`$]*)?$/;
-      if (allowed.test(trimmed)) return;
-    }
+  outputContext('SessionStart', `${String(mode.mode).toUpperCase()} ACTIVE\nTask: ${taskId} | Phase: ${phase}`);
+}
+
+function handleGoalCommands(prompt) {
+  const setMatch = prompt.match(/(?:^|\n)\s*goal\s+set\s+(.+)/i);
+  const completeMatch = prompt.match(/(?:^|\n)\s*goal\s+complete\s+(\S+)/i);
+  const abandonMatch = prompt.match(/(?:^|\n)\s*goal\s+abandon\s+(\S+)/i);
+
+  if (setMatch) {
+    const data = goalData();
+    data.goals.push({
+      id: 'g' + Date.now().toString(36),
+      description: setMatch[1].trim().slice(0, MAX_GOAL_DESC),
+      status: 'active',
+      createdAt: new Date().toISOString(),
+      completedAt: null,
+    });
+    writeGoals(data);
+  }
 
-    if (filePath) {
-      if (isTaskFile(filePath) || isHarnessMeta(filePath, agentRole)) return;
+  for (const [match, status] of [[completeMatch, 'completed'], [abandonMatch, 'abandoned']]) {
+    if (!match) continue;
+    const data = goalData();
+    const goal = data.goals.find((item) => item.id === match[1] && item.status === 'active');
+    if (goal) {
+      goal.status = status;
+      goal.completedAt = new Date().toISOString();
+      writeGoals(data);
     }
+  }
+}
 
-    process.stderr.write(`[WF-MAX MANAGER BLOCK] ${toolName} on source files is forbidden for Manager. Delegate to Workers.\n`);
-    process.exit(2);
+function handleEscalationCommands(prompt) {
+  if (/(?:^|\n)\s*ceo\s+done\b/i.test(prompt)) {
+    clearMode();
+    return true;
   }
 
-  // ── Reviewer: no edits at all ──
-  if (agentRole === 'reviewer') {
-    if (toolName === 'Bash') {
-      const trimmed = command.trim();
-      if (/[\r\n\0]/.test(trimmed)) {
-        process.stderr.write('[REVIEWER BLOCK] Bash command contains control characters.\n');
-        process.exit(2);
-      }
-      const allowed = /^(ls|dir|tree|git\s+status|git\s+diff|git\s+log|git\s+branch|which|echo|type)(\s+[^;&|>`$]*)?$/;
-      if (allowed.test(trimmed)) return;
+  const escalateMatch = prompt.match(/(?:^|\n)\s*ceo\s+escalate\s+(\S+(?:\s*,\s*\S+)*)(?:\s+"(.+?)")?/i);
+  if (escalateMatch) {
+    const mode = readMode();
+    const files = parseList(escalateMatch[1]);
+    if (!mode?.active || !files || files.length !== MAX_ESCALATION_FILES || files.some((file) => !normalizeProjectPath(file))) {
+      outputContext('UserPromptSubmit', 'CEO escalation denied. Provide exactly one project-relative file path.');
+      return true;
     }
+    writeJSONFile(MODE_FILE, {
+      ...mode,
+      agentRole: 'ceo-escalated',
+      writeSet: files,
+      escalationReason: (escalateMatch[2] || 'Worker retry limit exceeded').slice(0, 200),
+      escalatedAt: new Date().toISOString(),
+    });
+    outputContext('UserPromptSubmit', `CEO escalation active for ${files[0]}. Say "ceo deescalate" when finished.`);
+    return true;
+  }
 
-    if (filePath) {
-      if (isTaskFile(filePath) || isHarnessMeta(filePath, agentRole)) return;
+  if (/(?:^|\n)\s*ceo\s+deescalate\b/i.test(prompt)) {
+    const mode = readMode();
+    if (mode?.active) {
+      const { writeSet, forbidden, escalationReason, escalatedAt, ...rest } = mode;
+      writeJSONFile(MODE_FILE, {
+        ...rest,
+        agentRole: 'ceo',
+        deescalatedAt: new Date().toISOString(),
+      });
     }
-
-    process.stderr.write(`[WF-MAX REVIEWER BLOCK] ${toolName} is forbidden for Reviewer. Read and report only.\n`);
-    process.exit(2);
+    outputContext('UserPromptSubmit', 'CEO escalation cleared. Source writes are blocked again.');
+    return true;
   }
 
-  // ── CEO-Escalated: can write escalated files only ──
-  if (agentRole === 'ceo-escalated') {
-    const writeSet = mode.writeSet || [];
+  return false;
+}
 
-    if (toolName === 'Bash') {
-      const trimmed = command.trim();
-      if (/[\r\n\0]/.test(trimmed)) {
-        process.stderr.write('[ESCALATED BLOCK] Bash command contains control characters.\n');
-        process.exit(2);
-      }
-      if (/[;&|>`$]/.test(trimmed)) {
-        process.stderr.write('[ESCALATED BLOCK] Bash command contains shell metacharacters.\n');
-        process.exit(2);
-      }
-      const allowed = /^(ls|dir|tree|git\s+status|git\s+diff|git\s+log|git\s+branch|node\s+Harness\/scripts\/[a-z0-9_.-]+\.mjs|which|echo|type|codex|claude|npm\s+test|npm\s+run)(\s+[^;&|>`$]*)?$/;
-      if (allowed.test(trimmed)) return;
+function detectMode(prompt) {
+  const lower = prompt.toLowerCase();
+  const configs = [
+    { triggers: ['/wf-auto-spark', 'wf auto spark', 'spark mode'], mode: 'wf-auto-spark', taskId: 'wf-auto-spark-current', phase: 'SPARK' },
+    { triggers: ['/wf-max', 'wf max'], mode: 'wf-max', taskId: 'wf-max-current-task', phase: 'W0_EXPLORE' },
+    { triggers: ['/wf-auto', 'wf auto', 'auto mode'], mode: 'wf-auto', taskId: 'wf-auto-current', phase: 'AUTO' },
+    { triggers: ['/wf-review', 'wf review'], mode: 'wf-review', taskId: 'wf-review-current', phase: 'REVIEW' },
+    { triggers: ['/wf-learn', 'wf learn'], mode: 'wf-learn', taskId: 'wf-learn-current', phase: 'LEARN' },
+    { triggers: ['/wf', 'wf mode', 'workflow mode', 'wk mode'], mode: 'wf', taskId: 'wf-current-task', phase: 'W0_EXPLORE' },
+  ];
+
+  for (const config of configs) {
+    if (config.triggers.some((trigger) => lower.includes(trigger))) {
+      writeJSONFile(MODE_FILE, {
+        active: true,
+        mode: config.mode,
+        agentRole: 'ceo',
+        taskId: config.taskId,
+        phase: config.phase,
+        explicitInvocation: true,
+        startedAt: new Date().toISOString(),
+      });
+      return config;
     }
+  }
+  return null;
+}
 
-    if (filePath) {
-      if (isTaskFile(filePath) || isHarnessMeta(filePath, 'ceo')) return;
-      if (isInWriteSet(filePath, writeSet)) return;
-      process.stderr.write(`[ESCALATED BLOCK] ${toolName} on "${filePath}" is outside escalation writeSet [${writeSet.join(', ')}]. Say "ceo deescalate" to return to normal CEO.\n`);
-      process.exit(2);
+function handleUserPromptSubmit(event) {
+  const prompt = String(event.prompt || event.text || '').trim();
+  if (!prompt) return;
+
+  handleGoalCommands(prompt);
+  if (handleEscalationCommands(prompt)) return;
+  detectMode(prompt);
+
+  const goalText = activeGoalText();
+  const mode = readMode();
+  if (!goalText && !isModeActive(mode)) return;
+
+  const dispatch = readDispatchContext(event);
+  const contextLines = [];
+  if (goalText) contextLines.push(goalText);
+  if (isModeActive(mode)) {
+    if (mode.mode === 'wf-review') {
+      contextLines.push('WF-REVIEW ACTIVE. Use the OTHER CLI. Never self-review.');
+    } else if (mode.mode === 'wf-max') {
+      const role = dispatch?.agentRole || mode.agentRole || 'observer';
+      contextLines.push(`WF-MAX ACTIVE. Role: ${role}. Source-write authority comes from dispatch context, not the mode file.`);
+    } else {
+      contextLines.push(`${String(mode.mode).toUpperCase()} ACTIVE.`);
     }
-    return;
   }
+  if (contextLines.length) outputContext('UserPromptSubmit', contextLines.join('\n'));
 }
 
-// ── Memory auto-capture (PostToolUse) ──────────────────────────────────────
+function allowTaskArtifact(agentRole, relativePath) {
+  if (!isTaskArtifact(relativePath)) return false;
+  return agentRole === 'ceo' || agentRole === 'manager' || agentRole === 'ceo-escalated';
+}
 
-const MEMORY_DIR = join(__dirname, '..', 'memory');
-const MEMORY_FILES = {
-  toolReflections: join(MEMORY_DIR, 'tool-usage-reflections.md'),
-  userCorrections: join(MEMORY_DIR, 'user-corrections-preferences.md'),
-  agentLessons:    join(MEMORY_DIR, 'agent-lessons-patterns.md'),
-};
-const EPISODE_BUFFER = []; // Batched significant events
-const EPISODE_FLUSH_SIZE = 5;
-const SESSION_EVENTS = []; // Tracked for Stop hook summary
+function block(message) {
+  process.stderr.write(message + '\n');
+  process.exit(2);
+}
 
-// Captured in UserPromptSubmit: last user prompt text
-let _lastPrompt = '';
+function enforceFileTool(agentRole, relativePath, context) {
+  if (!relativePath) block('[BLOCK] Invalid or unsafe file path.');
+  if (isForbiddenPath(relativePath, context.forbidden || [])) {
+    block(`[FORBIDDEN BLOCK] ${relativePath} matches forbidden scope.`);
+  }
+  if (!isGuardedSourcePath(relativePath) && allowTaskArtifact(agentRole, relativePath)) return;
 
-function isSignificantError(stderr, stdout) {
-  const combined = (stderr + stdout).toLowerCase();
-  const patterns = [
-    /\berror\b/, /\bfail(?:ed|ure)?\b/, /\bexception\b/, /\btraceback\b/,
-    /\bpanic\b/, /\bfatal\b/, /\btimeout\b/, /\bdenied\b/, /\bblock(?:ed)?\b/,
-    /\bpermission denied\b/, /\bnot found\b/i, /\bout of memory\b/i,
-  ];
-  return patterns.some(p => p.test(combined));
+  if (agentRole === 'reviewer') {
+    block(`[REVIEWER BLOCK] ${relativePath} cannot be edited by reviewer.`);
+  }
+  if (agentRole === 'ceo') {
+    block(`[CEO BLOCK] ${relativePath} is a source write. Delegate to a Worker or use ceo escalate <file>.`);
+  }
+  if (agentRole === 'worker' || agentRole === 'manager' || agentRole === 'ceo-escalated') {
+    if (isInWriteSet(relativePath, context.writeSet || [])) return;
+    const label = agentRole === 'ceo-escalated' ? 'ESCALATED BLOCK' : `${agentRole.toUpperCase()} BLOCK`;
+    block(`[${label}] ${relativePath} is outside writeSet [${(context.writeSet || []).join(', ')}].`);
+  }
+  block(`[ROLE BLOCK] ${relativePath} blocked for role ${agentRole}.`);
 }
 
-function isTestResult(stdout) {
-  return /\b(tests?|pass(?:ed)?|fail(?:ed)?)\s+\d+/i.test(stdout) ||
-         /(\d+)\s+(passed|failed)/i.test(stdout);
+function enforceBash(agentRole, command) {
+  if (isSafeBash(command)) return;
+  block(`[${agentRole.toUpperCase()} BLOCK] Bash command is outside the safe command policy.`);
 }
 
-function isUserCorrectionIntent(prompt) {
-  const patterns = [
-    /记住|记下来|别忘了|don'?t\s+forget|remember\s+this/i,
-    /我(说了|告诉过).*记住/i, /correction/i,
-    /不要.*再|别再|以后.*不要|下次.*不要/i,
-  ];
-  return patterns.some(p => p.test(prompt));
-}
+function handlePreToolUse(event) {
+  const mode = readMode();
+  const dispatch = readDispatchContext(event);
+  const emergencyEscalation = dispatch ? null : readEmergencyEscalation(mode);
+  const context = dispatch || emergencyEscalation;
 
-function appendMemory(filePath, entry) {
-  try {
-    mkdirSync(dirname(filePath), { recursive: true });
-    const ts = new Date().toISOString().replace('T', ' ').slice(0, 19);
-    const header = `\n### ${ts} — auto-captured by wf-mode-hook\n\n${entry}\n`;
-    const fd = openSync(filePath, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND, 0o644);
-    writeSync(fd, header);
-    closeSync(fd);
-  } catch {}
-}
+  if (!context && !isModeActive(mode)) return;
 
-function flushEpisodeBuffer() {
-  if (EPISODE_BUFFER.length === 0) return;
-  const batch = EPISODE_BUFFER.splice(0);
-  const entry = batch.map(e => `- [${e.type}] ${e.tool}: ${e.summary.slice(0, 200)}`).join('\n');
-  appendMemory(MEMORY_FILES.toolReflections, `**Batch (${batch.length} events)**\n${entry}`);
-  SESSION_EVENTS.push({ type: 'batch', count: batch.length, summary: batch[0]?.summary });
-}
+  const toolName = event.tool_name || event.tool || '';
+  if (!GUARDED_TOOLS.has(toolName)) return;
 
-function handlePostToolUse(event) {
-  try {
-    const toolName = event.tool_name || event.tool || '';
-    const stderr = (event.stderr || event.tool_stderr || '').toString();
-    const stdout = (event.stdout || event.tool_stdout || '').toString();
-
-    // ── Error auto-capture ──
-    if (isSignificantError(stderr, stdout)) {
-      const summary = stderr.slice(0, 300).replace(/\n/g, ' ').trim() ||
-                      stdout.slice(0, 300).replace(/\n/g, ' ').trim();
-      EPISODE_BUFFER.push({ type: 'error', tool: toolName, summary, ts: Date.now() });
-
-      // Immediate write for critical errors (exit code 2 = blocked by hook)
-      if (stderr.includes('BLOCK') || stderr.includes('exit 2') || event.exit_code === 2) {
-        appendMemory(MEMORY_FILES.toolReflections,
-          `**Hook blocked**: \`${toolName}\` — ${summary}\n` +
-          `> Reason: ${stderr.slice(0, 200)}\n`);
-      }
-    }
+  const toolInput = pickObject(event.tool_input || event.input);
+  const command = toolInput.command || '';
+  const relativePath = normalizeProjectPath(toolInput.file_path || '');
 
-    // ── Test result capture ──
-    if (isTestResult(stdout)) {
-      const lines = stdout.split('\n').filter(l => /\b(pass|fail|test)/i.test(l));
-      if (lines.length > 0) {
-        appendMemory(MEMORY_FILES.agentLessons,
-          `**Test run** (\`${toolName}\`):\n${lines.slice(0, 5).map(l => `> ${l.trim()}`).join('\n')}\n`);
-      }
-    }
+  if (!context) {
+    if (toolName === 'Bash' && isSafeBash(command)) return;
+    if (relativePath && isTaskArtifact(relativePath)) return;
+    block(`[WF-MAX BLOCK] ${toolName} blocked: no dispatch role/writeSet authority is present.`);
+  }
 
-    // ── Flush buffer when full ──
-    if (EPISODE_BUFFER.length >= EPISODE_FLUSH_SIZE) {
-      flushEpisodeBuffer();
-    }
+  if (toolName === 'Bash') {
+    enforceBash(context.agentRole, command);
+    return;
+  }
 
-    // ── User correction capture (checked against last prompt) ──
-    if (_lastPrompt && isUserCorrectionIntent(_lastPrompt)) {
-      appendMemory(MEMORY_FILES.userCorrections,
-        `**User directive**: ${_lastPrompt.slice(0, 300)}\n` +
-        `> Context: after \`${toolName}\` tool call\n`);
-      _lastPrompt = ''; // Reset — one correction per trigger
-    }
-  } catch {}
+  enforceFileTool(context.agentRole, relativePath, context);
 }
 
-function handleStop() {
-  try {
-    // Flush remaining buffer
-    flushEpisodeBuffer();
-
-    // Write session summary if significant events occurred
-    if (SESSION_EVENTS.length > 0) {
-      const ts = new Date().toISOString().replace('T', ' ').slice(0, 19);
-      const summary = [
-        `## Session Summary — ${ts}`,
-        `- Events captured: ${SESSION_EVENTS.length}`,
-        ...SESSION_EVENTS.slice(0, 10).map(e =>
-          `  - ${e.type}: ${(e.summary || '').slice(0, 100)}`),
-        '',
-      ].join('\n');
-      appendMemory(MEMORY_FILES.toolReflections, summary);
-    }
-  } catch {}
+function handlePostToolUse() {
+  return;
 }
 
-// ── main ───────────────────────────────────────────────────────────────────
-
-const event = await readStdin();
-const eventType = event.hook_event_name || event.event || event.type || '';
-
-// Capture user prompt for PostToolUse correlation
-if (eventType === 'UserPromptSubmit') {
-  _lastPrompt = (event.prompt || event.input || '').toString();
+function handleStop() {
+  return;
 }
 
-switch (eventType) {
+const event = readEvent();
+
+switch (eventName(event)) {
   case 'SessionStart':
-    handleSessionStart();
+    handleSessionStart(event);
     break;
   case 'UserPromptSubmit':
     handleUserPromptSubmit(event);
@@ -891,5 +640,3 @@ switch (eventType) {
   default:
     break;
 }
-
-process.exit(0);