nccgs 2.0.0 → 2.1.1

package/tests/unity-transport.test.mjs

@@ -0,0 +1,348 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import {spawnSync} from "node:child_process";
+import {fileURLToPath} from "node:url";
+import test from "node:test";
+import {launchPlan} from "../scripts/run.mjs";
+import {supervise} from "../scripts/supervise.mjs";
+import {guardTool} from "../.claude/nccgs/tools/tool-guard.mjs";
+import {initializeStandalone} from "../.claude/nccgs/tools/lifecycle.mjs";
+import {reserve} from "../.claude/nccgs/tools/orchestration.mjs";
+import {observe} from "../.claude/nccgs/tools/runtime.mjs";
+import {assertStrictUnityCliArgs,unityCliMcpArgs} from "../.claude/nccgs/tools/unity-transport.mjs";
+import {permissionModeArgs} from "../.claude/nccgs/tools/autonomy.mjs";
+
+// Offline synthetic fixtures: admission is not actual tool/provider execution.
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),"..");
+function fixture() {
+  const base=fs.realpathSync(os.tmpdir()),project=fs.mkdtempSync(path.join(base,"nccgs-cli-transport-"));
+  const write=(rel,value)=>{const f=path.join(project,rel);fs.mkdirSync(path.dirname(f),{recursive:true});fs.writeFileSync(f,typeof value==="string"||Buffer.isBuffer(value)?value:JSON.stringify(value));return f;};
+  for(const file of ["studio.json","pipeline.json"])write(".claude/nccgs/"+file,fs.readFileSync(path.join(root,".claude/nccgs",file)));
+  write(".claude/nccgs/install-state.json",{});
+  write(".nccgs/project.yaml","schema_version: 2\nmodels:\n  profile: claude-standalone\n");
+  write(".nccgs/execution.json",{schemaVersion:1,name:"standalone",externalReview:{mode:"off"},acceptanceRequired:false,requireObservedEffort:false,maxParallelWorkers:2});
+  write(".nccgs/requirements.yaml","schema_version: 1\nrequirements: []\n");
+  write("Assets/synthetic.cs","// Synthetic admission fixture, not an engine project.\n");
+  const env={...process.env};for(const k of ["CLAUDECODE","CLAUDE_CODE_ENTRYPOINT","NCCGS_PROJECT_ROOT","NCCGS_TASK_AUTONOMY"])delete env[k];
+  const plan=(...args)=>launchPlan(["--project",project,"--dry-run","--",...args],env);
+  const worker=()=>{
+    write(".nccgs/intake.json",{schemaVersion:1,mode:"implement",objective:"Synthetic transport guard regression",scope:"local",target:"fix",readiness:"ready",requiredChecks:["synthetic"],acceptance:[]});
+    initializeStandalone(project,"synthetic",{intake:".nccgs/intake.json"});
+    write(".nccgs/runtime/bindings/synthetic-session.json",{taskId:"synthetic"});
+    const d=reserve(project,"synthetic",{kind:"implementation",agent:"nccgs-fast-implementer",requestKey:"synthetic",reason:"Synthetic admission only",writePaths:["Assets/synthetic.cs"]});
+    guardTool(project,{session_id:"synthetic-session",tool_name:"Agent",tool_use_id:"synthetic-use",tool_input:{subagent_type:d.agent,prompt:`[NCCGS-DISPATCH:${d.id}] synthetic`}});
+    observe(project,{session_id:"synthetic-session",agent_id:"synthetic-worker",agent_type:d.agent},"agent_start");
+    return (name,input)=>guardTool(project,{session_id:"synthetic-session",agent_id:"synthetic-worker",tool_name:name,tool_input:input});
+  };
+  return {project,write,env,plan,worker,dispose(){assert.equal(path.dirname(fs.realpathSync(project)),base);assert.ok(path.basename(project).startsWith("nccgs-cli-transport-"));assert.equal(fs.lstatSync(project).isSymbolicLink(),false);fs.rmSync(project,{recursive:true,force:true});}};
+}
+test("launcher isolates MCP by default and preserves prompt/model arguments",()=>{
+  const f=fixture();try{
+    const p=f.plan("--print","literal ; $(data)","--model","sonnet");
+    assert.equal(p.args.filter(x=>x==="--strict-mcp-config").length,1);
+    assert.equal(p.args[p.args.indexOf("--mcp-config")+1],'{"mcpServers":{}}');
+    // R08 intentional order change: owned prefix, strict flag, then caller arguments.
+    assert.deepEqual(p.args.slice(0,3),["--permission-mode","default","--strict-mcp-config"]);
+    assert.deepEqual(p.args.slice(3,7),["--print","literal ; $(data)","--model","sonnet"]);
+  }finally{f.dispose();}
+});
+test("launcher accepts explicit non-Unity MCP JSON and configuration files",()=>{
+  const f=fixture();try{
+    const cfg=JSON.stringify({mcpServers:{graphify:{command:"node",args:["approved-server.mjs"]}}});
+    for(const arg of [cfg,f.write("approved-mcp.json",cfg)]){
+      const p=f.plan("--strict-mcp-config","--mcp-config",arg);
+      assert.equal(p.args.filter(x=>x==="--strict-mcp-config").length,1);
+      assert.equal(p.args[p.args.indexOf("--mcp-config")+1],arg);
+    }
+  }finally{f.dispose();}
+});
+for(const [label,server]of Object.entries({
+  coplay:{unityMCP:{command:"uvx",args:["--from","mcpforunityserver==10.1.2","mcp-for-unity"]}},
+  disguised:{other:{command:"uvx",args:["--from","mcpforunityserver","mcp-for-unity"]}},
+  official:{editor:{command:"unity",args:["mcp"]}},
+  officialPath:{editor:{command:"C:/Program Files/Unity/unity.exe",args:["mcp"]}},
+  anklebreaker:{legacy:{command:"npx",args:["com.anklebreaker.unity-mcp"]}},
+  remote:{other:{url:"https://unity-mcp.example.test/mcp"}},
+  remoteCoplay:{other:{url:"https://coplay.dev/mcp"}}
+}))test("launcher rejects Unity MCP configuration: "+label,()=>{
+  const f=fixture();try{assert.throws(()=>f.plan("--mcp-config="+JSON.stringify({mcpServers:server})),/Unity CLI-only/);}finally{f.dispose();}
+});
+test("launcher rejects malformed, duplicate and weakening MCP options",()=>{
+  const f=fixture();try{
+    for(const args of [["--strict-mcp-config=false"],["--strict-mcp-config","--strict-mcp-config"],["--mcp-config"],["--mcp-config","missing.json"],["--mcp-config","{broken"],["--mcp-config","[]"],["--mcp-config",'{"mcpServers":[]}'],["--mcp-config",'{"mcpServers":{"notes":false}}'],["--mcp-config",'{"mcpServers":{}}',"--mcp-config",'{"mcpServers":{}}']])
+      assert.throws(()=>f.plan(...args),/Unity CLI-only/);
+  }finally{f.dispose();}
+});
+const forbiddenShell=[
+  "unity mcp","unity mcp configure codex","UNITY.EXE MCP --project-path .",'& "C:\\Program Files\\Unity\\unity.exe" mcp',
+  "echo before; unity mcp configure claude",'cmd /c "unity mcp configure codex"',"pwsh -Command 'unity mcp'",
+  "bash -c 'unity mcp'","& $env:UNITY_CLI mcp",'unity m`cp configure codex',
+  "uvx --from mcpforunityserver==10.1.2 mcp-for-unity --transport stdio","uv tool run mcp-for-unity",
+  "pip install mcpforunityserver","npx unity-mcp","python -m mcpforunityserver","mcp-for-unity --transport http",
+  "git clone https://github.com/CoplayDev/unity-mcp.git", "& { unity mcp configure codex }",
+  "${UNITY_CLI} mcp", "echo before\nunity mcp", 'Start-Process unity -ArgumentList "mcp configure codex"',
+  "Invoke-Expression 'unity mcp'"
+];
+test("correlated implementation rejects Unity MCP tools and registration shells",()=>{
+  const f=fixture();try{
+    const admit=f.worker();
+    for(const tool of ["mcp__unityMCP__get_state","mcp__UnityMCP__read_console","mcp__unity__execute","mcp__plugin_unity_editor__query","mcp__Coplay__inspect","mcp__anklebreaker__scene"])
+      assert.throws(()=>admit(tool,{}),/Unity CLI-only/);
+    for(const command of forbiddenShell)assert.throws(()=>admit("PowerShell",{command}),/Unity CLI-only/,command);
+    for(const command of ["unity status --format json","unity run . --format json","unity test . --mode EditMode",'& "C:\\Program Files\\Unity\\unity.exe" command eval code',"rg mcpforunityserver README.md","Write-Output 'unity mcp configure codex'","git diff -- unity-mcp-notes.md"])
+      assert.doesNotThrow(()=>admit("PowerShell",{command}),command);
+    assert.doesNotThrow(()=>admit("mcp__graphify__context",{}));
+    // The transport checker permits documentary data; lifecycle ownership still blocks a worker report.
+    assert.throws(()=>admit("PowerShell",{command:"node .claude/nccgs/tools/task.mjs report --id synthetic --summary \"CoplayDev/unity-mcp refused\""}),/Coordinator owns lifecycle commands/);
+  }finally{f.dispose();}
+});
+test("transport hook rejects Unity MCP before task/profile setup but permits direct CLI",()=>{
+  const f=fixture();try{
+    const hook=path.join(root,".claude/nccgs/hooks/unity-transport-guard.mjs");
+    for(const input of [{tool_name:"mcp__unityMCP__instances",tool_input:{}},...forbiddenShell.map(command=>({tool_name:"Bash",tool_input:{command}}))]){
+      const r=spawnSync(process.execPath,[hook],{cwd:f.project,input:JSON.stringify(input),encoding:"utf8"});
+      assert.equal(r.status,2,r.stderr);assert.match(r.stderr,/Unity CLI-only/);
+    }
+    const good=spawnSync(process.execPath,[hook],{cwd:f.project,input:JSON.stringify({tool_name:"PowerShell",tool_input:{command:"unity build . --format json"}}),encoding:"utf8"});
+    assert.equal(good.status,0,good.stderr);
+    const bad=spawnSync(process.execPath,[hook],{input:"{invalid",encoding:"utf8"});assert.equal(bad.status,2);
+  }finally{f.dispose();}
+});
+test("supervisor refuses unsafe retained arguments without editing its run or task budgets",async()=>{
+  const f=fixture();try{
+    const id=crypto.randomUUID(),rel=`.nccgs/runs/${id}/run.json`;
+    const state={schemaVersion:1,id,project:f.project,binary:process.execPath,permissionMode:"guarded",providerArgs:["--print","old retained arguments"],taskId:"historical-task",cumulativeCostUsd:3.5,invocations:[{status:"finished"}]};
+    const file=f.write(rel,state),before=fs.readFileSync(file);
+    await assert.rejects(supervise({project:f.project,binary:process.execPath,mode:"guarded",env:f.env,supervision:{recoverRun:id}}),/strict MCP isolation/);
+    assert.deepEqual(fs.readFileSync(file),before);
+    assert.equal(fs.existsSync(path.join(f.project,".nccgs/runs/task-historical-task.lock")),false);
+  }finally{f.dispose();}
+});
+
+test("supervisor revalidates an explicit file without rewriting retained state",async()=>{
+  const f=fixture();try{
+    const config=f.write("explicit-mcp.json",{mcpServers:{notes:{command:"node",args:["approved.mjs"]}}});
+    const plan=f.plan("--mcp-config",config,"--print","retained");
+    const id=crypto.randomUUID(),rel=`.nccgs/runs/${id}/run.json`;
+    const state={schemaVersion:1,id,project:f.project,binary:process.execPath,permissionMode:"guarded",providerArgs:plan.args,taskId:"historical-task",cumulativeCostUsd:3.5,invocations:[{status:"finished"}]};
+    const file=f.write(rel,state),before=fs.readFileSync(file);
+    f.write("explicit-mcp.json",{mcpServers:{editor:{command:"unity",args:["mcp"]}}});
+    await assert.rejects(supervise({project:f.project,binary:process.execPath,mode:"guarded",env:f.env,supervision:{recoverRun:id}}),/Unity MCP servers are forbidden/);
+    assert.deepEqual(fs.readFileSync(file),before);
+    assert.equal(fs.existsSync(path.join(f.project,".nccgs/runs/task-historical-task.lock")),false);
+  }finally{f.dispose();}
+});
+
+test("review F1 keeps positional prompts outside variadic MCP configuration",()=>{
+  const f=fixture();try{
+    for(const input of [["literal prompt"],["--print","literal prompt"],["--","--literal prompt"]]){
+      const p=f.plan(...input),i=p.args.indexOf("--mcp-config");
+      assert.ok(i>=0);
+      assert.equal(p.args[i+1],'{"mcpServers":{}}');
+      assert.ok(i+2===p.args.length||p.args[i+2]==="--","No bare argument may follow the one validated variadic config");
+      assert.ok(p.args.includes(input.at(-1)),"Prompt literal must survive");
+    }
+    const p=f.plan("--mcp-config",'{"mcpServers":{}}',"second.json");
+    assert.equal(p.args.at(-1),'{"mcpServers":{}}');
+    assert.ok(p.args.indexOf("second.json")<p.args.indexOf("--mcp-config"),"An extra positional value cannot be loaded as another MCP config");
+  }finally{f.dispose();}
+});
+test("review F2 rejects ordinary Claude and Codex Unity MCP registration",()=>{
+  const f=fixture();try{
+    const admit=f.worker();
+    for(const command of ["claude mcp add unityMCP -- uvx mcp-for-unity",`claude mcp add-json editor '{"command":"unity","args":["mcp"]}'`,"codex mcp add unity -- unity mcp","claude mcp add editor --url https://unity-mcp.example.test/mcp","pnpm dlx unity-mcp","bunx unity-mcp","bash -lc 'unity mcp'"])
+      assert.throws(()=>admit("PowerShell",{command}),/Unity CLI-only/,command);
+    for(const command of ["claude mcp add graphify -- node approved.mjs","codex mcp add community -- node approved.mjs","claude mcp remove unityMCP"])
+      assert.doesNotThrow(()=>admit("PowerShell",{command}),command);
+  }finally{f.dispose();}
+});
+test("review F3 preserves non-Unity community identities and method names",()=>{
+  const f=fixture();try{
+    assert.doesNotThrow(()=>f.plan("--mcp-config",JSON.stringify({mcpServers:{community:{command:"node",args:["approved.mjs"]}}})));
+    const admit=f.worker();
+    for(const name of ["mcp__graphify__get_community","mcp__community__context","mcp__pixellab__community_assets"])
+      assert.doesNotThrow(()=>admit(name,{}),name);
+  }finally{f.dispose();}
+});
+// R08 R-01: strict isolation precedes every caller-controlled argument, so a
+// forwarded value-taking option missing its value can never consume it.
+const EMPTY='{"mcpServers":{}}';
+function assertSafeLayout(args,label){
+  assert.deepEqual(args.slice(0,3),["--permission-mode","default","--strict-mcp-config"],label);
+  assert.equal(args.filter(x=>x==="--strict-mcp-config").length,1,label);
+  const configs=args.map((x,i)=>x==="--mcp-config"||x.startsWith("--mcp-config=")?i:-1).filter(i=>i>=0);
+  assert.equal(configs.length,1,label);
+  const i=configs[0];
+  assert.ok(i+2===args.length||args[i+2]==="--",label+": config must end argv or precede --");
+}
+test("R08 R-01 dangling value-taking options cannot consume strict MCP isolation",()=>{
+  const f=fixture();try{
+    for(const input of [["--model"],["--print","prompt","--append-system-prompt"],["--allowedTools"],["--add-dir"],["--model","--","literal prompt"],["--fallback-model","--mcp-config",EMPTY]]){
+      const p=f.plan(...input),label=JSON.stringify(input);
+      assertSafeLayout(p.args,label);
+      for(const option of input.filter(x=>x.startsWith("--")&&x!=="--"&&x!=="--mcp-config"&&x!=="--print"))
+        assert.notEqual(p.args[p.args.indexOf(option)+1],"--strict-mcp-config",label);
+      // Every caller token appears after the strict flag.
+      for(const token of input.filter(x=>x!=="--mcp-config"&&x!==EMPTY))assert.ok(p.args.indexOf(token)>2,label);
+      assert.doesNotThrow(()=>assertStrictUnityCliArgs(p.args,f.project,permissionModeArgs("guarded")),label);
+    }
+    // Explicit caller strict flag anywhere is normalized to the single owned position.
+    const p=f.plan("--print","x","--strict-mcp-config","--mcp-config",EMPTY);
+    assertSafeLayout(p.args,"explicit strict");
+    assert.deepEqual(p.args,["--permission-mode","default","--strict-mcp-config","--print","x","--mcp-config",EMPTY]);
+    // Positional, print and model semantics keep their caller order.
+    assert.deepEqual(f.plan("--model","sonnet","--print","hello","--","--literal").args,
+      ["--permission-mode","default","--strict-mcp-config","--model","sonnet","--print","hello","--mcp-config",EMPTY,"--","--literal"]);
+  }finally{f.dispose();}
+});
+test("R08 R-01 retained canonical validation requires the owned prefix and strict placement",()=>{
+  const f=fixture();try{
+    const guarded=permissionModeArgs("guarded"),full=permissionModeArgs("full");
+    const ok=[...full,"--strict-mcp-config","--model","sonnet","--mcp-config",EMPTY];
+    assert.doesNotThrow(()=>assertStrictUnityCliArgs(ok,f.project,full));
+    // An R07 layout with no caller arguments is byte-identical to the canonical layout.
+    assert.doesNotThrow(()=>assertStrictUnityCliArgs([...guarded,"--strict-mcp-config","--mcp-config",EMPTY],f.project,guarded));
+    for(const [label,args,prefix,pattern] of [
+      ["R07 order with caller args",[...guarded,"--print","x","--strict-mcp-config","--mcp-config",EMPTY],guarded,/directly after the fixed permission prefix/],
+      ["dangling option consumed strict",[...guarded,"--model","--strict-mcp-config","--mcp-config",EMPTY],guarded,/directly after the fixed permission prefix/],
+      ["no permission prefix",["--strict-mcp-config","--mcp-config",EMPTY],guarded,/directly after the fixed permission prefix/],
+      ["mismatched recorded mode",[...full,"--strict-mcp-config","--mcp-config",EMPTY],guarded,/directly after the fixed permission prefix/],
+      ["second strict later",[...guarded,"--strict-mcp-config","--print","--strict-mcp-config","--mcp-config",EMPTY],guarded,/Unity CLI-only/],
+      ["config not at end",[...guarded,"--strict-mcp-config","--mcp-config",EMPTY,"prompt"],guarded,/canonical single-configuration boundary/],
+      ["equals config form",[...guarded,"--strict-mcp-config","--mcp-config="+EMPTY],guarded,/canonical single-configuration boundary/],
+      ["unowned prefix",["--permission-mode","acceptEdits","--strict-mcp-config","--mcp-config",EMPTY],["--permission-mode","acceptEdits"],/valid NCCGS permission prefix/],
+      ["missing prefix argument",[...guarded,"--strict-mcp-config","--mcp-config",EMPTY],undefined,/valid NCCGS permission prefix/]])
+      assert.throws(()=>assertStrictUnityCliArgs(args,f.project,prefix),pattern,label);
+  }finally{f.dispose();}
+});
+function tree(directory){
+  const result={};
+  for(const entry of fs.readdirSync(directory,{withFileTypes:true,recursive:true}))
+    if(entry.isFile()){const file=path.join(entry.parentPath??entry.path,entry.name);result[path.relative(directory,file)]=fs.readFileSync(file,"base64");}
+    else if(entry.isDirectory())result[path.relative(directory,path.join(entry.parentPath??entry.path,entry.name))+"/"]="dir";
+  return result;
+}
+test("R08 R-01 direct noncanonical retained recovery refuses without changing records, locks or costs",async()=>{
+  const f=fixture();try{
+    for(const [mode,args] of [
+      ["guarded",[...permissionModeArgs("guarded"),"--print","old","--strict-mcp-config","--mcp-config",EMPTY]],
+      ["guarded",[...permissionModeArgs("guarded"),"--model","--strict-mcp-config","--mcp-config",EMPTY]],
+      ["full",[...permissionModeArgs("guarded"),"--strict-mcp-config","--mcp-config",EMPTY]],
+      ["full",["--strict-mcp-config","--print","old","--mcp-config",EMPTY]]]){
+      const id=crypto.randomUUID();
+      const state={schemaVersion:1,id,project:f.project,binary:process.execPath,permissionMode:mode,providerArgs:args,taskId:"historical-task",
+        sessionId:crypto.randomUUID(),budgetUsd:5,cumulativeCostUsd:3.5,costCoverage:"complete",maxResumes:2,invocations:[{status:"finished",allowanceUsd:1.5}],status:"blocked"};
+      f.write(`.nccgs/runs/${id}/run.json`,state);
+      const before=tree(path.join(f.project,".nccgs"));
+      await assert.rejects(supervise({project:f.project,binary:process.execPath,mode,env:f.env,supervision:{recoverRun:id}}),/Unity CLI-only.*fresh continuation without resetting spent budgets/,JSON.stringify(args));
+      assert.deepEqual(tree(path.join(f.project,".nccgs")),before,"No record, lock, binding or cost may change");
+      assert.equal(JSON.parse(fs.readFileSync(path.join(f.project,`.nccgs/runs/${id}/run.json`))).cumulativeCostUsd,3.5);
+    }
+  }finally{f.dispose();}
+});
+// R08 R-02: --bare and --safe-mode skip project hooks; NCCGS owns hook activation.
+test("R08 R-02 disabled-hook flags are rejected in ordinary and supervised launch",()=>{
+  const f=fixture();try{
+    const prompt=f.write(".nccgs/prompt.txt","Synthetic");
+    const forms=["--bare","--safe-mode","--bare=true","--safe-mode=true","--bare=","--safe-mode=false"];
+    for(const form of forms){
+      assert.throws(()=>f.plan(form),/conflicting option/,form);
+      assert.throws(()=>f.plan("--print","x","--model","sonnet",form),/conflicting option/,form);
+      assert.throws(()=>launchPlan(["--project",f.project,"--",form],f.env),/conflicting option/,form);
+      assert.throws(()=>launchPlan(["--project",f.project,"--dry-run","--supervise","--task","synthetic","--prompt-file",prompt,"--session-budget-usd","1","--",form],f.env),/conflicting option/,form);
+      assert.throws(()=>launchPlan(["--project",f.project,"--dry-run","--recover-run",crypto.randomUUID(),"--",form],f.env),/conflicting option/,form);
+    }
+    // Unrelated names are not treated as aliases.
+    assert.doesNotThrow(()=>f.plan("--print","bare safe-mode"));
+  }finally{f.dispose();}
+});
+// R09 R08-N1: --restricted ignores project settings/hooks (CLI 2.1.316 help).
+const RESTRICTED=["--restricted","--restricted=true","--restricted=false","--restricted="];
+test("R09 N1 --restricted is rejected at every launch entry point in guarded and full modes",()=>{
+  const f=fixture();try{
+    const prompt=f.write(".nccgs/prompt.txt","Synthetic");
+    for(const mode of ["guarded","full"]){
+      f.write(".nccgs/autonomy.json",{schemaVersion:1,mode});
+      assert.equal(f.plan().mode,mode);
+      for(const form of RESTRICTED){
+        const label=mode+" "+form;
+        assert.throws(()=>f.plan(form),/conflicting option/,label);
+        assert.throws(()=>f.plan("--print","x","--model","sonnet",form),/conflicting option/,label);
+        assert.throws(()=>f.plan("--print","x","--",form),/conflicting option/,label);
+        assert.throws(()=>launchPlan(["--project",f.project,"--",form],f.env),/conflicting option/,label);
+        assert.throws(()=>launchPlan(["--project",f.project,"--dry-run","--supervise","--task","synthetic","--prompt-file",prompt,"--session-budget-usd","1","--",form],f.env),/conflicting option/,label);
+        assert.throws(()=>launchPlan(["--project",f.project,"--dry-run","--recover-run",crypto.randomUUID(),"--",form],f.env),/conflicting option/,label);
+        assert.throws(()=>launchPlan(["--project",f.project,"--recover-run",crypto.randomUUID(),"--",form],f.env),/conflicting option/,label);
+      }
+      // R08 protections and positive controls remain in this mode.
+      for(const form of ["--bare","--safe-mode=false"])assert.throws(()=>f.plan(form),/conflicting option/,mode+" "+form);
+      const owned=permissionModeArgs(mode);
+      for(const input of [["--print","restricted"],["--print","--restricted mode"],["restricted project settings"],["--restricted-mode"],["--restrictedx"],["--unrestricted"],["--print","x","--","restricted"]]){
+        const p=f.plan(...input);
+        assert.deepEqual(p.args.slice(0,3),[...owned,"--strict-mcp-config"],JSON.stringify(input));
+        for(const token of input)assert.ok(p.args.includes(token),JSON.stringify(input));
+        assert.doesNotThrow(()=>assertStrictUnityCliArgs(p.args,f.project,owned),JSON.stringify(input));
+      }
+      const cfg=f.write("approved-mcp.json",JSON.stringify({mcpServers:{graphify:{command:"node",args:["approved-server.mjs"]}}}));
+      const p=f.plan("--print","restricted review","--mcp-config",cfg);
+      assert.equal(p.args.at(-1),cfg);
+      assert.doesNotThrow(()=>assertStrictUnityCliArgs(p.args,f.project,owned));
+    }
+  }finally{f.dispose();}
+});
+test("R09 N1 canonical stored arguments carrying --restricted are rejected by the shared policy",()=>{
+  const f=fixture();try{
+    for(const mode of ["guarded","full"]){
+      const owned=permissionModeArgs(mode);
+      for(const form of [...RESTRICTED,"--bare","--safe-mode=true","--settings=x.json"]){
+        for(const caller of [[form],["--print","x",form],["--model","sonnet",form,"--","literal"],["--print","x","--",form]]){
+          // Proves the record is R08-canonical: the unchanged layout builder reproduces it exactly.
+          const args=unityCliMcpArgs(caller,f.project,owned),label=mode+" "+JSON.stringify(caller);
+          assert.deepEqual(args.slice(0,3),[...owned,"--strict-mcp-config"],label);
+          assert.throws(()=>assertStrictUnityCliArgs(args,f.project,owned),/Unity CLI-only: retained arguments contain NCCGS-owned launch option .*fresh continuation without resetting spent budgets/,label);
+        }
+      }
+      // Only the fixed owned prefix is skipped; positive controls still pass.
+      for(const caller of [[],["--print","restricted"],["--restricted-mode"],["--print","x","--","restricted"]])
+        assert.doesNotThrow(()=>assertStrictUnityCliArgs(unityCliMcpArgs(caller,f.project,owned),f.project,owned),JSON.stringify(caller));
+      // A second permission option after the owned prefix is not skipped.
+      assert.throws(()=>assertStrictUnityCliArgs([...owned,"--strict-mcp-config",...owned,"--mcp-config",EMPTY],f.project,owned),/NCCGS-owned launch option --permission-mode/);
+    }
+  }finally{f.dispose();}
+});
+test("R09 N1 supervise({recoverRun}) refuses a retained --restricted record before any lock, binding, run write or cost change",async()=>{
+  const f=fixture();try{
+    for(const mode of ["guarded","full"])for(const form of RESTRICTED){
+      const owned=permissionModeArgs(mode),id=crypto.randomUUID(),taskId="historical-task",sessionId=crypto.randomUUID();
+      const args=unityCliMcpArgs(["--print","old",form],f.project,owned);
+      const state={schemaVersion:1,id,project:f.project,binary:process.execPath,permissionMode:mode,providerArgs:args,taskId,
+        sessionId,budgetUsd:5,cumulativeCostUsd:3.5,costCoverage:"complete",maxResumes:2,invocations:[{status:"finished",allowanceUsd:1.5}],status:"blocked"};
+      f.write(`.nccgs/runs/${id}/run.json`,state);
+      const before=tree(path.join(f.project,".nccgs"));
+      await assert.rejects(supervise({project:f.project,binary:process.execPath,mode,env:f.env,supervision:{recoverRun:id}}),/NCCGS-owned launch option --restricted.*fresh continuation without resetting spent budgets/,mode+" "+form);
+      assert.deepEqual(tree(path.join(f.project,".nccgs")),before,"No record, lock, binding or cost may change");
+      assert.equal(fs.existsSync(path.join(f.project,`.nccgs/runs/task-${taskId}.lock`)),false);
+      assert.equal(fs.existsSync(path.join(f.project,`.nccgs/runtime/bindings/${sessionId}.json`)),false);
+      assert.deepEqual(JSON.parse(fs.readFileSync(path.join(f.project,`.nccgs/runs/${id}/run.json`))),state);
+    }
+  }finally{f.dispose();}
+});
+test("R09 N1 positive control: a safe canonical retained record passes transport validation in supervise",async()=>{
+  const f=fixture();try{
+    const id=crypto.randomUUID(),args=unityCliMcpArgs(["--print","restricted wording only"],f.project,permissionModeArgs("guarded"));
+    f.write(`.nccgs/runs/${id}/run.json`,{schemaVersion:1,id,project:f.project,binary:process.execPath,permissionMode:"guarded",providerArgs:args,taskId:"missing-task",
+      sessionId:crypto.randomUUID(),budgetUsd:5,cumulativeCostUsd:3.5,costCoverage:"complete",maxResumes:2,invocations:[{status:"finished"}],status:"blocked"});
+    // The argv gate throws before the lock; past it, supervise records a blocked
+    // reason and returns 1. The deliberately absent task record blocks it there.
+    assert.equal(await supervise({project:f.project,binary:process.execPath,mode:"guarded",env:f.env,supervision:{recoverRun:id}}),1);
+    const after=JSON.parse(fs.readFileSync(path.join(f.project,`.nccgs/runs/${id}/run.json`)));
+    assert.equal(after.status,"blocked");
+    assert.match(after.reason,/ENOENT|missing-task/);
+    assert.doesNotMatch(after.reason,/Unity CLI-only|owned launch option/);
+    assert.equal(after.cumulativeCostUsd,3.5);
+    assert.equal(after.invocations.length,1,"No native invocation may start");
+  }finally{f.dispose();}
+});