nccgs 2.1.0 → 2.1.1

package/scripts/run.mjs

@@ -1,10 +1,11 @@
 import fs from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
-import { autonomyPolicy } from "../.claude/nccgs/tools/autonomy.mjs";
+import { autonomyPolicy, conflictingLaunchOption, permissionModeArgs } from "../.claude/nccgs/tools/autonomy.mjs";
 import { containedPath } from "../.claude/nccgs/tools/paths.mjs";
 import { supervise } from "./supervise.mjs";
 import { acquireInstallationLease, assertInstallationAvailable } from "../.claude/nccgs/tools/installation-guard.mjs";
+import { unityCliMcpArgs, assertStrictUnityCliArgs } from "../.claude/nccgs/tools/unity-transport.mjs";
 
 // No shell construction, restrictive tool allowlist, or model override.
 export function launchPlan(argv, env = process.env) {
@@ -34,8 +35,7 @@ export function launchPlan(argv, env = process.env) {
   if (!fs.existsSync(containedPath(project, ".claude/nccgs/install-state.json"))) throw new Error("Install/update NCCGS in the target project first");
   const mode = autonomyPolicy(project).mode;
   if (env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT) throw new Error("Start nccgs run from the external terminal/operator, not by nesting it inside an active Claude session");
-  const conflicting = /^(?:--permission-mode|--dangerously-skip-permissions|--allow-dangerously-skip-permissions|--settings|--setting-sources|--worktree|--agent)(?:=|$)|^-w$/;
-  for (const argument of forwarded) if (conflicting.test(argument)) throw new Error(`NCCGS owns session permission/root settings; conflicting option: ${argument}`);
+  for (const argument of forwarded) if (conflictingLaunchOption.test(argument)) throw new Error(`NCCGS owns session permission/root/hook settings; conflicting option: ${argument}`);
   if (supervised) {
     if (supervision.recoverRun) {
       if (forwarded.length || supervision.taskId || supervision.promptFile || supervision.budgetUsd !== undefined || supervision.budgetPhase || options.includes("--max-resumes") || options.includes("--timeout-ms")) throw new Error("Recovery preserves the original prompt, limits and provider arguments");
@@ -46,7 +46,7 @@ export function launchPlan(argv, env = process.env) {
       for (const argument of forwarded) if (owned.test(argument)) throw new Error(`Supervisor owns native lifecycle option: ${argument}`);
     }
   } else if (options.some(option => ["--task", "--prompt-file", "--max-resumes", "--timeout-ms", "--session-budget-usd", "--budget-phase"].includes(option))) throw new Error("Lifecycle options require --supervise");
-  return { project, binary, dryRun, mode, args: ["--permission-mode", mode === "full" ? "bypassPermissions" : "default", ...forwarded],
+  return { project, binary, dryRun, mode, args: unityCliMcpArgs(forwarded, project, permissionModeArgs(mode)),
     supervision: supervised ? supervision : null, env: { ...env, NCCGS_PROJECT_ROOT: project, NCCGS_TASK_AUTONOMY: mode,
       // Native auto-backgrounding can otherwise turn a claimed foreground worker
       // into async_launched mid-flight and invalidate its guarded write identity.
@@ -73,6 +73,7 @@ export async function run(argv) {
     if (!fs.existsSync(containedPath(plan.project, ".claude/nccgs/install-state.json")))
       throw new Error("Install/update NCCGS in the target project first; it was removed before launch");
     if (plan.supervision) return await supervise(plan);
+    assertStrictUnityCliArgs(plan.args, plan.project, permissionModeArgs(plan.mode));
     lease.update({ phase: "spawning" });
     child = spawn(plan.binary, plan.args, { cwd: plan.project, env: plan.env, stdio: "inherit", windowsHide: true });
     child.once("spawn", () => lease.update({ phase: "running", child: { pid: child.pid, group: false } }));

package/scripts/supervise.mjs

@@ -10,6 +10,8 @@ import { acquireLock, delay, pidState } from "../.claude/nccgs/tools/process-loc
 import { sessionBudgetLock, sessionBudgetCoverage } from "../.claude/nccgs/tools/session-budget.mjs";
 import { allocateReviewBudget } from "../.claude/nccgs/tools/review-budget.mjs";
 import { settleWorkHandoff } from "./work-handoff.mjs";
+import { assertStrictUnityCliArgs } from "../.claude/nccgs/tools/unity-transport.mjs";
+import { permissionModeArgs } from "../.claude/nccgs/tools/autonomy.mjs";
 
 const need = (condition, message) => { if (!condition) throw new Error(message); };
 const now = () => new Date().toISOString();
@@ -46,6 +48,7 @@ export async function supervise(plan) {
       createdAt: now(), deadline: Date.now() + config.timeoutMs, maxResumes: config.maxResumes,
       budgetUsd: config.budgetUsd, cumulativeCostUsd: 0, costCoverage: "complete", invocations: [], status: "ready" };
   }
+  assertStrictUnityCliArgs(state.providerArgs, project, permissionModeArgs(state.permissionMode));
   const lock = acquireLock(contained(project, `.nccgs/runs/task-${state.taskId}.lock`), { runId: state.id });
   let budgetLock;
   const directory = path.dirname(file), save = () => atomicJson(file, state);
@@ -121,6 +124,7 @@ export async function supervise(plan) {
         ...(index === 0 ? ["--session-id", state.sessionId] : ["--resume", state.sessionId])];
       let deadlineTimer;
       try {
+        assertStrictUnityCliArgs(state.providerArgs, project, permissionModeArgs(state.permissionMode));
         child = spawn(state.binary, args, { cwd: project, windowsHide: true, stdio: ["pipe", "pipe", "pipe"],
           env: { ...plan.env, NCCGS_SUPERVISED_SESSION: state.sessionId, NCCGS_SUPERVISED_RUN: state.id, NCCGS_TASK_ID: state.taskId } });
         child.stdin.on("error", () => {}); // early native failure is captured in its terminal/exit evidence