nccgs 2.1.0 → 2.1.1

package/.claude/nccgs/tools/tool-guard.mjs

@@ -1,131 +1,120 @@
-import path from "node:path";
-import { contained, json, resolveExecution } from "./policy.mjs";
-import { taskPath, check } from "./gates.mjs";
-import { boundTask } from "./runtime.mjs";
-import { claim, findDispatch, rejectUnclaimed, admitRepairTool, dispatchPrompt, pinnedRepairEvidence } from "./orchestration.mjs";
-import { requireDesignReady } from "./design-readiness.mjs";
-import { inFinalReviewPhase } from "./review-budget.mjs";
-
-const need = (condition, message) => { if (!condition) throw new Error(message); };
-const reads = new Set(["Read", "Glob", "Grep", "WebSearch", "WebFetch", "AskUserQuestion"]);
-const governance = new Set(["init", "bind", "inspect", "check", "snapshot", "ref", "record", "report", "reclassify", "refresh-inputs", "reserve", "dispatch-status", "dispatch-prompt", "checkpoint", "resume", "telemetry", "export-external", "close", "job-status", "job-wait", "acceptance-status", "design-validate", "design-compare", "handoff-validate", "record-review", "slice-preview", "slice-plan", "slice-status", "budget-status"]);
-export function parseTaskCommand(command, project = process.cwd()) {
-  // Parse data quotes without interpreting a shell. Punctuation inside report
-  // text is data; composition/redirection/expansion outside quotes stays blocked.
-  const tokens = []; let token = "", quote = null, started = false;
-  for (let i = 0; i < command.length; i++) {
-    const c = command[i];
-    if (quote) {
-      if (c === quote) { quote = null; continue; }
-      if (quote === '"' && /[`$]/.test(c)) return null;
-      if (quote === '"' && c === "\\" && ['"', "\\"].includes(command[i + 1])) { token += command[++i]; continue; }
-      token += c; continue;
-    }
-    if (/[;&|<>`$\r\n]/.test(c)) return null;
-    if (c === '"' || c === "'") { quote = c; started = true; continue; }
-    if (/\s/.test(c)) { if (started) { tokens.push(token); token = ""; started = false; } continue; }
-    token += c; started = true;
-  }
-  if (quote) return null;
-  if (started) tokens.push(token);
-  const script = tokens[1]?.replaceAll("\\", "/");
-  if (tokens[0] !== "node" || !script || path.resolve(project, script) !== path.resolve(project, ".claude/nccgs/tools/task.mjs")) return null;
-  const separator = tokens.indexOf("--");
-  const options = separator < 0 ? tokens : tokens.slice(0, separator);
-  const projectOptions = options.flatMap((t, i) => t === "--project" ? [i] : []);
-  if (projectOptions.length > 1 || options.some(t => t.startsWith("--project="))) return null;
-  if (projectOptions.length && (!options[projectOptions[0] + 1] || path.resolve(project, options[projectOptions[0] + 1]) !== path.resolve(project))) return null;
-  return { command: tokens[2], options, forwarded: separator < 0 ? null : tokens.slice(separator + 1) };
-}
-export function safeTaskCommand(command, project = process.cwd()) {
-  const parsed = parseTaskCommand(command, project);
-  return parsed && governance.has(parsed.command) && !parsed.forwarded ? parsed.command : null;
-}
-export function safeVerifyCommand(command, project = process.cwd()) {
-  const parsed = parseTaskCommand(command, project);
-  return Boolean(parsed?.command === "verify" && parsed.forwarded?.length && parsed.options.includes("--id") && parsed.options.includes("--name"));
-}
-export function recoveryTool(input, project = process.cwd()) {
-  return !input.agent_id && ["Bash", "PowerShell"].includes(input.tool_name) && ["report", "inspect"].includes(safeTaskCommand(input.tool_input?.command ?? "", project));
-}
-function ownHandoffValidation(command, project, task, dispatch) {
-  const parsed = parseTaskCommand(command, project);
-  if (!parsed || parsed.command !== "handoff-validate" || parsed.forwarded || dispatch?.status !== "running") return false;
-  const values = new Map(), args = parsed.options.slice(3);
-  for (let i = 0; i < args.length; i += 2) {
-    if (!["--id", "--dispatch", "--file", "--project"].includes(args[i]) || values.has(args[i]) || !args[i + 1] || args[i + 1].startsWith("--")) return false;
-    values.set(args[i], args[i + 1]);
-  }
-  return values.get("--id") === task?.id && values.get("--dispatch") === dispatch.id && dispatch.handoffPaths?.includes(values.get("--file"));
-}
-export function guardTool(project, input) {
-  if (recoveryTool(input, project)) return;
-  if (resolveExecution(project).name !== "standalone") return;
-  const tool = input.tool_input ?? {}, name = input.tool_name;
-  let dispatch = findDispatch(project, input);
-  const id = dispatch?.taskId ?? boundTask(project, input.session_id);
-  const task = id ? json(taskPath(project, id)) : null;
-  if (task && task.schemaVersion !== 2) throw new Error("Legacy tasks keep compatibility gates; create a fresh standalone task after migration");
-  if (input.agent_id) need(dispatch, "Worker tool has no correlated dispatch; cannot bypass its scope or budget");
-  if (input.agent_id && dispatch?.workPacket) { requireDesignReady(project, task); return admitRepairTool(project, dispatch.id, input); }
-  if (reads.has(name)) return;
-  if (["Agent", "Task"].includes(name)) {
-    need(!input.agent_id, "NCCGS workers cannot recursively delegate");
-    need(dispatch && /^\[NCCGS-DISPATCH:[\w-]+\]/.test(tool.prompt ?? ""), "Reserve this Agent call first and prefix its prompt with [NCCGS-DISPATCH:ID]");
-    need(task && dispatch.taskId === task.id, "Dispatch task missing");
-    try {
-      need(tool.run_in_background !== true, "Managed workers must use foreground Agent calls; use task verify --background for durable engine jobs");
-      if (dispatch.kind === "review") {
-        const readiness = check(project, task, "review");
-        need(readiness.allowed, readiness.message);
-      }
-      const prompt = dispatch.workPacket || dispatch.slice ? dispatchPrompt(project, task.id, dispatch.id).prompt : null;
-      claim(project, dispatch.id, { sessionId: input.session_id, toolUseId: input.tool_use_id, agent: tool.subagent_type });
-      if (prompt) return { updatedInput: { ...tool, prompt } };
-    } catch (error) {
-      if (input.hook_event_name === "PreToolUse" && dispatch.status === "reserved" && tool.subagent_type === dispatch.agent) {
-        try { rejectUnclaimed(project, dispatch.id, { sessionId: input.session_id, toolUseId: input.tool_use_id, agent: tool.subagent_type, reason: error.message }); }
-        catch { /* A concurrent claim or uncertain state must stay fail-closed. */ }
-      }
-      throw error;
-    }
-    return;
-  }
-  const readOnly = task?.mode !== "implement" || (dispatch && dispatch.kind !== "implementation");
-  if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(name)) {
-    const absolute = path.resolve(project, tool.file_path || tool.path || tool.notebook_path || ".");
-    const relative = path.relative(project, absolute).split(path.sep).join("/");
-    contained(project, relative);
-    need(!/^\.(?:claude|nccgs)(?:\/|$)/i.test(relative) || relative.startsWith(".nccgs/evidence/"), "Framework/governance records must be changed through the task CLI or external configuration");
-    if (relative.startsWith(".nccgs/evidence/")) {
-      need(!(dispatch?.handoffTransport === "native-result" && dispatch.handoffPaths?.includes(relative)), "Native-result handoff is captured only from the correlated final response; return text without writing this path");
-      need(!pinnedRepairEvidence(project, relative), "Reserved repair packet/context evidence is immutable; preserve it and create a fresh packet for a new eligible attempt");
-      need(!/^\.nccgs\/evidence\/(?:(?:runtime|criteria|design-checks|checkpoints|repair-operations|slices|external\/requests)\/|check-)/i.test(relative), "Captured runtime/checkpoint/verification/external request evidence is immutable and never authored by Claude");
-      if (input.agent_id && readOnly) need(task?.contract.analysisArtifacts?.includes(relative), "Read-only worker may write only declared analysis artifacts");
-      return;
-    }
-    need(task && !readOnly, "Audit/plan tasks cannot edit source; declare analysis artifacts under .nccgs/evidence/analysis/");
-    requireDesignReady(project, task);
-    need(dispatch && dispatch.status === "running" && dispatch.agentId === input.agent_id, "Source writes require a running, correlated implementation dispatch");
-    const lower = relative.toLowerCase();
-    if (dispatch.slice) need(dispatch.writePaths.some(p => lower === p.toLowerCase()), "Slice writes require an exact planned file; directory ownership is not granted");
-    need(dispatch.writePaths.some(p => lower === p.toLowerCase() || lower.startsWith(p.toLowerCase() + "/")), "Write is outside this dispatch's owned paths");
-    return;
-  }
-  if (["Bash", "PowerShell"].includes(name)) {
-    const command = tool.command ?? "";
-    if (input.agent_id && ownHandoffValidation(command, project, task, dispatch)) return;
-    need(!/\b(?:dispatch-reconcile|extend-dispatch|extend-review|import-external|migrate-execution|migrate-framework|budget-plan)\b|--stage\s+["']?(?:acceptance|astra)\b/i.test(command), "External decisions cannot be made by the Claude executor");
-    if (safeTaskCommand(command, project)) { need(!input.agent_id, "Coordinator owns lifecycle commands"); return; }
-    need(task && !readOnly, "Audit/plan/review shell execution is blocked; use read tools or externally supplied verification evidence");
-    requireDesignReady(project, task);
-    // Coordinator may run declared checks after workers finish. This command
-    // can execute a verifier, so it is allowed only for implementation tasks.
-    if (!input.agent_id && safeVerifyCommand(command, project)) { need(!inFinalReviewPhase(project, input.session_id), "Final-review reserve cannot run new verification jobs; use existing receipts"); return; }
-    need(dispatch?.kind === "implementation" && dispatch.status === "running" && input.agent_id === dispatch.agentId, "Shell mutation requires a correlated implementation worker");
-    return;
-  }
-  if (task) requireDesignReady(project, task);
-  need(task && !readOnly && dispatch?.kind === "implementation" && dispatch.status === "running" && input.agent_id === dispatch.agentId,
-    "Tool is not in the read-only allowlist; a correlated implementation dispatch is required");
-}
+import { commandTokens } from "./command-tokens.mjs";
+import { safeSharedContextCommand } from "./shared-context-guard.mjs";
+import { assertUnityCliOnlyInput } from "./unity-transport.mjs";
+import path from "node:path";
+import { contained, json, resolveExecution } from "./policy.mjs";
+import { taskPath, check } from "./gates.mjs";
+import { boundTask } from "./runtime.mjs";
+import { claim, findDispatch, rejectUnclaimed, admitRepairTool, dispatchPrompt, pinnedRepairEvidence } from "./orchestration.mjs";
+import { requireDesignReady } from "./design-readiness.mjs";
+import { inFinalReviewPhase } from "./review-budget.mjs";
+
+const need = (condition, message) => { if (!condition) throw new Error(message); };
+const reads = new Set(["Read", "Glob", "Grep", "WebSearch", "WebFetch", "AskUserQuestion"]);
+const governance = new Set(["init", "bind", "inspect", "check", "snapshot", "ref", "record", "report", "reclassify", "refresh-inputs", "reserve", "dispatch-status", "dispatch-prompt", "checkpoint", "resume", "telemetry", "export-external", "close", "job-status", "job-wait", "acceptance-status", "design-validate", "design-compare", "handoff-validate", "record-review", "slice-preview", "slice-plan", "slice-status", "budget-status"]);
+export function parseTaskCommand(command, project = process.cwd()) {
+  const tokens = commandTokens(command);
+  if (!tokens) return null;
+  const script = tokens[1]?.replaceAll("\\", "/");
+  if (tokens[0] !== "node" || !script || path.resolve(project, script) !== path.resolve(project, ".claude/nccgs/tools/task.mjs")) return null;
+  const separator = tokens.indexOf("--");
+  const options = separator < 0 ? tokens : tokens.slice(0, separator);
+  const projectOptions = options.flatMap((t, i) => t === "--project" ? [i] : []);
+  if (projectOptions.length > 1 || options.some(t => t.startsWith("--project="))) return null;
+  if (projectOptions.length && (!options[projectOptions[0] + 1] || path.resolve(project, options[projectOptions[0] + 1]) !== path.resolve(project))) return null;
+  return { command: tokens[2], options, forwarded: separator < 0 ? null : tokens.slice(separator + 1) };
+}
+export function safeTaskCommand(command, project = process.cwd()) {
+  const parsed = parseTaskCommand(command, project);
+  return parsed && governance.has(parsed.command) && !parsed.forwarded ? parsed.command : null;
+}
+export function safeVerifyCommand(command, project = process.cwd()) {
+  const parsed = parseTaskCommand(command, project);
+  return Boolean(parsed?.command === "verify" && parsed.forwarded?.length && parsed.options.includes("--id") && parsed.options.includes("--name"));
+}
+export function recoveryTool(input, project = process.cwd()) {
+  return !input.agent_id && ["Bash", "PowerShell"].includes(input.tool_name) && ["report", "inspect"].includes(safeTaskCommand(input.tool_input?.command ?? "", project));
+}
+function ownHandoffValidation(command, project, task, dispatch) {
+  const parsed = parseTaskCommand(command, project);
+  if (!parsed || parsed.command !== "handoff-validate" || parsed.forwarded || dispatch?.status !== "running") return false;
+  const values = new Map(), args = parsed.options.slice(3);
+  for (let i = 0; i < args.length; i += 2) {
+    if (!["--id", "--dispatch", "--file", "--project"].includes(args[i]) || values.has(args[i]) || !args[i + 1] || args[i + 1].startsWith("--")) return false;
+    values.set(args[i], args[i + 1]);
+  }
+  return values.get("--id") === task?.id && values.get("--dispatch") === dispatch.id && dispatch.handoffPaths?.includes(values.get("--file"));
+}
+export function guardTool(project, input) {
+  assertUnityCliOnlyInput(input);
+  if (recoveryTool(input, project)) return;
+  if (resolveExecution(project).name !== "standalone") return;
+  const tool = input.tool_input ?? {}, name = input.tool_name;
+  let dispatch = findDispatch(project, input);
+  const id = dispatch?.taskId ?? boundTask(project, input.session_id);
+  const task = id ? json(taskPath(project, id)) : null;
+  if (task && task.schemaVersion !== 2) throw new Error("Legacy tasks keep compatibility gates; create a fresh standalone task after migration");
+  if (input.agent_id) need(dispatch, "Worker tool has no correlated dispatch; cannot bypass its scope or budget");
+  if (input.agent_id && dispatch?.workPacket) { requireDesignReady(project, task); return admitRepairTool(project, dispatch.id, input); }
+  if (reads.has(name)) return;
+  if (["Agent", "Task"].includes(name)) {
+    need(!input.agent_id, "NCCGS workers cannot recursively delegate");
+    need(dispatch && /^\[NCCGS-DISPATCH:[\w-]+\]/.test(tool.prompt ?? ""), "Reserve this Agent call first and prefix its prompt with [NCCGS-DISPATCH:ID]");
+    need(task && dispatch.taskId === task.id, "Dispatch task missing");
+    try {
+      need(tool.run_in_background !== true, "Managed workers must use foreground Agent calls; use task verify --background for durable engine jobs");
+      if (dispatch.kind === "review") {
+        const readiness = check(project, task, "review");
+        need(readiness.allowed, readiness.message);
+      }
+      const prompt = dispatch.workPacket || dispatch.slice ? dispatchPrompt(project, task.id, dispatch.id).prompt : null;
+      claim(project, dispatch.id, { sessionId: input.session_id, toolUseId: input.tool_use_id, agent: tool.subagent_type });
+      if (prompt) return { updatedInput: { ...tool, prompt } };
+    } catch (error) {
+      if (input.hook_event_name === "PreToolUse" && dispatch.status === "reserved" && tool.subagent_type === dispatch.agent) {
+        try { rejectUnclaimed(project, dispatch.id, { sessionId: input.session_id, toolUseId: input.tool_use_id, agent: tool.subagent_type, reason: error.message }); }
+        catch { /* A concurrent claim or uncertain state must stay fail-closed. */ }
+      }
+      throw error;
+    }
+    return;
+  }
+  const readOnly = task?.mode !== "implement" || (dispatch && dispatch.kind !== "implementation");
+  if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(name)) {
+    const absolute = path.resolve(project, tool.file_path || tool.path || tool.notebook_path || ".");
+    const relative = path.relative(project, absolute).split(path.sep).join("/");
+    contained(project, relative);
+    need(!/^\.(?:claude|nccgs)(?:\/|$)/i.test(relative) || relative.startsWith(".nccgs/evidence/"), "Framework/governance records must be changed through the task CLI or external configuration");
+    if (relative.startsWith(".nccgs/evidence/")) {
+      need(!(dispatch?.handoffTransport === "native-result" && dispatch.handoffPaths?.includes(relative)), "Native-result handoff is captured only from the correlated final response; return text without writing this path");
+      need(!pinnedRepairEvidence(project, relative), "Reserved repair packet/context evidence is immutable; preserve it and create a fresh packet for a new eligible attempt");
+      need(!/^\.nccgs\/evidence\/(?:(?:runtime|criteria|design-checks|checkpoints|repair-operations|slices|external\/requests)\/|check-)/i.test(relative), "Captured runtime/checkpoint/verification/external request evidence is immutable and never authored by Claude");
+      if (input.agent_id && readOnly) need(task?.contract.analysisArtifacts?.includes(relative), "Read-only worker may write only declared analysis artifacts");
+      return;
+    }
+    need(task && !readOnly, "Audit/plan tasks cannot edit source; declare analysis artifacts under .nccgs/evidence/analysis/");
+    requireDesignReady(project, task);
+    need(dispatch && dispatch.status === "running" && dispatch.agentId === input.agent_id, "Source writes require a running, correlated implementation dispatch");
+    const lower = relative.toLowerCase();
+    if (dispatch.slice) need(dispatch.writePaths.some(p => lower === p.toLowerCase()), "Slice writes require an exact planned file; directory ownership is not granted");
+    need(dispatch.writePaths.some(p => lower === p.toLowerCase() || lower.startsWith(p.toLowerCase() + "/")), "Write is outside this dispatch's owned paths");
+    return;
+  }
+  if (["Bash", "PowerShell"].includes(name)) {
+    const command = tool.command ?? "";
+    if (input.agent_id && ownHandoffValidation(command, project, task, dispatch)) return;
+    need(!/\b(?:dispatch-reconcile|extend-dispatch|extend-review|import-external|migrate-execution|migrate-framework|budget-plan)\b|--stage\s+["']?(?:acceptance|astra)\b/i.test(command), "External decisions cannot be made by the Claude executor");
+    if (safeTaskCommand(command, project)) { need(!input.agent_id, "Coordinator owns lifecycle commands"); return; }
+    if (!input.agent_id && safeSharedContextCommand(command, project)) return;
+    need(task && !readOnly, "Audit/plan/review shell execution is blocked; use read tools or externally supplied verification evidence");
+    requireDesignReady(project, task);
+    // Coordinator may run declared checks after workers finish. This command
+    // can execute a verifier, so it is allowed only for implementation tasks.
+    if (!input.agent_id && safeVerifyCommand(command, project)) { need(!inFinalReviewPhase(project, input.session_id), "Final-review reserve cannot run new verification jobs; use existing receipts"); return; }
+    need(dispatch?.kind === "implementation" && dispatch.status === "running" && input.agent_id === dispatch.agentId, "Shell mutation requires a correlated implementation worker");
+    return;
+  }
+  if (task) requireDesignReady(project, task);
+  need(task && !readOnly && dispatch?.kind === "implementation" && dispatch.status === "running" && input.agent_id === dispatch.agentId,
+    "Tool is not in the read-only allowlist; a correlated implementation dispatch is required");
+}

package/.claude/nccgs/tools/unity-transport.mjs

@@ -0,0 +1,170 @@
+import fs from "node:fs";
+import path from "node:path";
+import { conflictingLaunchOption } from "./autonomy.mjs";
+
+const object = value => value !== null && typeof value === "object" && !Array.isArray(value);
+const unityIdentity = /(?:^|[^a-z0-9])(?:unity(?:mcp)?|mcpforunity(?:server)?|coplay(?:dev)?|anklebreaker)(?=$|[^a-z0-9])/i;
+const unityName = value => unityIdentity.test(value)
+  || unityIdentity.test(String(value).replace(/([a-z0-9])([A-Z])/g, "$1 $2"));
+const unityProvider = value => /mcpforunity|mcp-for-unity|unity[-_]mcp|coplay(?:dev|\.dev)|com\.anklebreaker/i.test(value);
+const fail = message => { throw new Error(`Unity CLI-only: ${message}`); };
+// The only argv allowed before strict isolation: the framework-owned permission
+// pair produced by autonomy.mjs permissionModeArgs. No other prefix is accepted.
+const ownedPrefix = prefix => Array.isArray(prefix) && prefix.length === 2 && prefix[0] === "--permission-mode"
+  && ["default", "bypassPermissions"].includes(prefix[1]);
+
+// Default sessions do not discover MCP servers from user settings or plugins.
+// An external caller may explicitly supply a non-Unity MCP configuration. Keep
+// file arguments as paths: never copy their possible credentials into run state.
+// `prefix` is the fixed framework-owned launch prefix (permission mode). Strict
+// isolation follows it directly, before every caller-controlled argument, so a
+// forwarded option missing its value can never consume the isolation flag.
+export function unityCliMcpArgs(args, project, prefix) {
+  if (!ownedPrefix(prefix)) fail("launch requires the fixed NCCGS --permission-mode default|bypassPermissions prefix");
+  let config = null, strict = false;
+  const remaining = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--") { remaining.push(...args.slice(i)); break; }
+    if (arg === "--strict-mcp-config") {
+      if (strict) fail("duplicate --strict-mcp-config");
+      strict = true; continue;
+    }
+    if (arg.startsWith("--strict-mcp-config=")) fail("strict MCP isolation cannot be disabled");
+    if (arg === "--mcp-config" || arg.startsWith("--mcp-config=")) {
+      if (config !== null) fail("use one explicit MCP configuration");
+      config = arg === "--mcp-config" ? args[++i] : arg.slice("--mcp-config=".length);
+      if (typeof config !== "string" || !config.trim() || config.startsWith("--")) fail("--mcp-config requires JSON or a JSON file");
+      continue;
+    }
+    remaining.push(arg);
+  }
+  config ??= '{"mcpServers":{}}';
+  let value;
+  try {
+    const text = config.trim().startsWith("{") ? config : fs.readFileSync(path.resolve(project, config), "utf8");
+    value = JSON.parse(text.replace(/^\uFEFF/, ""));
+  } catch { fail("MCP configuration must be readable valid JSON; no fallback to global servers"); }
+  if (!object(value) || Object.keys(value).some(k => k !== "mcpServers") || !object(value.mcpServers))
+    fail("MCP configuration must contain only a mcpServers object");
+  for (const [name, server] of Object.entries(value.mcpServers)) {
+    if (!object(server)) fail("invalid MCP server definition");
+    const command = typeof server.command === "string" && server.command.trim();
+    const url = typeof server.url === "string" && server.url.trim();
+    if ((!command && !url) || (command && url)
+        || (server.args !== undefined && (!Array.isArray(server.args) || !server.args.every(x => typeof x === "string"))))
+      fail("invalid MCP command/endpoint definition");
+    const route = [server.command, server.url, ...(Array.isArray(server.args) ? server.args : [])].filter(x => typeof x === "string").join(" ");
+    if (unityName(name) || unityProvider(route) || /\bunity(?:\.exe)?\s+mcp\b/i.test(route))
+      fail("Unity MCP servers are forbidden; use direct Unity CLI/Pipeline commands");
+  }
+  // Claude's config option is variadic. End it at argv end or the explicit
+  // option terminator, so no prompt or unchecked second config can be consumed.
+  // A trailing caller option missing its value may consume "--mcp-config"; the
+  // strict flag stays effective, so that fails closed with no MCP servers.
+  const boundary = remaining.indexOf("--");
+  const caller = boundary < 0 ? remaining : remaining.slice(0, boundary);
+  const terminated = boundary < 0 ? [] : remaining.slice(boundary);
+  return [...prefix, "--strict-mcp-config", ...caller, "--mcp-config", config, ...terminated];
+}
+
+// Recovery retains its original arguments and budgets. An old unsafe record is
+// refused, not silently rewritten or relaunched with different server settings.
+// Canonical layout: [...prefix, --strict-mcp-config, ...caller, --mcp-config,
+// <one validated config>, (-- ...terminated)].
+// `prefix` must be the owned pair for the run's recorded permission mode.
+export function assertStrictUnityCliArgs(args, project, prefix) {
+  if (!ownedPrefix(prefix)) fail("retained run has no valid NCCGS permission prefix; use an authorized fresh continuation without resetting spent budgets");
+  if (!Array.isArray(args) || !args.every(x => typeof x === "string") || !args.includes("--strict-mcp-config")
+      || !args.some(x => x === "--mcp-config" || x.startsWith("--mcp-config=")))
+    fail("retained run lacks strict MCP isolation; use an authorized fresh continuation without resetting spent budgets");
+  if (args[0] !== prefix[0] || args[1] !== prefix[1] || args[2] !== "--strict-mcp-config")
+    fail("retained arguments do not place strict MCP isolation directly after the fixed permission prefix, before caller arguments; use an authorized fresh continuation without resetting spent budgets");
+  // R09: the same ownership policy as a fresh launch. Only the verified fixed
+  // permission prefix is skipped; an R08-canonical record may still carry e.g.
+  // --restricted, which would ignore project settings and hooks.
+  const owned = args.slice(prefix.length).find(arg => conflictingLaunchOption.test(arg));
+  if (owned !== undefined)
+    fail(`retained arguments contain NCCGS-owned launch option ${owned}; use an authorized fresh continuation without resetting spent budgets`);
+  const canonical = unityCliMcpArgs(args.slice(prefix.length), project, prefix);
+  if (JSON.stringify(canonical) !== JSON.stringify(args))
+    fail("retained arguments lack the canonical single-configuration boundary; use an authorized fresh continuation without resetting spent budgets");
+}
+
+// This recognizes ordinary shell invocations; it does not execute or attempt to
+// sandbox arbitrary scripts, encoded payloads, or a deliberately hostile client.
+function tokens(command) {
+  const result = []; let word = "", quote = null;
+  const flush = () => { if (word) result.push(word); word = ""; };
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (c === "`" && command[i + 1]) { word += command[++i]; continue; }
+    if (quote) {
+      if (c === quote) {
+        if (quote === "'" && command[i + 1] === "'") { word += "'"; i++; }
+        else quote = null;
+      } else word += c;
+      continue;
+    }
+    if (c === "'" || c === '"') { quote = c; continue; }
+    if (c === "{" && word === "$") {
+      const end = command.indexOf("}", i + 1);
+      if (end >= 0) { word += command.slice(i, end + 1); i = end; continue; }
+    }
+    if (c === "\n" || c === "\r") { flush(); result.push(";"); continue; }
+    if (/\s/.test(c)) { flush(); continue; }
+    if (/[;&|(){}]/.test(c)) { flush(); result.push(c); continue; }
+    word += c;
+  }
+  flush(); return result;
+}
+function inspectShell(command, depth = 0) {
+  if (depth > 3) fail("nested command wrappers exceed the inspected transport boundary");
+  const parts = tokens(command);
+  for (let i = 0; i < parts.length; i++) {
+    const previous = parts[i - 1];
+    const invocation = i === 0 || ["&", ";", "|", "(", "{", ".", "sudo", "env", "exec", "call", "command"].includes(previous)
+      || /^[A-Za-z_]\w*=/.test(previous ?? "");
+    if (!invocation) continue;
+    const program = parts[i].replaceAll("\\", "/").split("/").at(-1).toLowerCase().replace(/\.exe$/, "");
+    if ((program === "unity" || /^\$(?:env:)?[\w:{}]+$/i.test(parts[i])) && parts[i + 1]?.toLowerCase() === "mcp")
+      fail("unity mcp/configure is disabled; call Unity CLI/Pipeline directly");
+    if (/^(?:mcp-for-unity|mcpforunityserver)$/.test(program)) fail("Coplay Unity MCP launch is disabled");
+    const end = parts.findIndex((x, n) => n > i && [";", "|", "&", ")"].includes(x));
+    const arguments_ = parts.slice(i + 1, end < 0 ? undefined : end);
+    if (["uvx", "uv", "pip", "pip3", "pipx", "npx", "npm", "pnpm", "bunx"].includes(program)) {
+      const following = arguments_.join(" ");
+      if (unityProvider(following)) fail("Unity MCP installation or launch is disabled");
+    }
+    if (["claude", "codex"].includes(program) && arguments_[0]?.toLowerCase() === "mcp"
+        && ["add", "add-json", "add-from-claude-desktop"].includes(arguments_[1]?.toLowerCase())) {
+      const registration = arguments_.slice(2).join(" ");
+      if (unityName(registration) || unityProvider(registration))
+        fail("Unity MCP registration through Claude/Codex is disabled");
+    }
+    if (["python", "python3", "node"].includes(program)
+        && unityProvider(arguments_[0] === "-m" ? arguments_[1] ?? "" : arguments_[0] ?? ""))
+      fail("Unity MCP launch is disabled");
+    if (program === "git" && parts[i + 1] === "clone" && unityProvider(parts.slice(i + 2).join(" ")))
+      fail("Unity MCP installation is disabled");
+    if (["start-process", "start"].includes(program)) {
+      const target = arguments_.join(" ");
+      if (unityProvider(target) || (/\bunity(?:\.exe)?\b/i.test(target) && /\bmcp\b/i.test(target)))
+        fail("Unity MCP launch is disabled");
+    }
+    if (["invoke-expression", "iex"].includes(program) && arguments_.length)
+      inspectShell(arguments_.join(" "), depth + 1);
+    if (["cmd", "powershell", "pwsh", "bash", "sh"].includes(program)) {
+      const option = parts.findIndex((x, n) => n > i && ["/c", "-c", "-lc", "-ic", "-command"].includes(x.toLowerCase()));
+      if (option >= 0 && parts[option + 1]) inspectShell(parts.slice(option + 1).join(" "), depth + 1);
+    }
+  }
+}
+export function assertUnityCliOnlyInput(input) {
+  const tool = input.tool_name ?? "";
+  const server = /^mcp__/i.test(tool) ? tool.slice(5).split("__")[0]
+    : /^mcp:/i.test(tool) ? tool.slice(4).split(":")[0] : null;
+  if (server !== null && unityName(server))
+    fail("Unity MCP tools are disabled, including discovery and read-only tools");
+  if (["Bash", "PowerShell"].includes(input.tool_name)) inspectShell(input.tool_input?.command ?? "");
+}

package/.claude/nccgs/workflow-catalog.json

@@ -498,23 +498,23 @@
         "FAST": {
           "implementationClass": "lightweight",
           "maxReviewRounds": 2,
-          "effort": "medium",
+          "effort": "high",
           "model": "sonnet"
         },
         "STANDARD": {
           "implementationClass": "standard",
           "maxReviewRounds": 3,
-          "effort": "medium",
+          "effort": "high",
           "model": "opus"
         },
         "CONTROLLED": {
           "implementationClass": "deep",
           "maxReviewRounds": 3,
-          "effort": "high",
+          "effort": "xhigh",
           "model": "opus"
         }
       },
-      "reviewModel": "opus",
+      "reviewModel": "fable",
       "reviewEffort": "high"
     },
     "astra-claude": {