nccgs 2.1.1 → 3.0.0-rc.2

package/.claude/nccgs/tools/tool-guard.mjs

@@ -1,120 +0,0 @@
-import { commandTokens } from "./command-tokens.mjs";
-import { safeSharedContextCommand } from "./shared-context-guard.mjs";
-import { assertUnityCliOnlyInput } from "./unity-transport.mjs";
-import path from "node:path";
-import { contained, json, resolveExecution } from "./policy.mjs";
-import { taskPath, check } from "./gates.mjs";
-import { boundTask } from "./runtime.mjs";
-import { claim, findDispatch, rejectUnclaimed, admitRepairTool, dispatchPrompt, pinnedRepairEvidence } from "./orchestration.mjs";
-import { requireDesignReady } from "./design-readiness.mjs";
-import { inFinalReviewPhase } from "./review-budget.mjs";
-
-const need = (condition, message) => { if (!condition) throw new Error(message); };
-const reads = new Set(["Read", "Glob", "Grep", "WebSearch", "WebFetch", "AskUserQuestion"]);
-const governance = new Set(["init", "bind", "inspect", "check", "snapshot", "ref", "record", "report", "reclassify", "refresh-inputs", "reserve", "dispatch-status", "dispatch-prompt", "checkpoint", "resume", "telemetry", "export-external", "close", "job-status", "job-wait", "acceptance-status", "design-validate", "design-compare", "handoff-validate", "record-review", "slice-preview", "slice-plan", "slice-status", "budget-status"]);
-export function parseTaskCommand(command, project = process.cwd()) {
-  const tokens = commandTokens(command);
-  if (!tokens) return null;
-  const script = tokens[1]?.replaceAll("\\", "/");
-  if (tokens[0] !== "node" || !script || path.resolve(project, script) !== path.resolve(project, ".claude/nccgs/tools/task.mjs")) return null;
-  const separator = tokens.indexOf("--");
-  const options = separator < 0 ? tokens : tokens.slice(0, separator);
-  const projectOptions = options.flatMap((t, i) => t === "--project" ? [i] : []);
-  if (projectOptions.length > 1 || options.some(t => t.startsWith("--project="))) return null;
-  if (projectOptions.length && (!options[projectOptions[0] + 1] || path.resolve(project, options[projectOptions[0] + 1]) !== path.resolve(project))) return null;
-  return { command: tokens[2], options, forwarded: separator < 0 ? null : tokens.slice(separator + 1) };
-}
-export function safeTaskCommand(command, project = process.cwd()) {
-  const parsed = parseTaskCommand(command, project);
-  return parsed && governance.has(parsed.command) && !parsed.forwarded ? parsed.command : null;
-}
-export function safeVerifyCommand(command, project = process.cwd()) {
-  const parsed = parseTaskCommand(command, project);
-  return Boolean(parsed?.command === "verify" && parsed.forwarded?.length && parsed.options.includes("--id") && parsed.options.includes("--name"));
-}
-export function recoveryTool(input, project = process.cwd()) {
-  return !input.agent_id && ["Bash", "PowerShell"].includes(input.tool_name) && ["report", "inspect"].includes(safeTaskCommand(input.tool_input?.command ?? "", project));
-}
-function ownHandoffValidation(command, project, task, dispatch) {
-  const parsed = parseTaskCommand(command, project);
-  if (!parsed || parsed.command !== "handoff-validate" || parsed.forwarded || dispatch?.status !== "running") return false;
-  const values = new Map(), args = parsed.options.slice(3);
-  for (let i = 0; i < args.length; i += 2) {
-    if (!["--id", "--dispatch", "--file", "--project"].includes(args[i]) || values.has(args[i]) || !args[i + 1] || args[i + 1].startsWith("--")) return false;
-    values.set(args[i], args[i + 1]);
-  }
-  return values.get("--id") === task?.id && values.get("--dispatch") === dispatch.id && dispatch.handoffPaths?.includes(values.get("--file"));
-}
-export function guardTool(project, input) {
-  assertUnityCliOnlyInput(input);
-  if (recoveryTool(input, project)) return;
-  if (resolveExecution(project).name !== "standalone") return;
-  const tool = input.tool_input ?? {}, name = input.tool_name;
-  let dispatch = findDispatch(project, input);
-  const id = dispatch?.taskId ?? boundTask(project, input.session_id);
-  const task = id ? json(taskPath(project, id)) : null;
-  if (task && task.schemaVersion !== 2) throw new Error("Legacy tasks keep compatibility gates; create a fresh standalone task after migration");
-  if (input.agent_id) need(dispatch, "Worker tool has no correlated dispatch; cannot bypass its scope or budget");
-  if (input.agent_id && dispatch?.workPacket) { requireDesignReady(project, task); return admitRepairTool(project, dispatch.id, input); }
-  if (reads.has(name)) return;
-  if (["Agent", "Task"].includes(name)) {
-    need(!input.agent_id, "NCCGS workers cannot recursively delegate");
-    need(dispatch && /^\[NCCGS-DISPATCH:[\w-]+\]/.test(tool.prompt ?? ""), "Reserve this Agent call first and prefix its prompt with [NCCGS-DISPATCH:ID]");
-    need(task && dispatch.taskId === task.id, "Dispatch task missing");
-    try {
-      need(tool.run_in_background !== true, "Managed workers must use foreground Agent calls; use task verify --background for durable engine jobs");
-      if (dispatch.kind === "review") {
-        const readiness = check(project, task, "review");
-        need(readiness.allowed, readiness.message);
-      }
-      const prompt = dispatch.workPacket || dispatch.slice ? dispatchPrompt(project, task.id, dispatch.id).prompt : null;
-      claim(project, dispatch.id, { sessionId: input.session_id, toolUseId: input.tool_use_id, agent: tool.subagent_type });
-      if (prompt) return { updatedInput: { ...tool, prompt } };
-    } catch (error) {
-      if (input.hook_event_name === "PreToolUse" && dispatch.status === "reserved" && tool.subagent_type === dispatch.agent) {
-        try { rejectUnclaimed(project, dispatch.id, { sessionId: input.session_id, toolUseId: input.tool_use_id, agent: tool.subagent_type, reason: error.message }); }
-        catch { /* A concurrent claim or uncertain state must stay fail-closed. */ }
-      }
-      throw error;
-    }
-    return;
-  }
-  const readOnly = task?.mode !== "implement" || (dispatch && dispatch.kind !== "implementation");
-  if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(name)) {
-    const absolute = path.resolve(project, tool.file_path || tool.path || tool.notebook_path || ".");
-    const relative = path.relative(project, absolute).split(path.sep).join("/");
-    contained(project, relative);
-    need(!/^\.(?:claude|nccgs)(?:\/|$)/i.test(relative) || relative.startsWith(".nccgs/evidence/"), "Framework/governance records must be changed through the task CLI or external configuration");
-    if (relative.startsWith(".nccgs/evidence/")) {
-      need(!(dispatch?.handoffTransport === "native-result" && dispatch.handoffPaths?.includes(relative)), "Native-result handoff is captured only from the correlated final response; return text without writing this path");
-      need(!pinnedRepairEvidence(project, relative), "Reserved repair packet/context evidence is immutable; preserve it and create a fresh packet for a new eligible attempt");
-      need(!/^\.nccgs\/evidence\/(?:(?:runtime|criteria|design-checks|checkpoints|repair-operations|slices|external\/requests)\/|check-)/i.test(relative), "Captured runtime/checkpoint/verification/external request evidence is immutable and never authored by Claude");
-      if (input.agent_id && readOnly) need(task?.contract.analysisArtifacts?.includes(relative), "Read-only worker may write only declared analysis artifacts");
-      return;
-    }
-    need(task && !readOnly, "Audit/plan tasks cannot edit source; declare analysis artifacts under .nccgs/evidence/analysis/");
-    requireDesignReady(project, task);
-    need(dispatch && dispatch.status === "running" && dispatch.agentId === input.agent_id, "Source writes require a running, correlated implementation dispatch");
-    const lower = relative.toLowerCase();
-    if (dispatch.slice) need(dispatch.writePaths.some(p => lower === p.toLowerCase()), "Slice writes require an exact planned file; directory ownership is not granted");
-    need(dispatch.writePaths.some(p => lower === p.toLowerCase() || lower.startsWith(p.toLowerCase() + "/")), "Write is outside this dispatch's owned paths");
-    return;
-  }
-  if (["Bash", "PowerShell"].includes(name)) {
-    const command = tool.command ?? "";
-    if (input.agent_id && ownHandoffValidation(command, project, task, dispatch)) return;
-    need(!/\b(?:dispatch-reconcile|extend-dispatch|extend-review|import-external|migrate-execution|migrate-framework|budget-plan)\b|--stage\s+["']?(?:acceptance|astra)\b/i.test(command), "External decisions cannot be made by the Claude executor");
-    if (safeTaskCommand(command, project)) { need(!input.agent_id, "Coordinator owns lifecycle commands"); return; }
-    if (!input.agent_id && safeSharedContextCommand(command, project)) return;
-    need(task && !readOnly, "Audit/plan/review shell execution is blocked; use read tools or externally supplied verification evidence");
-    requireDesignReady(project, task);
-    // Coordinator may run declared checks after workers finish. This command
-    // can execute a verifier, so it is allowed only for implementation tasks.
-    if (!input.agent_id && safeVerifyCommand(command, project)) { need(!inFinalReviewPhase(project, input.session_id), "Final-review reserve cannot run new verification jobs; use existing receipts"); return; }
-    need(dispatch?.kind === "implementation" && dispatch.status === "running" && input.agent_id === dispatch.agentId, "Shell mutation requires a correlated implementation worker");
-    return;
-  }
-  if (task) requireDesignReady(project, task);
-  need(task && !readOnly && dispatch?.kind === "implementation" && dispatch.status === "running" && input.agent_id === dispatch.agentId,
-    "Tool is not in the read-only allowlist; a correlated implementation dispatch is required");
-}

package/.claude/nccgs/tools/unity-repair.mjs

@@ -1,128 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import crypto from "node:crypto";
-import { artifact, atomicJson, contained, json, verifyArtifact } from "./policy.mjs";
-import { snapshot } from "./gates.mjs";
-
-const need = (ok, message) => { if (!ok) throw new Error(`Unity repair: ${message}`); };
-const keys = (value, allowed) => value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).every(k => allowed.includes(k));
-const code = /\.(?:cs|asmdef|asmref|shader|hlsl|cginc|compute|uxml|uss)$/i;
-const asset = /\.(?:unity|prefab|asset|mat|controller|overrideController|anim)$/i;
-export const unityCodePath = relative => relative.startsWith("Assets/") && code.test(relative);
-export const unitySceneSafety = "loaded-scenes-clean-v1";
-export const unityRepairProfiles = Object.freeze({
-  "unity-code": Object.freeze({ files: 8, workCalls: 24, readCalls: 12, handoffCalls: 3, durationMs: 900000 }),
-  "unity-editor": Object.freeze({ files: 8, workCalls: 20, readCalls: 8, handoffCalls: 3, durationMs: 900000 })
-});
-
-function guid(project, relative) {
-  const value = fs.readFileSync(contained(project, relative), "utf8").match(/^guid: ([a-f0-9]{32})\r?$/m)?.[1];
-  need(value, `missing or invalid Unity GUID in ${relative}`);
-  return value;
-}
-
-// The packet pins a chosen operation, not a general shell/MCP capability. The
-// installed Unity CLI binds every call to this project's absolute path.
-export function validateUnityRepair(project, packet) {
-  const profile = unityRepairProfiles[packet.repairType];
-  need(profile, "repairType must be unity-code or unity-editor");
-  need(fs.existsSync(contained(project, "ProjectSettings/ProjectVersion.txt")), "requires an existing Unity project");
-  need(packet.changes.length <= profile.files, `at most ${profile.files} exact files per packet`);
-  for (const change of packet.changes) {
-    need(keys(change, ["path", "operation", "instruction"]) && ["edit", "create"].includes(change.operation), "each change needs edit or create operation");
-    need(unityCodePath(change.path) || (packet.repairType === "unity-editor" && change.path.startsWith("Assets/") && asset.test(change.path)), "file type must match the repair profile under Assets/; no raw metadata, packages or project settings");
-    const file = contained(project, change.path);
-    need(fs.statSync(path.dirname(file)).isDirectory(), "create files only in existing folders; folder creation needs a separate scoped change");
-    if (change.operation === "edit") {
-      need(fs.existsSync(file) && fs.statSync(file).isFile(), "edit requires an existing file");
-      guid(project, `${change.path}.meta`);
-    } else need(!fs.existsSync(file) && !fs.existsSync(contained(project, `${change.path}.meta`)), "create target or companion metadata already exists");
-  }
-  need(keys(packet.unity, ["capabilities", "steps"]) && Array.isArray(packet.unity.steps) && packet.unity.steps.length <= 4, "unity requires capabilities and at most four fixed steps");
-  if (packet.unity.steps.length || packet.unity.capabilities !== undefined) {
-    need(packet.unity.capabilities?.path?.startsWith(".nccgs/evidence/") && !packet.unity.capabilities.path.startsWith(".nccgs/evidence/work-packets/"), "pin Unity command discovery evidence");
-    verifyArtifact(project, packet.unity.capabilities);
-  }
-  need((packet.repairType === "unity-code" && packet.changes.every(c => c.operation === "edit")) || packet.unity.steps.length > 0, "asset repairs and new code require an Editor/import step before completion");
-  const ids = new Set();
-  for (const step of packet.unity.steps) {
-    need(keys(step, ["id", "command", "arguments", "timeoutMs"]) && /^[a-zA-Z][\w-]{0,39}$/.test(step.id ?? "") && !ids.has(step.id), "steps need unique bounded IDs");
-    ids.add(step.id);
-    need(/^[a-zA-Z][\w-]{0,79}$/.test(step.command ?? "") && Array.isArray(step.arguments) && step.arguments.length <= 8 &&
-      step.arguments.every(a => typeof a === "string" && a.length <= 8000 && !a.startsWith("-") && !a.includes("\0")), "use a discovered command and positional arguments only; routing/global flags are generated");
-    need(Number.isSafeInteger(step.timeoutMs) && step.timeoutMs >= 1000 && step.timeoutMs <= 60000, "step timeoutMs must be 1000-60000; long verification belongs to managed jobs");
-    need(step.command === "eval" && step.arguments.length === 1, "new Editor steps require eval with one C# statement body so the dirty-scene check runs atomically before the operation");
-    need(!/^\s*(?:global\s+)?using\s+(?:static\s+)?[\w.]+\s*(?:=|;)/m.test(step.arguments[0]), "eval bodies must use fully qualified types; top-level using directives cannot follow the scene guard");
-  }
-  const { files, ...limits } = profile;
-  return limits;
-}
-
-export function captureUnityRepairScope(project, dispatch, source) {
-  if (dispatch.workPacket?.schemaVersion !== 2) return;
-  const metaGuids = Object.fromEntries(dispatch.workPacket.changes.map(c => [c.path, c.operation === "edit" ? guid(project, `${c.path}.meta`) : null]));
-  const relative = `.nccgs/evidence/work-packets/${dispatch.id}-scope.json`;
-  atomicJson(contained(project, relative), { schemaVersion: 1, taskId: dispatch.taskId, dispatchId: dispatch.id,
-    sourceSnapshot: source.sha256, fileEntries: source.fileEntries, metaGuids });
-  dispatch.workPacket.scope = artifact(project, relative);
-}
-
-export function verifyUnityRepairScope(project, dispatch, complete = false) {
-  if (dispatch.workPacket?.schemaVersion !== 2) return;
-  const p = dispatch.workPacket, baseline = json(verifyArtifact(project, p.scope));
-  need(baseline.dispatchId === dispatch.id && baseline.taskId === dispatch.taskId && baseline.sourceSnapshot === dispatch.snapshot, "scope baseline identity changed");
-  const before = new Map(baseline.fileEntries), after = new Map(snapshot(project, null, { includeFiles: true }).fileEntries);
-  const owned = new Set(p.changes.flatMap(c => [c.path, `${c.path}.meta`]));
-  for (const [file, hash] of before) {
-    need(after.has(file), `source file removed: ${file}; deletions/renames are outside this packet`);
-    need(after.get(file) === hash || owned.has(file), `source changed outside exact ownership: ${file}`);
-  }
-  for (const file of after.keys()) need(before.has(file) || owned.has(file), `source created outside exact ownership: ${file}`);
-  for (const c of p.changes) {
-    const meta = `${c.path}.meta`, present = after.has(meta);
-    if (present) {
-      const current = guid(project, meta);
-      need(!baseline.metaGuids[c.path] || current === baseline.metaGuids[c.path], `existing GUID changed: ${meta}`);
-    }
-    if (complete) need(after.has(c.path) && present, `output or imported metadata missing: ${c.path}; finish import before native completion`);
-  }
-}
-
-export function repairEditorCommand(dispatch, step) {
-  return `node .claude/nccgs/tools/task.mjs repair-editor --id ${dispatch.taskId} --dispatch ${dispatch.id} --step ${step.id}`;
-}
-
-export function unityEditorToolScope(dispatch, input) {
-  if (dispatch.workPacket?.schemaVersion !== 2 || input.tool_name !== "Bash") return null;
-  const tool = input.tool_input ?? {}, step = dispatch.workPacket.unity.steps.find(s => repairEditorCommand(dispatch, s) === tool.command);
-  need(step && keys(tool, ["command", "timeout", "description", "run_in_background"]) && tool.run_in_background !== true &&
-    Number.isSafeInteger(tool.timeout) && tool.timeout >= step.timeoutMs + 5000 && tool.timeout <= 120000,
-  "only the fixed repair-editor command is permitted, foreground, with timeout at least step timeoutMs + 5000");
-  return { bucket: "work", read: false, editorStep: step.id };
-}
-
-export function unityEditorInvocation(project, step, safety = null) {
-  need(safety === null || safety === unitySceneSafety, "unknown pinned scene safety policy");
-  let sceneGuard = null, args = step.arguments;
-  if (safety) {
-    need(step.command === "eval" && args.length === 1, "guarded Editor step requires one eval body");
-    sceneGuard = { policy: safety, token: crypto.randomUUID() };
-    // Same Editor eval, before any packet statement: includes untitled/additive
-    // loaded scenes. Never auto-save, discard or switch a dirty scene.
-    const prefix = `{ for (int nccgsSceneIndex = 0; nccgsSceneIndex < UnityEngine.SceneManagement.SceneManager.sceneCount; nccgsSceneIndex++) { var nccgsScene = UnityEngine.SceneManagement.SceneManager.GetSceneAt(nccgsSceneIndex); if (nccgsScene.isDirty) return new { nccgsSceneGuard = "${safety}", token = "${sceneGuard.token}", blockedScene = string.IsNullOrEmpty(nccgsScene.path) ? "<untitled>" : nccgsScene.path }; } }\n`;
-    args = [prefix + args[0]];
-  }
-  return { ...(sceneGuard ? { sceneGuard } : {}), executable: process.platform === "win32" ? "unity.exe" : "unity", arguments: ["command", step.command, ...args,
-    "--caller", "plugin", "--skill", "unity-cli",
-    "--project-path", fs.realpathSync(project), "--timeout", String(Math.ceil(step.timeoutMs / 1000)), "--format", "json", "--no-pager", "--non-interactive"] };
-}
-
-export function blockedUnityScene(invocation, result) {
-  if (!invocation.sceneGuard || result.status !== 0 || result.error || result.signal) return null;
-  try {
-    const response = JSON.parse(result.stdout), envelope = response.data?.result, value = envelope?.result;
-    if (response.success === true && envelope.success === true && value?.nccgsSceneGuard === invocation.sceneGuard.policy &&
-        value.token === invocation.sceneGuard.token && typeof value.blockedScene === "string") return value.blockedScene;
-  } catch { /* Unknown output retains existing conservative execution handling. */ }
-  return null;
-}

package/.claude/nccgs/tools/unity-transport.mjs

@@ -1,170 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { conflictingLaunchOption } from "./autonomy.mjs";
-
-const object = value => value !== null && typeof value === "object" && !Array.isArray(value);
-const unityIdentity = /(?:^|[^a-z0-9])(?:unity(?:mcp)?|mcpforunity(?:server)?|coplay(?:dev)?|anklebreaker)(?=$|[^a-z0-9])/i;
-const unityName = value => unityIdentity.test(value)
-  || unityIdentity.test(String(value).replace(/([a-z0-9])([A-Z])/g, "$1 $2"));
-const unityProvider = value => /mcpforunity|mcp-for-unity|unity[-_]mcp|coplay(?:dev|\.dev)|com\.anklebreaker/i.test(value);
-const fail = message => { throw new Error(`Unity CLI-only: ${message}`); };
-// The only argv allowed before strict isolation: the framework-owned permission
-// pair produced by autonomy.mjs permissionModeArgs. No other prefix is accepted.
-const ownedPrefix = prefix => Array.isArray(prefix) && prefix.length === 2 && prefix[0] === "--permission-mode"
-  && ["default", "bypassPermissions"].includes(prefix[1]);
-
-// Default sessions do not discover MCP servers from user settings or plugins.
-// An external caller may explicitly supply a non-Unity MCP configuration. Keep
-// file arguments as paths: never copy their possible credentials into run state.
-// `prefix` is the fixed framework-owned launch prefix (permission mode). Strict
-// isolation follows it directly, before every caller-controlled argument, so a
-// forwarded option missing its value can never consume the isolation flag.
-export function unityCliMcpArgs(args, project, prefix) {
-  if (!ownedPrefix(prefix)) fail("launch requires the fixed NCCGS --permission-mode default|bypassPermissions prefix");
-  let config = null, strict = false;
-  const remaining = [];
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === "--") { remaining.push(...args.slice(i)); break; }
-    if (arg === "--strict-mcp-config") {
-      if (strict) fail("duplicate --strict-mcp-config");
-      strict = true; continue;
-    }
-    if (arg.startsWith("--strict-mcp-config=")) fail("strict MCP isolation cannot be disabled");
-    if (arg === "--mcp-config" || arg.startsWith("--mcp-config=")) {
-      if (config !== null) fail("use one explicit MCP configuration");
-      config = arg === "--mcp-config" ? args[++i] : arg.slice("--mcp-config=".length);
-      if (typeof config !== "string" || !config.trim() || config.startsWith("--")) fail("--mcp-config requires JSON or a JSON file");
-      continue;
-    }
-    remaining.push(arg);
-  }
-  config ??= '{"mcpServers":{}}';
-  let value;
-  try {
-    const text = config.trim().startsWith("{") ? config : fs.readFileSync(path.resolve(project, config), "utf8");
-    value = JSON.parse(text.replace(/^\uFEFF/, ""));
-  } catch { fail("MCP configuration must be readable valid JSON; no fallback to global servers"); }
-  if (!object(value) || Object.keys(value).some(k => k !== "mcpServers") || !object(value.mcpServers))
-    fail("MCP configuration must contain only a mcpServers object");
-  for (const [name, server] of Object.entries(value.mcpServers)) {
-    if (!object(server)) fail("invalid MCP server definition");
-    const command = typeof server.command === "string" && server.command.trim();
-    const url = typeof server.url === "string" && server.url.trim();
-    if ((!command && !url) || (command && url)
-        || (server.args !== undefined && (!Array.isArray(server.args) || !server.args.every(x => typeof x === "string"))))
-      fail("invalid MCP command/endpoint definition");
-    const route = [server.command, server.url, ...(Array.isArray(server.args) ? server.args : [])].filter(x => typeof x === "string").join(" ");
-    if (unityName(name) || unityProvider(route) || /\bunity(?:\.exe)?\s+mcp\b/i.test(route))
-      fail("Unity MCP servers are forbidden; use direct Unity CLI/Pipeline commands");
-  }
-  // Claude's config option is variadic. End it at argv end or the explicit
-  // option terminator, so no prompt or unchecked second config can be consumed.
-  // A trailing caller option missing its value may consume "--mcp-config"; the
-  // strict flag stays effective, so that fails closed with no MCP servers.
-  const boundary = remaining.indexOf("--");
-  const caller = boundary < 0 ? remaining : remaining.slice(0, boundary);
-  const terminated = boundary < 0 ? [] : remaining.slice(boundary);
-  return [...prefix, "--strict-mcp-config", ...caller, "--mcp-config", config, ...terminated];
-}
-
-// Recovery retains its original arguments and budgets. An old unsafe record is
-// refused, not silently rewritten or relaunched with different server settings.
-// Canonical layout: [...prefix, --strict-mcp-config, ...caller, --mcp-config,
-// <one validated config>, (-- ...terminated)].
-// `prefix` must be the owned pair for the run's recorded permission mode.
-export function assertStrictUnityCliArgs(args, project, prefix) {
-  if (!ownedPrefix(prefix)) fail("retained run has no valid NCCGS permission prefix; use an authorized fresh continuation without resetting spent budgets");
-  if (!Array.isArray(args) || !args.every(x => typeof x === "string") || !args.includes("--strict-mcp-config")
-      || !args.some(x => x === "--mcp-config" || x.startsWith("--mcp-config=")))
-    fail("retained run lacks strict MCP isolation; use an authorized fresh continuation without resetting spent budgets");
-  if (args[0] !== prefix[0] || args[1] !== prefix[1] || args[2] !== "--strict-mcp-config")
-    fail("retained arguments do not place strict MCP isolation directly after the fixed permission prefix, before caller arguments; use an authorized fresh continuation without resetting spent budgets");
-  // R09: the same ownership policy as a fresh launch. Only the verified fixed
-  // permission prefix is skipped; an R08-canonical record may still carry e.g.
-  // --restricted, which would ignore project settings and hooks.
-  const owned = args.slice(prefix.length).find(arg => conflictingLaunchOption.test(arg));
-  if (owned !== undefined)
-    fail(`retained arguments contain NCCGS-owned launch option ${owned}; use an authorized fresh continuation without resetting spent budgets`);
-  const canonical = unityCliMcpArgs(args.slice(prefix.length), project, prefix);
-  if (JSON.stringify(canonical) !== JSON.stringify(args))
-    fail("retained arguments lack the canonical single-configuration boundary; use an authorized fresh continuation without resetting spent budgets");
-}
-
-// This recognizes ordinary shell invocations; it does not execute or attempt to
-// sandbox arbitrary scripts, encoded payloads, or a deliberately hostile client.
-function tokens(command) {
-  const result = []; let word = "", quote = null;
-  const flush = () => { if (word) result.push(word); word = ""; };
-  for (let i = 0; i < command.length; i++) {
-    const c = command[i];
-    if (c === "`" && command[i + 1]) { word += command[++i]; continue; }
-    if (quote) {
-      if (c === quote) {
-        if (quote === "'" && command[i + 1] === "'") { word += "'"; i++; }
-        else quote = null;
-      } else word += c;
-      continue;
-    }
-    if (c === "'" || c === '"') { quote = c; continue; }
-    if (c === "{" && word === "$") {
-      const end = command.indexOf("}", i + 1);
-      if (end >= 0) { word += command.slice(i, end + 1); i = end; continue; }
-    }
-    if (c === "\n" || c === "\r") { flush(); result.push(";"); continue; }
-    if (/\s/.test(c)) { flush(); continue; }
-    if (/[;&|(){}]/.test(c)) { flush(); result.push(c); continue; }
-    word += c;
-  }
-  flush(); return result;
-}
-function inspectShell(command, depth = 0) {
-  if (depth > 3) fail("nested command wrappers exceed the inspected transport boundary");
-  const parts = tokens(command);
-  for (let i = 0; i < parts.length; i++) {
-    const previous = parts[i - 1];
-    const invocation = i === 0 || ["&", ";", "|", "(", "{", ".", "sudo", "env", "exec", "call", "command"].includes(previous)
-      || /^[A-Za-z_]\w*=/.test(previous ?? "");
-    if (!invocation) continue;
-    const program = parts[i].replaceAll("\\", "/").split("/").at(-1).toLowerCase().replace(/\.exe$/, "");
-    if ((program === "unity" || /^\$(?:env:)?[\w:{}]+$/i.test(parts[i])) && parts[i + 1]?.toLowerCase() === "mcp")
-      fail("unity mcp/configure is disabled; call Unity CLI/Pipeline directly");
-    if (/^(?:mcp-for-unity|mcpforunityserver)$/.test(program)) fail("Coplay Unity MCP launch is disabled");
-    const end = parts.findIndex((x, n) => n > i && [";", "|", "&", ")"].includes(x));
-    const arguments_ = parts.slice(i + 1, end < 0 ? undefined : end);
-    if (["uvx", "uv", "pip", "pip3", "pipx", "npx", "npm", "pnpm", "bunx"].includes(program)) {
-      const following = arguments_.join(" ");
-      if (unityProvider(following)) fail("Unity MCP installation or launch is disabled");
-    }
-    if (["claude", "codex"].includes(program) && arguments_[0]?.toLowerCase() === "mcp"
-        && ["add", "add-json", "add-from-claude-desktop"].includes(arguments_[1]?.toLowerCase())) {
-      const registration = arguments_.slice(2).join(" ");
-      if (unityName(registration) || unityProvider(registration))
-        fail("Unity MCP registration through Claude/Codex is disabled");
-    }
-    if (["python", "python3", "node"].includes(program)
-        && unityProvider(arguments_[0] === "-m" ? arguments_[1] ?? "" : arguments_[0] ?? ""))
-      fail("Unity MCP launch is disabled");
-    if (program === "git" && parts[i + 1] === "clone" && unityProvider(parts.slice(i + 2).join(" ")))
-      fail("Unity MCP installation is disabled");
-    if (["start-process", "start"].includes(program)) {
-      const target = arguments_.join(" ");
-      if (unityProvider(target) || (/\bunity(?:\.exe)?\b/i.test(target) && /\bmcp\b/i.test(target)))
-        fail("Unity MCP launch is disabled");
-    }
-    if (["invoke-expression", "iex"].includes(program) && arguments_.length)
-      inspectShell(arguments_.join(" "), depth + 1);
-    if (["cmd", "powershell", "pwsh", "bash", "sh"].includes(program)) {
-      const option = parts.findIndex((x, n) => n > i && ["/c", "-c", "-lc", "-ic", "-command"].includes(x.toLowerCase()));
-      if (option >= 0 && parts[option + 1]) inspectShell(parts.slice(option + 1).join(" "), depth + 1);
-    }
-  }
-}
-export function assertUnityCliOnlyInput(input) {
-  const tool = input.tool_name ?? "";
-  const server = /^mcp__/i.test(tool) ? tool.slice(5).split("__")[0]
-    : /^mcp:/i.test(tool) ? tool.slice(4).split(":")[0] : null;
-  if (server !== null && unityName(server))
-    fail("Unity MCP tools are disabled, including discovery and read-only tools");
-  if (["Bash", "PowerShell"].includes(input.tool_name)) inspectShell(input.tool_input?.command ?? "");
-}

package/.claude/nccgs/tools/verification-jobs.mjs

@@ -1,171 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import crypto from "node:crypto";
-import { fileURLToPath } from "node:url";
-import { spawnSync } from "node:child_process";
-import { artifact, atomicJson, contained, hash, json, verifyArtifact } from "./policy.mjs";
-import { snapshot, taskPath } from "./gates.mjs";
-import { inputPolicy } from "./inputs.mjs";
-import { acquireLock, ownerState, pidState } from "./process-lock.mjs";
-import { captureCriteria, measurementBaseline } from "./criteria.mjs";
-import { inFinalReviewPhase } from "./review-budget.mjs";
-
-const worker = fileURLToPath(new URL("./verification-worker.mjs", import.meta.url));
-const need = (condition, message) => { if (!condition) throw new Error(message); };
-export function jobDirectory(project, jobId) {
-  need(typeof jobId === "string" && /^[a-f0-9-]{36}$/.test(jobId), "Invalid verification job ID");
-  return contained(project, `.nccgs/jobs/${jobId}`);
-}
-export function readJob(project, jobId) {
-  const job = json(path.join(jobDirectory(project, jobId), "request.json"));
-  need(job.schemaVersion === 1 && job.id === jobId && job.project === fs.realpathSync(project), "Verification job identity mismatch");
-  return job;
-}
-export function finishJob(project, job, result) {
-  const directory = jobDirectory(project, job.id);
-  const receipt = `.nccgs/evidence/check-${job.id}.json`;
-  if (fs.existsSync(contained(project, receipt))) return jobStatus(project, job.id, job.taskId);
-  let after = null, afterGenerated = [], snapshotError = null;
-  try {
-    const captured = snapshot(project, json(taskPath(project, job.taskId)));
-    after = captured.sha256; afterGenerated = captured.unityGeneratedFiles ?? [];
-  } catch (error) { snapshotError = error.message; }
-  const beforeGenerated = new Map((job.unityGeneratedBaseline ?? []).map(file => [file.path, file.sha256]));
-  const generatedFileChanges = afterGenerated.filter(file => beforeGenerated.get(file.path) !== file.sha256)
-    .map(file => ({ path: file.path, beforeSha256: beforeGenerated.get(file.path) ?? null, afterSha256: file.sha256 }));
-  const logPath = `.nccgs/evidence/check-${job.id}.log`;
-  fs.mkdirSync(path.dirname(contained(project, logPath)), { recursive: true });
-  if (!fs.existsSync(contained(project, logPath))) fs.writeFileSync(contained(project, logPath), result.error || "No command output captured\n");
-  else if (fs.statSync(contained(project, logPath)).size === 0) fs.appendFileSync(contained(project, logPath), "[NCCGS command produced no output]\n");
-  if (result.error || snapshotError) fs.appendFileSync(contained(project, logPath), `\n${result.error ?? ""}\n${snapshotError ?? ""}\n`);
-  const status = result.exitCode === 0 && !result.error && !result.timedOut && job.snapshot === after ? "PASS" : "FAIL";
-  atomicJson(contained(project, receipt), { schemaVersion: 1, origin: "verification-command", taskId: job.taskId, name: job.name,
-    jobId: job.id, requestKey: job.requestKey, snapshot: job.snapshot, contractHash: job.contractHash,
-    queuedAt: job.queuedAt, startedAt: result.startedAt ?? job.queuedAt, finishedAt: new Date().toISOString(),
-    timeoutMs: job.timeoutMs, supervisorDeadline: job.supervisorDeadline ?? null,
-    timedOut: result.timedOut === true, signal: result.signal ?? null,
-    snapshotError, executable: job.executable, arguments: job.arguments, exitCode: result.exitCode ?? null,
-    ...(job.unityGeneratedBaseline ? { unityGeneratedFiles: { before: job.unityGeneratedBaseline, after: afterGenerated, changes: generatedFileChanges } } : {}),
-    error: result.error ?? null, sourceUnchanged: job.snapshot === after, status, log: artifact(project, logPath),
-    acceptance: captureCriteria(project, job, status) });
-  atomicJson(path.join(directory, "result.json"), { status, evidence: artifact(project, receipt) });
-  return jobStatus(project, job.id, job.taskId);
-}
-export function jobStatus(project, jobId, taskId) {
-  const job = readJob(project, jobId), directory = jobDirectory(project, jobId);
-  need(!taskId || taskId === job.taskId, "Verification job belongs to another task");
-  const receipt = `.nccgs/evidence/check-${job.id}.json`;
-  if (fs.existsSync(contained(project, receipt))) {
-    const resultPath = path.join(directory, "result.json");
-    const evidence = fs.existsSync(resultPath) ? json(resultPath).evidence : artifact(project, receipt);
-    const result = json(verifyArtifact(project, evidence));
-    need(result.jobId === job.id && result.taskId === job.taskId && result.snapshot === job.snapshot && result.name === job.name, "Verification receipt identity mismatch");
-    verifyArtifact(project, result.log);
-    return { jobId, taskId: job.taskId, name: job.name, status: result.status, evidence, acceptance: result.acceptance ?? null };
-  }
-  const lockPath = path.join(directory, "owner.lock");
-  if (fs.existsSync(lockPath)) {
-    let owner; try { owner = json(lockPath); } catch { /* incomplete owner */ }
-    const state = ownerState(owner);
-    if (state === "dead") {
-      const lock = acquireLock(lockPath, { jobId });
-      try { return finishJob(project, job, { error: "Verification owner exited without a terminal receipt; attempt retained, no automatic rerun" }); }
-      finally { lock.release(); }
-    }
-    return { jobId, taskId: job.taskId, name: job.name, status: state === "unknown" ? "UNCERTAIN" : "RUNNING", owner: owner ?? null };
-  }
-  const launchPath = path.join(directory, "launch.json");
-  const launch = fs.existsSync(launchPath) ? json(launchPath) : null;
-  const launchError = fs.existsSync(path.join(directory, "launch-error.json"));
-  return { jobId, taskId: job.taskId, name: job.name, status: launchError || (launch && pidState(launch.pid) === "dead") ? "UNCERTAIN" : "STARTING",
-    ...(fs.existsSync(path.join(directory, "worker.log")) ? { diagnostics: fs.readFileSync(path.join(directory, "worker.log"), "utf8").slice(-4000) } : {}) };
-}
-export function listJobs(project, taskId) {
-  const directory = contained(project, ".nccgs/jobs");
-  if (!fs.existsSync(directory)) return [];
-  return fs.readdirSync(directory, { withFileTypes: true }).filter(e => e.isDirectory()).flatMap(e => {
-    const job = readJob(project, e.name);
-    return !taskId || job.taskId === taskId ? [jobStatus(project, job.id, job.taskId)] : [];
-  });
-}
-export function pendingJobs(project, taskId) { return listJobs(project, taskId).filter(job => !["PASS", "FAIL"].includes(job.status)); }
-export function startVerification(project, taskId, options) {
-  project = fs.realpathSync(project);
-  need(!inFinalReviewPhase(project, process.env.NCCGS_SUPERVISED_SESSION), "Final-review reserve cannot run new verification jobs; use existing receipts");
-  const task = json(taskPath(project, taskId));
-  need(task.schemaVersion !== 2 || task.mode === "implement" || !(process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT), "Audit/plan tasks cannot run arbitrary verification commands inside Claude");
-  need(typeof options.name === "string" && options.name.trim() && options.executable, "verify requires --name CHECK -- EXECUTABLE [ARGS]");
-  const configuredTimeout = inputPolicy(project).checks[options.name]?.timeoutMs;
-  const timeoutMs = options.timeoutMs === undefined ? (configuredTimeout ?? 300000) : options.timeoutMs;
-  need(Number.isSafeInteger(timeoutMs) && timeoutMs >= 100 && timeoutMs <= 7200000, "Verification timeoutMs must be an integer from 100 to 7200000");
-  need(configuredTimeout === undefined || timeoutMs <= configuredTimeout, "Verification timeout cannot exceed the configured check timeout");
-  let supervisorDeadline;
-  if (process.env.NCCGS_SUPERVISED_SESSION) {
-    const owner = json(contained(project, `.nccgs/runs/task-${taskId}.lock`));
-    need(/^[a-f0-9-]{36}$/.test(owner.runId ?? ""), "Missing supervised verification run identity");
-    const run = json(contained(project, `.nccgs/runs/${owner.runId}/run.json`));
-    need(run.project === project && run.taskId === taskId && run.sessionId === process.env.NCCGS_SUPERVISED_SESSION &&
-      Number.isSafeInteger(run.deadline), "Supervised verification run binding mismatch");
-    supervisorDeadline = run.deadline;
-  }
-  const requestKey = options.requestKey ?? crypto.randomUUID();
-  need(/^[\w-]{1,100}$/.test(requestKey), "Verification request key must use 1-100 letters, digits, underscores or hyphens");
-  const key = hash(`${taskId}\n${requestKey}`);
-  // Keep the request-key index outside the job directories.
-  const index = contained(project, `.nccgs/job-requests/${key}.json`);
-  const lock = acquireLock(`${index}.lock`, { taskId, requestKey });
-  let measurementLock;
-  try {
-    const captured = snapshot(project, task), current = captured.sha256;
-    const spec = { taskId, name: options.name, executable: options.executable, arguments: options.arguments ?? [],
-      timeoutMs, snapshot: current, contractHash: task.contractHash ?? null,
-      ...(supervisorDeadline === undefined ? {} : { supervisorDeadline }),
-      criteria: (task.contract?.acceptance ?? []).filter(c => !c.manual && c.check === options.name) };
-    const requestHash = hash(JSON.stringify(spec));
-    if (fs.existsSync(index)) {
-      const previous = json(index);
-      need(previous.requestHash === requestHash, "Verification request key reused with changed source/command/contract; use a new key for a new attempt");
-      return jobStatus(project, previous.jobId, taskId);
-    }
-    need(supervisorDeadline === undefined || Date.now() < supervisorDeadline, "Supervised run deadline reached; no new verification");
-    const outputPaths = spec.criteria.flatMap(c => (c.assertions ?? []).map(r => r.artifact.toLowerCase()));
-    if (outputPaths.length) {
-      measurementLock = acquireLock(contained(project, ".nccgs/measurement-start.lock"), { taskId, requestKey });
-      for (const pending of pendingJobs(project)) {
-        const other = readJob(project, pending.jobId);
-        need(!(other.criteria ?? []).some(c => (c.assertions ?? []).some(r => outputPaths.includes(r.artifact.toLowerCase()))),
-          "Another verification owns these measurement outputs; wait for its terminal receipt before starting a new attempt");
-      }
-    }
-    const baseline = measurementBaseline(project, spec.criteria);
-    const jobId = crypto.randomUUID(), directory = jobDirectory(project, jobId);
-    fs.mkdirSync(directory, { recursive: true });
-    fs.mkdirSync(contained(project, ".nccgs/evidence"), { recursive: true });
-    const job = { schemaVersion: 1, id: jobId, project, ...spec, requestKey, requestHash, measurementBaseline: baseline, queuedAt: new Date().toISOString(),
-      ...(captured.unityGeneratedFiles ? { unityGeneratedBaseline: captured.unityGeneratedFiles } : {}),
-      sessionId: process.env.NCCGS_SUPERVISED_SESSION || null };
-    atomicJson(path.join(directory, "request.json"), job);
-    atomicJson(index, { jobId, requestHash }); // pinned before launch: an ambiguous crash cannot mint a duplicate
-    const launched = spawnSync(process.execPath, [worker, "launch", project, jobId], { cwd: project, encoding: "utf8", windowsHide: true, timeout: 15000 });
-    if (launched.status !== 0 || launched.error) {
-      // A launcher timeout/error may occur after its detached child was created.
-      // Preserve uncertainty and let the actual owner publish its own receipt.
-      atomicJson(path.join(directory, "launch-error.json"), { at: new Date().toISOString(), error: launched.error?.message || launched.stderr, exitCode: launched.status });
-    }
-    return jobStatus(project, jobId, taskId);
-  } finally { measurementLock?.release(); lock.release(); }
-}
-export function waitVerification(project, jobId, taskId, timeoutMs = 30000) {
-  need(Number.isSafeInteger(timeoutMs) && timeoutMs >= 0 && timeoutMs <= 7200000 + 30000, "Invalid job wait timeout");
-  const deadline = Date.now() + timeoutMs;
-  for (;;) {
-    const result = jobStatus(project, jobId, taskId);
-    if (["PASS", "FAIL"].includes(result.status)) {
-      const launchPath = path.join(jobDirectory(project, jobId), "launch.json");
-      // A receipt is durable before the worker exits. Synchronous callers also
-      // wait for that owner to release its cwd/handles before disposing a project.
-      if (!fs.existsSync(launchPath) || pidState(json(launchPath).pid) === "dead" || Date.now() >= deadline) return result;
-    } else if (result.status === "UNCERTAIN" || Date.now() >= deadline) return result;
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(100, deadline - Date.now()));
-  }
-}