strom-research 1.27.0-beta.3 → 1.27.0-beta.5

package/CHANGELOG.cs.md

@@ -7,7 +7,7 @@ Změny každé verze ve zkratce. Úplné poznámky a instalační řádky jsou n
 
 ## 1.27.0
 
-*Připravuje se: bety do 1.27.0-beta.3. Oddíl bude úplný s vydáním.*
+*Připravuje se: bety do 1.27.0-beta.5. Oddíl bude úplný s vydáním.*
 
 - **Snímky uložené ručně vrátí svůj úkol samy.** Kde se snímky archivu ukládají ručně – archiv, kam smí jen prohlížeč
   člověka, nebo archiv, jehož podmínky nic jiného nedovolují – výzkum požádá o knihu a čísla snímků a připraví pro ně
@@ -60,8 +60,10 @@ Změny každé verze ve zkratce. Úplné poznámky a instalační řádky jsou n
   spustit?“. Podmínka týdne předplatného uvádí využití za týden proti tomu, co je zatím dovoleno, a jak se počítá.
   `strom help --human` uvádí pořadí úkolů, práci mimo linie, opravy a ponechání rozporu mezi příkazy člověka. Výzkum s
   OpenCode pokračuje i po sezení, které OpenCode řádně uzavřel, ale ohlásil jako neúspěšné, a po přechodné chybě sítě –
-  totéž sezení se po krátkém čekání obnoví, v rámci času sezení. Když sandbox Codexu nepustí strom k výzkumu – na
-  Windows i u příkazu zadaného přes PowerShell –, výzkum se hned zastaví s tím, co zůstává volbou člověka, a takové
+  totéž sezení se po krátkém čekání obnoví, v rámci času sezení. Když sandbox Codexu nepustí strom k výzkumu – i v
+  rouře a na Windows i u příkazu zadaného přes PowerShell –, nebo když příkaz stromu odmítnou už pravidla Codexu, než
+  se spustí (na Windows strom v rouře nebo za `;`), výzkum se hned zastaví s tím, co zůstává volbou člověka,
+  a takové
   sezení úkol nikdy neodloží. Díky za hlášení na GitHubu. Změnu čtení snímků, kterou výzkum udělal sám a po které se
   četlo zřetelně méně jistě, hned vrátí – už ne až po 60 dnech – a `strom recent` to uvede.
 

package/CHANGELOG.de.md

@@ -7,7 +7,7 @@ Die Änderungen jeder Version in Kürze. Die vollständigen Hinweise und die Ins
 
 ## 1.27.0
 
-*In Vorbereitung: die Betas bis 1.27.0-beta.3. Der Abschnitt ist mit dem Release vollständig.*
+*In Vorbereitung: die Betas bis 1.27.0-beta.5. Der Abschnitt ist mit dem Release vollständig.*
 
 - **Von Hand gespeicherte Bilder bringen ihre Aufgabe von selbst zurück.** Wo die Bilder eines Archivs von Hand
   gespeichert werden – ein Archiv, das nur der Browser eines Menschen erreicht, oder eines, dessen Bedingungen nichts
@@ -74,8 +74,10 @@ Die Änderungen jeder Version in Kürze. Die vollständigen Hinweise und die Ins
   abseits der Linien, Korrekturen und das Belassen eines Widerspruchs unter den eigenen Befehlen des Menschen. Die
   Forschung mit OpenCode geht weiter nach einer Sitzung, die es ordnungsgemäß abgeschlossen, aber als fehlgeschlagen
   gemeldet hat, und nach einem vorübergehenden Netzwerkfehler – dieselbe Sitzung wird nach kurzem Warten fortgesetzt,
-  innerhalb der Zeit der Sitzung. Hält die Sandbox von Codex strom von der Forschung fern – unter Windows auch bei einem
-  über PowerShell gegebenen Befehl –, hält die Forschung sofort an und nennt, was die Wahl des Menschen bleibt; eine
+  innerhalb der Zeit der Sitzung. Hält die Sandbox von Codex strom von der Forschung fern – auch in einer Pipe und
+  unter Windows auch bei einem über PowerShell gegebenen Befehl – oder lehnen die Regeln von Codex einen strom-Befehl
+  ab, bevor er läuft (unter Windows strom in einer Pipe oder nach `;`), hält die Forschung sofort an und nennt, was die Wahl
+  des Menschen bleibt; eine
   solche Sitzung legt ihre Aufgabe nie beiseite. Danke für die Meldung auf GitHub. Eine Änderung beim Lesen der Scans,
   die die Forschung selbst vorgenommen hat und nach der die Lesungen deutlich unsicherer wurden, wird sofort
   zurückgenommen – nicht mehr erst nach 60 Tagen –, und `strom recent` sagt es.

package/CHANGELOG.md

@@ -7,7 +7,7 @@ The changes of each version in short. The full notes and the install lines are o
 
 ## 1.27.0
 
-*In preparation: the betas up to 1.27.0-beta.3. The section is complete with the release.*
+*In preparation: the betas up to 1.27.0-beta.5. The section is complete with the release.*
 
 - **Images saved by hand bring their task back by themselves.** Where an archive's images are saved by hand – an archive
   only a person's browser reaches, or one whose terms allow nothing else – the research asks for its book and the
@@ -65,8 +65,9 @@ The changes of each version in short. The full notes and the install lines are o
   counted. `strom help --human` lists the order of tasks, work off the lines, fixes and leaving a conflict among the
   person's own commands. OpenCode's research goes on after a session it closed properly but reported as failed, and
   after a passing network error – the same session resumed after a short wait, within the session's time. Codex kept
-  away from strom by its sandbox – on Windows also with a command said through PowerShell – stops the research at once
-  with what remains the person's choice, and such a session never puts its task aside. Thanks for the report on GitHub.
+  away from strom by its sandbox – also in a pipe, and on Windows with a command said through PowerShell – or a strom
+  command its own rules refuse before it runs (on Windows strom in a pipe or after `;`) stops the research at once with what remains the person's choice, and such a session never puts its task aside. Thanks for the
+  report on GitHub.
   A change the research made by itself in reading the scans, after which the readings got clearly less sure, is taken
   back at once – no longer only after 60 days – and `strom recent` says so.
 

package/CHANGELOG.pl.md

@@ -7,7 +7,7 @@ Zmiany każdej wersji w skrócie. Pełne informacje o wydaniach i polecenia inst
 
 ## 1.27.0
 
-*W przygotowaniu: bety do 1.27.0-beta.3. Sekcja będzie kompletna z wydaniem.*
+*W przygotowaniu: bety do 1.27.0-beta.5. Sekcja będzie kompletna z wydaniem.*
 
 - **Skany zapisane ręcznie same przywracają swoje zadanie.** Tam, gdzie skany archiwum zapisuje się ręcznie – archiwum,
   do którego wolno tylko przeglądarce człowieka, albo takie, którego warunki nie pozwalają na nic innego – badanie
@@ -67,8 +67,10 @@ Zmiany każdej wersji w skrócie. Pełne informacje o wydaniach i polecenia inst
   i jak jest liczone. `strom help --human` wymienia kolejność zadań, pracę poza liniami, poprawki i pozostawienie
   sprzeczności wśród poleceń człowieka. Badanie z OpenCode toczy się dalej po sesji, którą OpenCode poprawnie zamknął,
   ale zgłosił jako nieudaną, oraz po przejściowym błędzie sieci – ta sama sesja zostaje wznowiona po krótkim
-  oczekiwaniu, w ramach czasu sesji. Gdy sandbox Codexa nie dopuści strom do badań – w Windows także przy poleceniu
-  podanym przez PowerShell –, badanie od razu się zatrzymuje z tym, co pozostaje wyborem człowieka, a taka sesja nigdy
+  oczekiwaniu, w ramach czasu sesji. Gdy sandbox Codexa nie dopuści strom do badań – także w potoku, a w Windows
+  także przy poleceniu podanym przez PowerShell – albo gdy polecenie strom odrzucą już reguły Codexa, zanim się
+  uruchomi (w Windows strom w potoku lub po `;`), badanie od razu się zatrzymuje z tym, co pozostaje wyborem
+  człowieka, a taka sesja nigdy
   nie odkłada zadania. Dziękujemy za zgłoszenie na GitHubie. Zmiana odczytu skanów, którą badanie wprowadziło samo i po
   której odczyty stały się wyraźnie mniej pewne, zostaje od razu cofnięta – już nie dopiero po 60 dniach – a `strom
   recent` to podaje.

package/dist/commands/session.js

@@ -1196,8 +1196,11 @@ register(updatedDuringRun({
                 const after = Tree.open(root, runEnv);
                 let s = after.get(session.id);
                 // strom itself refused to the agent (its permissions, its sandbox — said through any shell): kept with the
-                // session's metrics, so the session is not counted against its task
-                const stromDenied = result.denied?.filter(deniedStrom).length ?? 0;
+                // session's metrics, so the session is not counted against its task. strom first in the command — in any part
+                // of it only where the agent refused the command whole before any of it ran (Codex's policy: deniedWhole); a
+                // sandbox that refused `touch ../x` in `touch ../x && strom …` refused no strom
+                const whole = new Set(result.deniedWhole ?? []);
+                const stromDenied = result.denied?.filter((d, i) => deniedStrom(d, whole.has(i))).length ?? 0;
                 if (stromDenied)
                     result = { ...result, metrics: { ...result.metrics, stromDenied } };
                 // the agent closed the session itself and its process then failed by its exit code alone (OpenCode: 1 after its
@@ -1253,7 +1256,7 @@ register(updatedDuringRun({
                 // what it cost: the agent's own and its readers', both apart too
                 const m = after.get(s.id)?.metrics ?? withReaders(result.metrics, s.metrics);
                 const total = sessionCost(m);
-                report.push({ session: s.id, task: task.id, outcome: result.outcome, ...(result.exitOnly && result.outcome === "ok" ? { agentExit: result.exitCode } : {}), ...(result.recovered ? { recovered: result.recovered } : {}), ...(s.summary ? { summary: s.summary } : {}), ...(total !== undefined ? { costUsd: total } : {}), ...(m.readersUsd !== undefined ? { agentUsd: m.costUsd ?? 0, readersUsd: m.readersUsd } : {}) });
+                report.push({ session: s.id, task: task.id, outcome: result.outcome, ...(result.exitOnly && result.outcome === "ok" ? { agentExit: result.exitCode } : {}), ...(result.recovered ? { recovered: result.recovered } : {}), ...(result.denied?.length ? { denied: result.denied.length } : {}), ...(stromDenied ? { stromDenied } : {}), ...(s.summary ? { summary: s.summary } : {}), ...(total !== undefined ? { costUsd: total } : {}), ...(m.readersUsd !== undefined ? { agentUsd: m.costUsd ?? 0, readersUsd: m.readersUsd } : {}) });
                 out(`■ ${s.id} ${s.state} · ${result.outcome}${costText(m) ? ` · ${costText(m)}` : ""}${s.summary ? ` · ${truncate(s.summary, 80)}` : ""}`);
                 if (result.denied?.length)
                     out(ui(lang, "ui.run.denied", { n: result.denied.length, what: result.denied.slice(0, 3).join(" · ") }));
@@ -1268,15 +1271,6 @@ register(updatedDuringRun({
                     stopCode = "user";
                     break;
                 }
-                // An agent that may not run strom can do nothing: stop, do not burn session after session.
-                // A refused command that only starts with strom (strom … && sed …, a loop) is no such thing
-                // when strom worked for it otherwise.
-                if (!ranStrom && stromDenied) {
-                    // Codex: its sandbox (strom out of it only as a command of its own, by the research's rules; on Windows .git
-                    // closed inside it) — said with what is the person's choice; nothing more is started, the task stays queued
-                    stopCode = runnerId === "codex" && permissions !== "full" ? "denied.codex" : "denied";
-                    break;
-                }
                 if (result.outcome === "limit") {
                     stopCode = "limit";
                     stopValues = { resets: result.resumeAt ? ui(lang, "ui.run.stop.resets", { at: result.resumeAt }) : "" };
@@ -1287,6 +1281,16 @@ register(updatedDuringRun({
                     stopValues = { command: runnerId === "claude" ? claudeLoginCommand(runEnv) : runner.command };
                     break;
                 }
+                // An agent that may not run strom can do nothing: stop, do not burn session after session.
+                // A refused command that only starts with strom (strom … && sed …, a loop) is no such thing
+                // when strom worked for it otherwise. (The plan's limit and a login gone come first: they ended the session,
+                // the limit said with when it resets; a refusal is met again by the run after them.)
+                if (!ranStrom && stromDenied) {
+                    // Codex: its sandbox (strom out of it only as a command of its own, by the research's rules; on Windows .git
+                    // closed inside it) — said with what is the person's choice; nothing more is started, the task stays queued
+                    stopCode = runnerId === "codex" && permissions !== "full" ? "denied.codex" : "denied";
+                    break;
+                }
                 // the agent does not take its model: said with what to do, never only its raw error
                 if (result.outcome === "error" && result.modelRejected) {
                     stopCode = "model";

package/dist/core/tree.js

@@ -31,7 +31,7 @@ export const TREE_FILE = "strom.json";
 export const SEAL_FOREIGN = "seal.foreign";
 // between releases the candidate being made (a bridge run from the sources says what it is: the Strom app goes by it);
 // at a release the release's own (package.json)
-export const VERSION = "1.27.0-beta.3";
+export const VERSION = "1.27.0-beta.5";
 const GITIGNORE = `# Strom Research — local state and large files are not versioned
 .strom/
 /media/

package/dist/core/writable.js

@@ -72,6 +72,22 @@ const WINDOWS_HINT = `${FOLDER_HINT} — on Windows, OneDrive or the controlled
 export function agentName(id) {
     return AGENTS.find((a) => a.id === id)?.name ?? { cursor: "Cursor", gemini: "Gemini CLI" }[id] ?? id;
 }
+/**
+ * How strom says it was refused under an agent (fs.sandboxed), word for word: a run reads it in what the agent's command
+ * printed — also when the command's exit code is 0 (strom in a pipe: the code is the last program's; found with
+ * codex-cli 0.155.1, `strom … | cat` refused by Codex's sandbox ended with 0).
+ */
+export const SANDBOX_REFUSAL = "strom runs under an agent, and most likely its sandbox forbids it";
+/**
+ * The mark of the session strom refused in, after SANDBOX_REFUSAL: `(strom session N0042)`, from STROM_SESSION (set by
+ * strom run for the agent it starts; Codex hands its commands the environment it was started with). A run reads a
+ * refusal where the exit code is 0 (strom in a pipe) only with its own session's mark: the words quoted from another
+ * session — a summary in the next strom brief, a note, strom grep — carry that session's mark or none (#8). Undefined:
+ * no session, or an id that is none of strom's.
+ */
+export function refusalMark(session) {
+    return session && /^[\p{L}\p{N}_-]{1,40}$/u.test(session) ? `(strom session ${session})` : undefined;
+}
 /**
  * A refusal to use a file or folder: under an agent most likely its sandbox (fs.sandboxed) — else no right to write
  * there (fs.no-permission; on Windows OneDrive and the controlled folder access named as what may also do it). `above`:
@@ -82,8 +98,10 @@ export function agentName(id) {
 export function noPermission(where, agent, platform = process.platform, above) {
     const at = where ? `: ${where}` : "";
     const params = where ? { where } : undefined;
-    if (agent)
-        return new UsageError(`no permission to use${at} — strom runs under an agent, and most likely its sandbox forbids it`, { hint: sandboxHint(agent, where), code: "fs.sandboxed", ...(params ? { params } : {}) });
+    if (agent) {
+        const mark = refusalMark(agent.STROM_SESSION);
+        return new UsageError(`no permission to use${at} — ${SANDBOX_REFUSAL}${mark ? ` ${mark}` : ""}`, { hint: sandboxHint(agent, where), code: "fs.sandboxed", ...(params ? { params } : {}) });
+    }
     if (above === "?")
         return new UsageError(`no permission to use${at}`, {
             hint: `strom could not see the programs that started it, as in an agent's sandbox: if an agent started strom, most likely its sandbox forbids it — the command approved outside the sandbox; else ${platform === "win32" ? WINDOWS_HINT : FOLDER_HINT}`,

package/dist/runners/codex.js

@@ -12,6 +12,7 @@ import { codexConfigFile, codexModel, effortArgs } from "../agents/effort.js";
 import { CODEX_BROWSER_SERVERS } from "../core/browser.js";
 import { isolated } from "../core/paths.js";
 import { inRoom, readerRoom } from "./room.js";
+import { refusalMark, SANDBOX_REFUSAL } from "../core/writable.js";
 /**
  * What Codex's sandbox lets it write besides the tree folder: the tree's .git — its sandbox keeps a .git
  * read-only even inside the folder it works in, and every change strom makes is a commit (found live:
@@ -120,6 +121,119 @@ export function codexWeb(item) {
         return typeof action.url === "string" && action.url ? { via: "web", url: action.url, tool: "web_search" } : undefined;
     return { via: "search", tool: "web_search" };
 }
+/**
+ * strom's own refusal under an agent in what a command printed with the exit code 0 (strom in a pipe: the code is the
+ * last program's) — only with the mark of the session it ran in (`<SANDBOX_REFUSAL> (strom session N0042)`,
+ * refusalMark): the words quoted — a session's summary in the next strom brief or session show, a note, strom grep,
+ * cat, echo — carry another session's mark or none, whatever their lines look like (#8, found 2026-11-05: an agent
+ * summed up a refusal in its words, and the next session's strom brief stopped the run). The mark is read in whatever
+ * shape a pipe gives strom's error — plain, --json, `jq .` or `jq -r .message`, Windows PowerShell 5.1's own
+ * (`strom.cmd : error: …`, wrapped at the console's width: the lines joined again), a dash spoiled by the console's
+ * code page (the sentence and the mark are ASCII). No session (a run strom did not start): no refusal read here.
+ */
+export function codexRefusedStrom(output, session) {
+    const mark = refusalMark(session);
+    return !!mark && output.replace(/\r?\n/g, "").includes(`${SANDBOX_REFUSAL} ${mark}`);
+}
+/**
+ * One string as Rust's Debug writes it (`"…"` with `\"`, `\\`, `\n`, `\u{…}`), read from its opening quote at `at`:
+ * its text and where it ended — undefined when it does not end (a line cut short).
+ */
+function debugString(s, at) {
+    if (s[at] !== '"')
+        return undefined;
+    let text = "";
+    for (let i = at + 1; i < s.length; i++) {
+        const c = s[i];
+        if (c === '"')
+            return { text, end: i + 1 };
+        if (c !== "\\") {
+            text += c;
+            continue;
+        }
+        const e = s[++i];
+        if (e === undefined)
+            return undefined;
+        if (e === "u") {
+            const u = /^\{([0-9a-fA-F]{1,6})\}/u.exec(s.slice(i + 1));
+            if (!u)
+                return undefined;
+            text += String.fromCodePoint(parseInt(u[1], 16));
+            i += u[0].length;
+        }
+        else
+            text += { n: "\n", r: "\r", t: "\t", "0": "\0" }[e] ?? e;
+    }
+    return undefined;
+}
+/**
+ * A command line as Codex renders it (the shlex crate's join: words '…'-quoted, or "…"-quoted with \ before $ ` " \
+ * where a backslash keeps single quotes out — Windows paths) split into its words again.
+ */
+function shlexWords(line) {
+    const words = [];
+    let word;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (/\s/u.test(c)) {
+            if (word !== undefined)
+                words.push(word);
+            word = undefined;
+        }
+        else if (c === "'") {
+            const close = line.indexOf("'", i + 1);
+            if (close < 0)
+                return [];
+            word = (word ?? "") + line.slice(i + 1, close);
+            i = close;
+        }
+        else if (c === '"') {
+            word ??= "";
+            for (i++; i < line.length && line[i] !== '"'; i++)
+                word += line[i] === "\\" && i + 1 < line.length ? line[++i] : line[i];
+            if (i >= line.length)
+                return [];
+        }
+        else
+            word = (word ?? "") + (c === "\\" && i + 1 < line.length ? line[++i] : c);
+    }
+    if (word !== undefined)
+        words.push(word);
+    return words;
+}
+/**
+ * A command Codex's own policy refused before it ran, as Codex alone says it — a line of its log on its stderr, never a
+ * command_execution item, never what a command printed or the agent wrote (codex-cli 0.166.0 on Windows, found
+ * 2026-11-05):
+ *   `<time> ERROR codex_core::tools::router: error=exec_command failed: CreateProcess { message: "Rejected(\"`<the
+ *   command, its shell around it>` rejected: blocked by policy\")" }`
+ * "Blocked by policy" is an approval nobody gives in `codex exec`: with Codex's own Windows sandbox not in use (as where
+ * it was found) every part of a command no rule allows is refused — `strom.cmd … | Select-Object`, `Set-Location .; strom.cmd …`:
+ * the rule lets strom run, the part after it is refused, and so the whole command (Codex's exec_policy.rs,
+ * render_decision_for_unmatched_command). A refusal by a rule of its own (strom's `git`, `strom login`, the person's:
+ * its justification) or of Codex's `rm -f` is what the rules say: no such refusal here. The command as the agent meant
+ * it (its shell around it taken off); undefined: no such line.
+ */
+export function codexPolicyRejected(line) {
+    const clean = line.replace(/\u001b\[[0-9;]*m/gu, "");
+    const at = /^\s*(?:\S+\s+)?ERROR\s+codex_core::tools::router:\s+error=[\p{L}\p{N}_.-]+ failed: CreateProcess \{ message: "/u.exec(clean);
+    if (!at)
+        return undefined;
+    const outer = debugString(clean, at.index + at[0].length - 1);
+    if (!outer || !/^\s*\}\s*$/u.test(clean.slice(outer.end)) || !outer.text.startsWith('Rejected("'))
+        return undefined;
+    const reason = debugString(outer.text, "Rejected(".length);
+    if (!reason || outer.text.slice(reason.end) !== ")")
+        return undefined;
+    const said = /^`([\s\S]+)` rejected: blocked by policy$/u.exec(reason.text);
+    if (!said)
+        return undefined;
+    const words = shlexWords(said[1]);
+    // the agent's own command: what its shell was given (-Command, -c, /c, -lc), else the words as they are
+    const flag = words.findIndex((w, i) => i > 0 && /^(?:-(?:command|c|lc)|\/[ck])$/iu.test(w));
+    const command = flag > 0 && flag < words.length - 1 ? words.slice(flag + 1).join(" ") : words.length ? words.join(" ") : said[1];
+    return shellUnwrapped(command);
+}
 /** The error Codex said last, kept when an earlier one said the plan's limit (the later one may only say the turn failed). */
 function failure(said, had) {
     return looksLikeLimit(had).limit && !looksLikeLimit(said).limit ? had : said || had;
@@ -150,6 +264,17 @@ function runCodex(opts) {
         tellUsage(opts, { total: true, in: usageNumber(u.input_tokens), cr: usageNumber(u.cached_input_tokens), out: usageNumber(u.output_tokens), turns: steps || undefined });
         steps = 0;
     };
+    // a command its policy refused before it ran is said on its stderr alone (codexPolicyRejected): counted like a denial —
+    // strom's own command so refused stops the run as its sandbox's refusal does (#8: on Windows Codex runs every command
+    // through PowerShell, and strom in a pipe, after `;` or `&` was refused so — the run went on and put its tasks aside)
+    const stderrLine = (line, heard) => {
+        const command = codexPolicyRejected(line);
+        if (command === undefined)
+            return;
+        // refused whole before any of it ran: strom counts refused in any part of it (deniedStrom's `whole`)
+        (heard.deniedWhole ??= []).push(heard.denied.length);
+        heard.denied.push(`Bash: ${command.slice(0, 120)}`);
+    };
     return runJsonLines("codex", codexArgs(opts), opts.env, opts, resume, (msg, heard) => {
         if (msg.type === "thread.started" && typeof msg.thread_id === "string") {
             heard.sessionId = msg.thread_id;
@@ -167,10 +292,17 @@ function runCodex(opts) {
         }
         // The sandbox refused a command (a write outside the tree, .git closed, the network off — strom's own refusal says
         // "sandbox", Windows "access is denied"), or Codex did not run it (its rules, an approval nobody gives in exec:
-        // "declined"): counted like a denial, the command as the agent meant it (its shell around it taken off)
+        // "declined"): counted like a denial, the command as the agent meant it (its shell around it taken off). strom's own
+        // refusal under an agent counts with the exit code 0 too: in a pipe (`strom … | cat`, `| Select-Object`) the code
+        // is the last program's — but then only strom's error with this session's mark, never its words quoted
+        // (codexRefusedStrom). (Codex's exec_command gives no item of a command its policy refused before it ran — said on
+        // its stderr alone: stderrLine above — nor of one its sandbox stopped within 150 ms; strom itself starts slower and
+        // is always said.)
         if (msg.type === "item.completed" &&
             item?.type === "command_execution" &&
-            (item.status === "declined" || (item.exit_code !== 0 && /operation not permitted|sandbox|read-only file system|access (?:to the path .{1,200} )?is denied/i.test(item.aggregated_output ?? ""))))
+            (item.status === "declined" ||
+                (item.exit_code !== 0 && ((item.aggregated_output ?? "").includes(SANDBOX_REFUSAL) || /operation not permitted|sandbox|read-only file system|access (?:to the path .{1,200} )?is denied/i.test(item.aggregated_output ?? ""))) ||
+                (item.exit_code === 0 && codexRefusedStrom(item.aggregated_output ?? "", opts.env?.STROM_SESSION))))
             heard.denied.push(`Bash: ${shellUnwrapped(String(item.command ?? "")).slice(0, 120)}`);
         // its web search, once its item is done (counted after the fact: core/metrics.ts)
         if (msg.type === "item.completed") {
@@ -197,5 +329,5 @@ function runCodex(opts) {
             const e = msg.error;
             heard.text = failure(String(e?.message ?? msg.message ?? ""), heard.text);
         }
-    });
+    }, { stderrLine });
 }

package/dist/runners/jsonl.js

@@ -78,7 +78,7 @@ export async function runJsonLines(command, args, env, opts, resume, onEvent, wa
         heard.deniedBefore = heard.denied.length;
         heard.error = undefined;
         heard.endedNormally = undefined;
-        const a = await attempt(command, args, input, env, opts, timeoutMs, heard, onEvent);
+        const a = await attempt(command, args, input, env, opts, timeoutMs, heard, onEvent, ways.stderrLine);
         lastStderr = a.stderr;
         // (its events set them while it ran)
         const said = heard.responses;
@@ -200,12 +200,13 @@ export async function runJsonLines(command, args, env, opts, resume, onEvent, wa
         ...(recovered ? { recovered } : {}),
         ...(limit.resumeAt ? { resumeAt: limit.resumeAt } : {}),
         ...(heard.denied.length ? { denied: heard.denied } : {}),
+        ...(heard.deniedWhole?.length ? { deniedWhole: heard.deniedWhole } : {}),
         ...(heard.refused?.length ? { refused: heard.refused } : {}),
         ...(outcome === "error" && looksLikeModelRejected(all) ? { modelRejected: true } : {}),
     };
 }
 /** One start of the agent; its events go to `heard`. */
-function attempt(command, args, input, env, opts, timeoutMs, heard, onEvent) {
+function attempt(command, args, input, env, opts, timeoutMs, heard, onEvent, onStderr) {
     return new Promise((resolve) => {
         const child = spawnAgent(command, args, { cwd: opts.cwd, env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true, detached: OWN_GROUP });
         feedStdin(child, input);
@@ -246,9 +247,28 @@ function attempt(command, args, input, env, opts, timeoutMs, heard, onEvent) {
             log.flush();
         });
         let stderr = "";
+        // its stderr a whole line at a time too, for a runner that reads it (a line cut between two chunks read whole)
+        const errText = new StringDecoder("utf8");
+        let errLine = "";
+        const errLines = (chunk, end = false) => {
+            if (!onStderr)
+                return;
+            errLine += chunk;
+            let nl;
+            while ((nl = errLine.indexOf("\n")) >= 0) {
+                onStderr(errLine.slice(0, nl).replace(/\r$/u, ""), heard);
+                errLine = errLine.slice(nl + 1);
+            }
+            if (end && errLine)
+                onStderr(errLine.replace(/\r$/u, ""), heard);
+            if (end)
+                errLine = "";
+        };
         child.stderr?.on("data", (d) => {
-            stderr += d.toString("utf8");
-            appendLog(opts.logFile, d.toString("utf8"));
+            const t = errText.write(d);
+            stderr += t;
+            appendLog(opts.logFile, t);
+            errLines(t);
         });
         const end = () => {
             if (timer)
@@ -264,6 +284,9 @@ function attempt(command, args, input, env, opts, timeoutMs, heard, onEvent) {
             buffer += text.end();
             if (buffer)
                 handle(buffer);
+            const errRest = errText.end();
+            stderr += errRest;
+            errLines(errRest, true);
             log.rest(buffer);
             log.flush();
             resolve({ code, signal, timedOut, stderr });

package/dist/runners/runner.js

@@ -79,11 +79,48 @@ export function shellUnwrapped(command) {
 }
 /**
  * Whether a refused tool call ("Bash: …", "PowerShell: …", as a run collects them) ran strom itself: strom, strom.cmd,
- * strom.exe, strom.ps1 or a second installation's strom-<suffix>, by its name or its path, first in the command.
+ * strom.exe, strom.ps1 or a second installation's strom-<suffix>, by its name or its path, first in the command — never
+ * inside quotes (`echo "x; strom brief"`) or as another program's argument. `whole`: the command was refused whole
+ * before any of it ran (Codex's policy, RunResult.deniedWhole): there strom counts first in any part of it too — after
+ * `;`, `&&`, `||`, a pipe or a new line (`Set-Location .; strom.cmd …`: found on Windows, #8). A command refused while
+ * it ran (a sandbox) is strom's only with strom first: in `touch ../x && strom …` the sandbox refused touch, and strom
+ * never ran.
  */
-export function deniedStrom(denied) {
+export function deniedStrom(denied, whole = false) {
     const command = shellUnwrapped(denied.replace(/^[\p{L}\p{N}_]+: /u, ""));
-    return /^(['"]?)(?:[^\s'"]*[\\/])?strom(?:-[\p{L}\p{N}_.-]+?)?(?:\.cmd|\.exe|\.ps1|\.bat)?\1(?:\s|$)/iu.test(command);
+    return (whole ? commandParts(command) : [command]).some((part) => STROM_FIRST.test(part.replace(/^&\s*/u, "")));
+}
+/** strom by its name or path first in a command (its own quotes around it, the same at both ends). */
+const STROM_FIRST = /^(['"]?)(?:[^\s'"]*[\\/])?strom(?:-[\p{L}\p{N}_.-]+?)?(?:\.cmd|\.exe|\.ps1|\.bat)?\1(?:\s|$)/iu;
+/** The parts of a command line between `;`, `&&`, `||`, `|` and new lines outside quotes, each trimmed. */
+function commandParts(command) {
+    const parts = [];
+    let part = "";
+    let quote;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (quote) {
+            part += c;
+            if (c === "\\" && quote === '"' && i + 1 < command.length)
+                part += command[++i];
+            else if (c === quote)
+                quote = undefined;
+        }
+        else if (c === "'" || c === '"') {
+            quote = c;
+            part += c;
+        }
+        else if (c === ";" || c === "\n" || c === "|" || (c === "&" && command[i + 1] === "&")) {
+            parts.push(part.trim());
+            part = "";
+            if (command[i + 1] === c)
+                i++;
+        }
+        else
+            part += c;
+    }
+    parts.push(part.trim());
+    return parts.filter(Boolean);
 }
 /** A command as a run's progress shows it: "$ " and its first line, cut at 140 characters — a cut ends in "…". */
 export function commandLine(command) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strom-research",
-  "version": "1.27.0-beta.3",
+  "version": "1.27.0-beta.5",
   "description": "Genealogical research toolkit for AI coding agents",
   "type": "module",
   "stromLayout": 2,