@agentplate/cli 1.1.0 → 1.2.0

package/src/commands/sling.ts

@@ -6,28 +6,27 @@
  * the agent identity + session row → dispatch the task over mail → run the first
  * headless turn → observe the agent's terminal mail to transition the session.
  *
- * Headless spawn-per-turn: this runs the FIRST turn. Subsequent turns are driven
- * by new mail (a later refinement); the basic core proves the single-turn loop.
+ * Headless spawn-per-turn: this runs the FIRST turn (a fresh runtime session).
+ * Follow-up turns are run by `agentplate turn <agent>`, which resumes the same
+ * session (warm start). Both share the {@link driveTurn} core.
  */
 
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { Command } from "commander";
-import { createIdentity, updateIdentity } from "../agents/identity.ts";
+import { assertCapacity } from "../agents/capacity.ts";
+import { driveTurn } from "../agents/drive.ts";
+import { createIdentity } from "../agents/identity.ts";
 import { buildDefaultManifest, getDefinition, loadManifest } from "../agents/manifest.ts";
 import { writeOverlay } from "../agents/overlay.ts";
-import { runTurn } from "../agents/turn-runner.ts";
 import { findProjectRoot, isInitialized, loadConfig } from "../config.ts";
 import { ValidationError } from "../errors.ts";
 import { createEventStore } from "../events/store.ts";
-import { runQualityGates } from "../insights/quality-gates.ts";
 import { jsonOutput } from "../json.ts";
 import { brand, muted, printHint, printInfo, printSuccess } from "../logging/color.ts";
 import { createMailClient } from "../mail/client.ts";
-import { createMailStore } from "../mail/store.ts";
 import {
 	currentRunPath,
 	eventsDbPath,
-	mailDbPath,
 	manifestFilePath,
 	packageAgentDefPath,
 	sessionsDbPath,
@@ -35,7 +34,7 @@ import {
 import { getRuntime } from "../runtimes/registry.ts";
 import { resolveModel } from "../runtimes/resolve.ts";
 import { createSessionStore } from "../sessions/store.ts";
-import { retrieveSkillsForSpawn, runSkillFeedbackAndDistill } from "../skills/lifecycle.ts";
+import { retrieveSkillsForSpawn } from "../skills/lifecycle.ts";
 import type { AgentManifest, AgentSession, Capability, OverlayConfig } from "../types.ts";
 import { SUPPORTED_CAPABILITIES } from "../types.ts";
 import { createWorktree } from "../worktree/manager.ts";
@@ -130,6 +129,17 @@ export function createSlingCommand(): Command {
 				// Resolve the run this agent belongs to.
 				const runId = resolveRun(store, root, opts);
 
+				// Enforce orchestration capacity BEFORE any worktree/session is created,
+				// so a runaway fan-out is refused cleanly instead of spawning unbounded.
+				const parentAgent = opts.parent ?? null;
+				assertCapacity({
+					depth: Number(opts.depth ?? "0"),
+					active: store.countActive(runId),
+					parentAgent,
+					parentActiveChildren: parentAgent ? store.countActiveByParent(parentAgent, runId) : 0,
+					limits: config.agents,
+				});
+
 				const name = uniqueName(store, opts.name ?? `${capability}-${taskId}`);
 				const branchName = `agentplate/${name}`;
 
@@ -199,91 +209,22 @@ export function createSlingCommand(): Command {
 					type: "dispatch",
 				});
 
-				// 5. Run the first headless turn.
-				const resolved = resolveModel(config, root, def.model);
-				store.updateSessionState(session.id, "working");
+				// 5. Run the first turn. Follow-up turns warm-start (resume) via
+				//    `agentplate turn`; driveTurn owns state + skills + auto-merge.
+				const resolved = resolveModel(config, root, def.model, capability);
 				const prompt = buildInitialPrompt(mail.checkInject(name), runtime.instructionPath);
-				let sawError = false;
-				const turn = await runTurn({
+				const { finalState, exitCode } = await driveTurn({
+					root,
+					config,
 					runtime,
-					worktreePath: worktree.path,
-					model: resolved.model,
+					store,
+					events,
+					mail,
+					session,
+					model: resolved,
 					prompt,
-					env: resolved.env,
-					onEvent: (event) => {
-						if (event.error || event.type === "error") sawError = true;
-						// Prefer the error message (so a failed agent's reason is visible in
-						// the feed/logs), else the token/cost JSON the Costs page aggregates.
-						const detail = event.error
-							? event.error
-							: event.usage
-								? JSON.stringify({ tokens: event.usage.tokens, cost: event.usage.costUsd })
-								: null;
-						events.record({
-							agentName: name,
-							runId,
-							type: event.type,
-							tool: event.tool ?? null,
-							detail,
-						});
-						// Bump last_activity on every streamed event so a long but active
-						// turn keeps itself fresh and is never reaped as "idle".
-						store.touch(session.id);
-					},
-				});
-				if (turn.runtimeSessionId) store.setRuntimeSessionId(session.id, turn.runtimeSessionId);
-
-				// A non-zero exit with no error event means the runtime failed via stderr
-				// (e.g. Pi's "No API key found for anthropic"). Record that stderr so the
-				// failure reason is visible in the feed/logs instead of a blank "failed".
-				if (turn.exitCode !== 0 && !sawError) {
-					const reason = turn.stderr.trim();
-					if (reason) {
-						events.record({
-							agentName: name,
-							runId,
-							type: "error",
-							tool: null,
-							detail: reason.length > 1000 ? `${reason.slice(0, 1000)}…` : reason,
-						});
-					}
-				}
-
-				// 6. Observe terminal mail to transition the session.
-				const finalState = resolveFinalState(root, name, capability, turn.exitCode);
-				store.updateSessionState(session.id, finalState);
-				store.touch(session.id);
-				updateIdentity(root, name, {
-					taskId,
-					summary: `${capability} ran a turn for ${taskId} → ${finalState}`,
 				});
 
-				// 7. Self-improving loop: score quality gates, append outcomes to
-				//    applied skills, and distill a skill when the work passed. Only
-				//    runs for a completed task; best-effort (never fails the spawn).
-				if (finalState === "completed" && config.skills.enabled) {
-					try {
-						const gateOutcome = await runQualityGates(
-							config.project.qualityGates ?? [],
-							worktree.path,
-						);
-						await runSkillFeedbackAndDistill({
-							root,
-							agentName: name,
-							capability,
-							taskId,
-							worktreePath: worktree.path,
-							baseRef: config.project.canonicalBranch,
-							runtime,
-							outcomeStatus: gateOutcome?.status ?? null,
-							skills: config.skills,
-							model: resolved.model,
-						});
-					} catch {
-						// Skill loop is advisory; a failure here must not fail the spawn.
-					}
-				}
-
 				if (useJson) {
 					jsonOutput({
 						agent: name,
@@ -293,7 +234,7 @@ export function createSlingCommand(): Command {
 						branchName,
 						worktreePath: worktree.path,
 						state: finalState,
-						exitCode: turn.exitCode,
+						exitCode: exitCode,
 					});
 					return;
 				}
@@ -301,8 +242,8 @@ export function createSlingCommand(): Command {
 				printInfo(`  task:    ${taskId}`);
 				printInfo(`  branch:  ${branchName}`);
 				printInfo(`  worktree:${muted(` ${worktree.path}`)}`);
-				if (turn.exitCode !== 0) {
-					printHint(`  turn exited ${turn.exitCode}; see \`agentplate mail list --from ${name}\``);
+				if (exitCode !== 0) {
+					printHint(`  turn exited ${exitCode}; see \`agentplate mail list --from ${name}\``);
 				}
 			} finally {
 				events.close();
@@ -378,26 +319,3 @@ function buildInitialPrompt(injected: string, instructionPath: string): string {
 	const header = `Read your instructions at ${instructionPath}, then begin your task.`;
 	return injected ? `${injected}\n\n${header}` : header;
 }
-
-/** Terminal mail types that mark a capability's work complete. */
-function terminalTypesFor(capability: Capability): string[] {
-	return capability === "merger" ? ["merged", "merge_failed"] : ["worker_done"];
-}
-
-function resolveFinalState(
-	root: string,
-	name: string,
-	capability: Capability,
-	exitCode: number,
-): AgentSession["state"] {
-	const terminal = terminalTypesFor(capability);
-	const store = createMailStore(mailDbPath(root));
-	try {
-		const sent = store.list({ from: name });
-		if (sent.some((m) => terminal.includes(m.type))) return "completed";
-	} finally {
-		store.close();
-	}
-	if (exitCode === 0) return "idle";
-	return "failed";
-}

package/src/commands/turn.test.ts

@@ -0,0 +1,101 @@
+/**
+ * `agentplate turn` command tests. Real initialized temp project + a real (mock)
+ * runtime turn. Drives the exported command's action via parseAsync.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+	AGENTPLATE_DIR,
+	CONFIG_FILE,
+	DEFAULT_CONFIG,
+	serializeConfig,
+	setProjectRootOverride,
+} from "../config.ts";
+import { NotFoundError, ValidationError } from "../errors.ts";
+import { sessionsDbPath } from "../paths.ts";
+import { createSessionStore } from "../sessions/store.ts";
+import type { AgentSession, SessionState } from "../types.ts";
+import { createTurnCommand } from "./turn.ts";
+
+let root: string;
+let worktree: string;
+
+function seedSession(over: Partial<AgentSession>): void {
+	const store = createSessionStore(sessionsDbPath(root));
+	const now = new Date().toISOString();
+	try {
+		store.upsertSession({
+			id: `session-${crypto.randomUUID()}`,
+			agentName: "builder-1",
+			capability: "builder",
+			taskId: "task-1",
+			runId: "run-1",
+			worktreePath: worktree,
+			branchName: "agentplate/builder-1",
+			state: "idle",
+			parentAgent: "lead-1",
+			depth: 1,
+			pid: null,
+			runtimeSessionId: "sess-prior",
+			startedAt: now,
+			lastActivity: now,
+			...over,
+		});
+	} finally {
+		store.close();
+	}
+}
+
+function sessionState(agent: string): SessionState | undefined {
+	const store = createSessionStore(sessionsDbPath(root));
+	try {
+		return store.getSessionByAgent(agent)?.state;
+	} finally {
+		store.close();
+	}
+}
+
+async function runTurnCmd(agent: string): Promise<void> {
+	await createTurnCommand().parseAsync([agent], { from: "user" });
+}
+
+beforeEach(() => {
+	root = mkdtempSync(join(tmpdir(), "agentplate-turn-cmd-"));
+	worktree = mkdtempSync(join(tmpdir(), "agentplate-turn-wt-"));
+	mkdirSync(join(root, AGENTPLATE_DIR), { recursive: true });
+	const config = structuredClone(DEFAULT_CONFIG);
+	config.runtime.default = "mock";
+	writeFileSync(join(root, AGENTPLATE_DIR, CONFIG_FILE), serializeConfig(config), "utf8");
+	setProjectRootOverride(root);
+	process.env.AGENTPLATE_MOCK_CMD = "true";
+});
+
+afterEach(() => {
+	setProjectRootOverride(null);
+	rmSync(root, { recursive: true, force: true });
+	rmSync(worktree, { recursive: true, force: true });
+	process.env.AGENTPLATE_MOCK_CMD = undefined;
+});
+
+describe("agentplate turn — refusals", () => {
+	test("throws NotFoundError for an unknown agent", async () => {
+		await expect(runTurnCmd("ghost")).rejects.toBeInstanceOf(NotFoundError);
+	});
+
+	test("refuses a terminal (completed) agent", async () => {
+		seedSession({ state: "completed" });
+		await expect(runTurnCmd("builder-1")).rejects.toBeInstanceOf(ValidationError);
+	});
+});
+
+describe("agentplate turn — runs the next turn", () => {
+	test("an idle agent takes another turn and transitions", async () => {
+		seedSession({ state: "idle" });
+		await runTurnCmd("builder-1");
+		// No terminal mail from the mock no-op → stays idle (ran without throwing).
+		expect(sessionState("builder-1")).toBe("idle");
+	});
+});

package/src/commands/turn.ts

@@ -0,0 +1,113 @@
+/**
+ * `agentplate turn <agent>` — run the NEXT headless turn for an existing agent.
+ *
+ * Where `sling` opens a fresh runtime session (turn 1), `turn` **resumes** it: it
+ * passes the session's captured `runtimeSessionId` to the runtime's `--resume`, so
+ * follow-up turns keep the warm context and skip the cold-start cost. The agent's
+ * unread mail is injected as the turn's prompt; the shared {@link driveTurn} core
+ * handles the state transition, skills loop, and auto-merge identically to turn 1.
+ *
+ * This is the multi-turn primitive: a coordinator/lead (or a future watcher) calls
+ * it when new mail arrives for an `idle` agent. Spawn-per-turn is preserved — each
+ * call is one fresh, resumed runtime subprocess.
+ */
+
+import { existsSync } from "node:fs";
+import { Command } from "commander";
+import { driveTurn } from "../agents/drive.ts";
+import { buildDefaultManifest, getDefinition, loadManifest } from "../agents/manifest.ts";
+import { findProjectRoot, isInitialized, loadConfig } from "../config.ts";
+import { NotFoundError, ValidationError } from "../errors.ts";
+import { createEventStore } from "../events/store.ts";
+import { jsonOutput } from "../json.ts";
+import { brand, muted, printInfo, printSuccess } from "../logging/color.ts";
+import { createMailClient } from "../mail/client.ts";
+import { eventsDbPath, manifestFilePath, sessionsDbPath } from "../paths.ts";
+import { getRuntime } from "../runtimes/registry.ts";
+import { resolveModel } from "../runtimes/resolve.ts";
+import { createSessionStore } from "../sessions/store.ts";
+import type { SessionState } from "../types.ts";
+
+interface TurnOptions {
+	json?: boolean;
+}
+
+/** States a turn can be driven from: paused/awaiting mail (not terminal, not mid-turn). */
+const DRIVABLE_STATES: ReadonlySet<SessionState> = new Set<SessionState>(["idle", "booting"]);
+
+export function createTurnCommand(): Command {
+	return new Command("turn")
+		.description("Run the next (resumed) turn for an existing agent")
+		.argument("<agent>", "agent name")
+		.option("--json", "output JSON")
+		.action(async (agent: string, opts: TurnOptions, command: Command) => {
+			const useJson = command.optsWithGlobals().json === true;
+			const root = findProjectRoot();
+			if (!isInitialized(root)) {
+				throw new ValidationError("Not initialized. Run `agentplate setup` first.");
+			}
+			const config = loadConfig(root);
+
+			const store = createSessionStore(sessionsDbPath(root));
+			const mail = createMailClient(root);
+			const events = createEventStore(eventsDbPath(root));
+			try {
+				const session = store.getSessionByAgent(agent);
+				if (!session) throw new NotFoundError(`No agent named "${agent}".`);
+				if (!DRIVABLE_STATES.has(session.state)) {
+					throw new ValidationError(
+						`Agent "${agent}" is ${session.state}; only an idle agent can take another turn.`,
+					);
+				}
+
+				const manifestPath = manifestFilePath(root);
+				const manifest = existsSync(manifestPath)
+					? loadManifest(manifestPath)
+					: buildDefaultManifest();
+				const def = getDefinition(manifest, session.capability);
+				const runtime = getRuntime(config.runtime.default, config.runtime.default);
+				const model = resolveModel(config, root, def.model, session.capability);
+
+				// The next turn's user text is the agent's unread mail (e.g. a child's
+				// reply or operator direction); fall back to a continue nudge.
+				const injected = mail.checkInject(agent);
+				const prompt =
+					injected.trim().length > 0
+						? injected
+						: "Continue your task. If it is complete, send your terminal mail.";
+
+				const { finalState, exitCode } = await driveTurn({
+					root,
+					config,
+					runtime,
+					store,
+					events,
+					mail,
+					session,
+					model,
+					prompt,
+					// Warm start: resume the runtime session captured on a prior turn.
+					resumeSessionId: session.runtimeSessionId ?? undefined,
+				});
+
+				if (useJson) {
+					jsonOutput({
+						agent,
+						capability: session.capability,
+						taskId: session.taskId,
+						state: finalState,
+						resumed: Boolean(session.runtimeSessionId),
+						exitCode,
+					});
+					return;
+				}
+				printSuccess(`${brand(agent)} [${session.capability}] → ${finalState}`);
+				printInfo(`  resumed: ${session.runtimeSessionId ? "yes (warm)" : "no (cold)"}`);
+				printInfo(`  worktree:${muted(` ${session.worktreePath}`)}`);
+			} finally {
+				events.close();
+				mail.close();
+				store.close();
+			}
+		});
+}

package/src/config.test.ts

@@ -45,6 +45,13 @@ describe("loadConfig", () => {
 		expect(cfg.merge.aiResolveEnabled).toBe(true);
 	});
 
+	test("an old config without merge.autoMerge inherits the 'off' default (deep merge)", () => {
+		writeConfig(root, "config.yaml", "merge:\n  aiResolveEnabled: true\n");
+		const cfg = loadConfig(root);
+		expect(cfg.merge.autoMerge).toBe("off");
+		expect(cfg.merge.aiResolveEnabled).toBe(true);
+	});
+
 	test("config.local.yaml overrides config.yaml", () => {
 		writeConfig(root, "config.yaml", "runtime:\n  default: claude\n");
 		writeConfig(root, "config.local.yaml", "runtime:\n  default: gemini\n");
@@ -74,6 +81,17 @@ describe("validateConfig", () => {
 	test("accepts the defaults", () => {
 		expect(() => validateConfig(structuredClone(DEFAULT_CONFIG))).not.toThrow();
 	});
+
+	test("auto-merge defaults to off", () => {
+		expect(DEFAULT_CONFIG.merge.autoMerge).toBe("off");
+	});
+
+	test("rejects an unknown merge.autoMerge mode", () => {
+		const cfg = structuredClone(DEFAULT_CONFIG);
+		// @ts-expect-error intentionally invalid value
+		cfg.merge.autoMerge = "always";
+		expect(() => validateConfig(cfg)).toThrow();
+	});
 });
 
 describe("isInitialized / serializeConfig", () => {

package/src/config.ts

@@ -13,7 +13,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import yaml from "js-yaml";
 import { ConfigError } from "./errors.ts";
-import type { AgentplateConfig } from "./types.ts";
+import type { AgentplateConfig, AutoMergeMode } from "./types.ts";
 
 /** Directory (relative to project root) holding all Agentplate state. */
 export const AGENTPLATE_DIR = ".agentplate";
@@ -46,6 +46,7 @@ export const DEFAULT_CONFIG: AgentplateConfig = {
 	},
 	merge: {
 		aiResolveEnabled: true,
+		autoMerge: "off",
 	},
 	skills: {
 		enabled: true,
@@ -175,6 +176,10 @@ export function validateConfig(config: AgentplateConfig): void {
 			"config.agents.idleTimeoutMinutes must be >= 0 (0 disables idle reaping)",
 		);
 	}
+	const autoMergeModes: AutoMergeMode[] = ["off", "on-gates-pass", "on-complete"];
+	if (!autoMergeModes.includes(config.merge.autoMerge)) {
+		throw new ConfigError(`config.merge.autoMerge must be one of: ${autoMergeModes.join(", ")}`);
+	}
 }
 
 /**

package/src/errors.ts

@@ -63,6 +63,17 @@ export class NotFoundError extends AgentplateError {
 	}
 }
 
+/**
+ * A spawn was refused because it would exceed a configured orchestration limit
+ * (maxConcurrent / maxAgentsPerLead / maxDepth). Distinct exit code so callers
+ * (a lead/coordinator) can recognize "at capacity — back off and retry later".
+ */
+export class CapacityError extends AgentplateError {
+	constructor(message: string) {
+		super(message, "CAPACITY_EXCEEDED", 5);
+	}
+}
+
 /** Type guard: is the given value a AgentplateError? */
 export function isAgentplateError(value: unknown): value is AgentplateError {
 	return value instanceof AgentplateError;

package/src/index.ts

@@ -34,6 +34,7 @@ import { createSpecCommand } from "./commands/spec.ts";
 import { createStatusCommand } from "./commands/status.ts";
 import { createStopCommand } from "./commands/stop.ts";
 import { createTuiCommand } from "./commands/tui.ts";
+import { createTurnCommand } from "./commands/turn.ts";
 import { createWorktreeCommand } from "./commands/worktree.ts";
 import { setProjectRootOverride } from "./config.ts";
 import { isAgentplateError } from "./errors.ts";
@@ -96,6 +97,7 @@ function buildProgram(): Command {
 	// Orchestration
 	program.addCommand(createCoordinatorCommand());
 	program.addCommand(createSlingCommand());
+	program.addCommand(createTurnCommand());
 	program.addCommand(createSpecCommand());
 	program.addCommand(createStatusCommand());
 	program.addCommand(createMailCommand());

package/src/insights/quality-gates.test.ts

@@ -0,0 +1,43 @@
+/**
+ * Tests for runQualityGates. Real subprocesses (no mocks) — gates are shell
+ * commands, so we use `true`/`false`/`sleep` to exercise pass/fail/partial and to
+ * prove the gates run concurrently (wall-clock < sum of durations).
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { QualityGate } from "../types.ts";
+import { runQualityGates } from "./quality-gates.ts";
+
+const gate = (name: string, command: string): QualityGate => ({ name, command });
+
+describe("runQualityGates", () => {
+	test("returns null when there are no gates", async () => {
+		expect(await runQualityGates([], process.cwd())).toBeNull();
+	});
+
+	test("all passing → success", async () => {
+		const out = await runQualityGates([gate("a", "true"), gate("b", "true")], process.cwd());
+		expect(out?.status).toBe("success");
+		expect(out?.results.every((r) => r.passed)).toBe(true);
+	});
+
+	test("all failing → failure", async () => {
+		const out = await runQualityGates([gate("a", "false"), gate("b", "false")], process.cwd());
+		expect(out?.status).toBe("failure");
+	});
+
+	test("mixed → partial", async () => {
+		const out = await runQualityGates([gate("ok", "true"), gate("bad", "false")], process.cwd());
+		expect(out?.status).toBe("partial");
+		// Order is preserved across the concurrent run.
+		expect(out?.results.map((r) => r.name)).toEqual(["ok", "bad"]);
+	});
+
+	test("gates run concurrently (wall-clock well under the sum)", async () => {
+		const gates = [gate("s1", "sleep 0.3"), gate("s2", "sleep 0.3"), gate("s3", "sleep 0.3")];
+		const out = await runQualityGates(gates, process.cwd());
+		expect(out?.status).toBe("success");
+		// Sequential would be ~900ms; concurrent should be well under that.
+		expect(out?.totalDurationMs ?? Number.POSITIVE_INFINITY).toBeLessThan(700);
+	});
+});

package/src/insights/quality-gates.ts

@@ -34,37 +34,36 @@ export async function runQualityGates(
 ): Promise<QualityGateOutcome | null> {
 	if (gates.length === 0) return null;
 
-	const results: GateResult[] = [];
-	let total = 0;
-	for (const gate of gates) {
-		const started = performance.now();
-		let exitCode = 1;
-		try {
-			// Run the gate through the platform shell: `cmd /c` on Windows (no bash
-			// there), `bash -lc` elsewhere. `.cmd` shims (biome/tsc) resolve under both.
-			const shellArgv =
-				process.platform === "win32"
-					? ["cmd", "/d", "/s", "/c", gate.command]
-					: ["bash", "-lc", gate.command];
-			const proc = Bun.spawn(shellArgv, {
-				cwd,
-				stdout: "pipe",
-				stderr: "pipe",
-			});
-			exitCode = await proc.exited;
-		} catch {
-			exitCode = 1;
-		}
-		const durationMs = Math.round(performance.now() - started);
-		total += durationMs;
-		results.push({
-			name: gate.name,
-			command: gate.command,
-			passed: exitCode === 0,
-			exitCode,
-			durationMs,
-		});
-	}
+	// Gates are independent checks, so run them concurrently and measure the
+	// outcome by wall-clock — `totalDurationMs` is the elapsed time of the whole
+	// batch (the slowest gate), not the sum of all gates.
+	const overallStart = performance.now();
+	const results: GateResult[] = await Promise.all(
+		gates.map(async (gate): Promise<GateResult> => {
+			const started = performance.now();
+			let exitCode = 1;
+			try {
+				// Run the gate through the platform shell: `cmd /c` on Windows (no bash
+				// there), `bash -lc` elsewhere. `.cmd` shims (biome/tsc) resolve under both.
+				const shellArgv =
+					process.platform === "win32"
+						? ["cmd", "/d", "/s", "/c", gate.command]
+						: ["bash", "-lc", gate.command];
+				const proc = Bun.spawn(shellArgv, { cwd, stdout: "pipe", stderr: "pipe" });
+				exitCode = await proc.exited;
+			} catch {
+				exitCode = 1;
+			}
+			return {
+				name: gate.name,
+				command: gate.command,
+				passed: exitCode === 0,
+				exitCode,
+				durationMs: Math.round(performance.now() - started),
+			};
+		}),
+	);
+	const total = Math.round(performance.now() - overallStart);
 
 	const passed = results.filter((r) => r.passed).length;
 	const status: OutcomeStatus =