@aipper/aiws 0.0.27 → 0.0.29

package/src/commands/ws-finish.js

@@ -0,0 +1,83 @@
+import { execSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { UserError } from "../errors.js";
+
+/**
+ * aiws finish — ff-merge + push + archive
+ * @param {{ cwd?: string, changeId?: string, into?: string, push?: boolean, remote?: string }} opts
+ */
+export async function wsFinishCommand({ cwd = ".", changeId, into, push = false, remote = "origin" } = {}) {
+  checkClean(cwd);
+
+  if (!changeId) {
+    changeId = detectChangeBranch(cwd);
+  }
+
+  if (!changeId) {
+    throw new UserError("Could not detect change ID. Provide as argument or be on a change branch.", { exitCode: 2 });
+  }
+
+  const targetBranch = into || "main";
+
+  // Validate before complete
+  try {
+    execSync(`npx -y @aipper/aiws change validate ${changeId} --strict 2>/dev/null`, { cwd, stdio: "inherit" });
+  } catch {
+    throw new UserError(`Validation failed for ${changeId}. Fix issues first.`, { exitCode: 1 });
+  }
+
+  // FF merge
+  const changeBranch = `change/${changeId}`;
+  const branchExists = execSync(`git branch --list '${changeBranch}'`, { cwd, encoding: "utf8" }).trim();
+  if (branchExists) {
+    console.log(`info: ff-merging ${changeBranch} → ${targetBranch}...`);
+    execSync(`git checkout ${targetBranch}`, { cwd, stdio: "inherit" });
+    execSync(`git merge --ff-only ${changeBranch}`, { cwd, stdio: "inherit" });
+  } else {
+    console.log("info: no change branch found, using current branch");
+  }
+
+  // Push
+  if (push) {
+    const currentBranch = execSync("git branch --show-current", { cwd, encoding: "utf8" }).trim();
+
+    // Push submodules first
+    if (existsSync(`${cwd}/.gitmodules`)) {
+      const targetsFile = `changes/${changeId}/submodules.targets`;
+      if (existsSync(targetsFile)) {
+        const content = execSync(`cat "${targetsFile}"`, { cwd, encoding: "utf8" });
+        for (const line of content.split("\n")) {
+          const t = line.trim();
+          if (!t || t.startsWith("#")) continue;
+          const [subPath, targetBranch] = t.split(/\s+/);
+          if (subPath && targetBranch) {
+            console.log(`info: pushing submodule ${subPath}...`);
+            execSync(`git push ${remote} ${targetBranch}`, { cwd: `${cwd}/${subPath}`, stdio: "inherit" });
+          }
+        }
+      }
+    }
+
+    execSync(`git push ${remote} ${currentBranch}`, { cwd, stdio: "inherit" });
+  }
+
+  // Archive
+  try {
+    execSync(`npx -y @aipper/aiws change archive ${changeId} --force 2>/dev/null || aiws change archive ${changeId} --force 2>/dev/null || true`, { cwd, stdio: "inherit" });
+  } catch { /* ignore archive failure — main flow done */ }
+
+  console.log(`ok: finish complete. ${push ? "Pushed and " : ""}Archived.`);
+}
+
+function checkClean(cwd) {
+  const out = execSync("git status --porcelain", { cwd, encoding: "utf8" }).trim();
+  if (out) {
+    throw new UserError("Working tree is not clean. Commit or stash first.", { exitCode: 2 });
+  }
+}
+
+function detectChangeBranch(cwd) {
+  const branch = execSync("git branch --show-current", { cwd, encoding: "utf8" }).trim();
+  const match = branch.match(/^(?:change|changes|ws|ws-change)\/(.+)$/);
+  return match ? match[1] : null;
+}

package/src/commands/ws-handoff.js

@@ -0,0 +1,40 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+
+/**
+ * aiws handoff — read/display handoff documents
+ * @param {{ cwd?: string }} opts
+ */
+export async function wsHandoffCommand({ cwd = "." } = {}) {
+  const changesDir = `${cwd}/changes`;
+  if (!existsSync(changesDir)) {
+    console.log("info: no changes/ directory found");
+    return;
+  }
+
+  // Check archive handoffs first
+  const archiveDir = `${changesDir}/archive`;
+  if (existsSync(archiveDir)) {
+    const archives = readdirSync(archiveDir).filter(f => f !== ".DS_Store");
+    for (const a of archives) {
+      const hf = `${archiveDir}/${a}/handoff.md`;
+      if (existsSync(hf)) {
+        console.log(`=== ${a} ===`);
+        console.log(readFileSync(hf, "utf8"));
+      }
+    }
+  }
+
+  // Check active change handoffs
+  const changes = readdirSync(changesDir).filter(f =>
+    !f.startsWith(".") && f !== "templates" && f !== "archive" && f !== "README.md"
+  );
+  for (const c of changes) {
+    const hf = `${changesDir}/${c}/handoff.md`;
+    if (existsSync(hf)) {
+      console.log(`=== ${c} (active) ===`);
+      console.log(readFileSync(hf, "utf8"));
+    }
+  }
+
+  console.log("info: handoffs are generated by aiws change finish --push");
+}

package/src/commands/ws-migrate.js

@@ -0,0 +1,41 @@
+import { execSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+/**
+ * aiws migrate — workspace migration (init or update)
+ * @param {{ cwd?: string }} opts
+ */
+export async function wsMigrateCommand({ cwd = "." } = {}) {
+  const localAiws = `${cwd}/node_modules/.bin/aiws`;
+
+  if (existsSync(`${cwd}/.aiws/manifest.json`)) {
+    console.log("info: workspace detected, running update...");
+    runAiws(localAiws, `update ${cwd}`);
+  } else {
+    console.log("info: no workspace detected, running init...");
+    runAiws(localAiws, `init ${cwd}`);
+  }
+
+  // Enable hooks
+  try {
+    execSync("git config core.hooksPath .githooks", { cwd, stdio: "inherit" });
+    console.log("info: hooks enabled (core.hooksPath=.githooks)");
+  } catch {
+    console.log("warn: could not set hooks (not a git repo?)");
+  }
+
+  console.log("ok: migrate complete");
+}
+
+function runAiws(localAiws, args) {
+  try {
+    if (existsSync(localAiws)) {
+      execSync(`${localAiws} ${args}`, { stdio: "inherit" });
+    } else {
+      execSync(`npx -y @aipper/aiws ${args}`, { stdio: "inherit" });
+    }
+  } catch (e) {
+    console.error(`error: aiws ${args} failed`);
+    throw e;
+  }
+}

package/src/commands/ws-plan-verify.js

@@ -0,0 +1,44 @@
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { UserError } from "../errors.js";
+
+/**
+ * aiws plan-verify — check plan completeness
+ * @param {{ cwd?: string }} opts
+ */
+export async function wsPlanVerifyCommand({ cwd = "." } = {}) {
+  const planDir = `${cwd}/plan`;
+  if (!existsSync(planDir)) {
+    throw new UserError("No plan/ directory found", { exitCode: 2 });
+  }
+  const plans = readdirSync(planDir).filter(f => f.endsWith(".md"));
+  if (plans.length === 0) {
+    throw new UserError("No plan files found in plan/", { exitCode: 2 });
+  }
+
+  const failures = [];
+  for (const planFile of plans) {
+    const content = readFileSync(`${planDir}/${planFile}`, "utf8");
+    const checks = [];
+
+    checks.push({ name: "Goal", pass: /^##?\s*Goal/im.test(content) });
+    checks.push({ name: "Non-goals", pass: /^##?\s*Non-goals/im.test(content) });
+    checks.push({ name: "Scope", pass: /^##?\s*(Scope|In Scope)/im.test(content) });
+    checks.push({ name: "Verify", pass: /^##?\s*Verify/im.test(content) });
+    checks.push({ name: "Risks", pass: /^##?\s*Risks/im.test(content) });
+
+    const failed = checks.filter(c => !c.pass);
+    if (failed.length > 0) {
+      failures.push({ file: planFile, missing: failed.map(c => c.name) });
+    }
+  }
+
+  if (failures.length > 0) {
+    for (const f of failures) {
+      console.error(`error: ${f.file} missing sections: ${f.missing.join(", ")}`);
+    }
+    throw new UserError("Plan verification failed. Fix missing sections.", { exitCode: 1 });
+  }
+
+  console.log("ok: plan verification passed");
+}

package/src/commands/ws-pull.js

@@ -0,0 +1,30 @@
+import { execSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { UserError } from "../errors.js";
+
+/**
+ * aiws pull — git pull --ff-only + submodule sync
+ * @param {{ cwd?: string }} opts
+ */
+export async function wsPullCommand({ cwd = "." } = {}) {
+  checkClean(cwd);
+
+  // git pull --ff-only
+  execSync("git pull --ff-only", { cwd, stdio: "inherit" });
+
+  // submodule sync if .gitmodules exists
+  if (existsSync(`${cwd}/.gitmodules`)) {
+    console.log("info: submodules detected, syncing...");
+    execSync("git submodule sync --recursive", { cwd, stdio: "inherit" });
+    execSync("git submodule update --init --recursive", { cwd, stdio: "inherit" });
+  }
+
+  console.log("ok: pull complete");
+}
+
+function checkClean(cwd) {
+  const out = execSync("git status --porcelain", { cwd, encoding: "utf8" }).trim();
+  if (out) {
+    throw new UserError("Working tree is not clean. Commit or stash first.", { exitCode: 2 });
+  }
+}

package/src/commands/ws-push.js

@@ -0,0 +1,71 @@
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { UserError } from "../errors.js";
+
+/**
+ * aiws push — submodule-aware push (submodules first, then superproject)
+ * @param {{ cwd?: string, remote?: string }} opts
+ */
+export async function wsPushCommand({ cwd = ".", remote = "origin" } = {}) {
+  checkClean(cwd);
+
+  if (existsSync(`${cwd}/.gitmodules`)) {
+    pushSubmodules(cwd, remote);
+  }
+
+  const branch = execSync("git branch --show-current", { cwd, encoding: "utf8" }).trim();
+  console.log(`info: pushing ${branch} to ${remote}...`);
+
+  try {
+    execSync(`git push ${remote} ${branch}`, { cwd, stdio: "inherit" });
+  } catch {
+    throw new UserError("Push failed. Check for diverged branch.", { exitCode: 1 });
+  }
+
+  console.log("ok: push complete");
+}
+
+function pushSubmodules(cwd, remote) {
+  const targetFile = findSubmodulesTargets(cwd);
+  if (!targetFile) {
+    console.log("info: no submodules.targets found, skipping submodule push");
+    return;
+  }
+
+  const content = readFileSync(targetFile, "utf8");
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const [subPath, targetBranch, rmt = remote] = trimmed.split(/\s+/);
+    if (!subPath || !targetBranch) continue;
+
+    console.log(`info: pushing submodule ${subPath} (${targetBranch})...`);
+    try {
+      execSync(`git push ${rmt} ${targetBranch}`, { cwd: `${cwd}/${subPath}`, stdio: "inherit" });
+    } catch {
+      throw new UserError(`Failed to push submodule ${subPath}`, { exitCode: 1 });
+    }
+  }
+}
+
+function findSubmodulesTargets(cwd) {
+  const paths = [
+    `${cwd}/changes/*/submodules.targets`,
+  ];
+  // Find first match using shell expansion
+  try {
+    const out = execSync("ls changes/*/submodules.targets 2>/dev/null || true", { cwd, encoding: "utf8" }).trim();
+    if (out) {
+      const first = out.split("\n")[0];
+      if (first) return `${cwd}/${first}`;
+    }
+  } catch { /* ignore */ }
+  return null;
+}
+
+function checkClean(cwd) {
+  const out = execSync("git status --porcelain", { cwd, encoding: "utf8" }).trim();
+  if (out) {
+    throw new UserError("Working tree is not clean. Commit or stash first.", { exitCode: 2 });
+  }
+}

package/src/commands/ws-submodule-setup.js

@@ -0,0 +1,65 @@
+import { execSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { UserError } from "../errors.js";
+
+/**
+ * aiws submodule-setup — set .gitmodules branch for each submodule
+ * @param {{ cwd?: string, branch?: string }} opts
+ */
+export async function wsSubmoduleSetupCommand({ cwd = ".", branch = "main" } = {}) {
+  checkClean(cwd);
+
+  if (!existsSync(`${cwd}/.gitmodules`)) {
+    console.log("info: no .gitmodules found, nothing to configure");
+    return;
+  }
+
+  // List submodules
+  const out = execSync("git config --file .gitmodules --get-regexp '^submodule\\..*\\.path$'", {
+    cwd, encoding: "utf8",
+  }).trim();
+
+  if (!out) {
+    console.log("info: no submodules in .gitmodules");
+    return;
+  }
+
+  const lines = out.split("\n");
+  for (const line of lines) {
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 2) continue;
+    const key = parts[0];  // submodule.<name>.path
+    const subPath = parts[1];
+    const name = key.replace(/^submodule\./, "").replace(/\.path$/, "");
+
+    // Check if branch already set
+    const existing = execSync(
+      `git config --file .gitmodules --get submodule.${name}.branch 2>/dev/null || true`,
+      { cwd, encoding: "utf8" }
+    ).trim();
+
+    if (existing) {
+      console.log(`info: ${subPath} branch already set: ${existing}`);
+      continue;
+    }
+
+    // Detect current branch
+    let detected = branch;
+    try {
+      const current = execSync(`git -C "${subPath}" branch --show-current 2>/dev/null || true`, { cwd, encoding: "utf8" }).trim();
+      if (current) detected = current;
+    } catch { /* use default */ }
+
+    console.log(`info: setting ${subPath} branch → ${detected}`);
+    execSync(`git submodule set-branch --branch ${detected} ${name}`, { cwd, stdio: "inherit" });
+  }
+
+  console.log("ok: submodule branches configured. Review .gitmodules changes before committing.");
+}
+
+function checkClean(cwd) {
+  const out = execSync("git status --porcelain", { cwd, encoding: "utf8" }).trim();
+  if (out) {
+    throw new UserError("Working tree is not clean. Commit or stash first.", { exitCode: 2 });
+  }
+}

package/src/commands/ws-verify-before-complete.js

@@ -0,0 +1,39 @@
+import { existsSync, readdirSync } from "node:fs";
+import { UserError } from "../errors.js";
+
+/**
+ * aiws verify-bc — verify before complete (check review + validate)
+ * @param {{ cwd?: string }} opts
+ */
+export async function wsVerifyBeforeCompleteCommand({ cwd = "." } = {}) {
+  const missing = [];
+
+  // Check spec-review
+  const changesDir = `${cwd}/changes`;
+  if (existsSync(changesDir)) {
+    const changes = readdirSync(changesDir).filter(f => !f.startsWith(".") && f !== "templates" && f !== "archive");
+    const hasSpecReview = changes.some(c =>
+      existsSync(`${changesDir}/${c}/review/spec-review.md`)
+    );
+    const hasQualityReview = changes.some(c =>
+      existsSync(`${changesDir}/${c}/review/quality-review.md`)
+    );
+    if (!hasSpecReview) missing.push("spec-review.md");
+    if (!hasQualityReview) missing.push("quality-review.md");
+  } else {
+    missing.push("changes/ directory not found");
+  }
+
+  // Check validate stamp
+  const stampDir = `${cwd}/.agentdocs/tmp/aiws-validate`;
+  const hasStamp = existsSync(stampDir) && readdirSync(stampDir).some(f => f.endsWith(".json"));
+  if (!hasStamp) {
+    console.log("warn: no validate stamp found. Run aiws validate . --stamp");
+  }
+
+  if (missing.length > 0) {
+    throw new UserError(`Missing gates: ${missing.join(", ")}`, { exitCode: 1 });
+  }
+
+  console.log("ok: all gates passed");
+}

package/src/manifest.js

@@ -5,6 +5,31 @@ import { pathExists, readText, writeText } from "./fs.js";
 import { findManagedBlock } from "./managed-blocks.js";
 import { UserError } from "./errors.js";
 
+/**
+ * Detect an older AIWS workspace that predates `.aiws/manifest.json`.
+ *
+ * Current migration only recognizes the built-in `workspace` template.
+ *
+ * @param {string} workspaceRoot
+ * @returns {Promise<string | null>}
+ */
+export async function detectLegacyWorkspaceTemplateId(workspaceRoot) {
+  const requiredSignals = [
+    "AI_PROJECT.md",
+    "REQUIREMENTS.md",
+    "AI_WORKSPACE.md",
+    "tools/ws_change_check.py",
+    "tools/requirements_contract.py",
+  ];
+
+  for (const rel of requiredSignals) {
+    const abs = joinRel(workspaceRoot, rel);
+    if (!(await pathExists(abs))) return null;
+  }
+
+  return "workspace";
+}
+
 /**
  * @param {any} manifest
  */
@@ -150,4 +175,3 @@ export async function validateDrift(options) {
     throw new UserError("Workspace drift detected.", { details: problems.join("\n") });
   }
 }
-

package/src/opencode-env.js

@@ -2,6 +2,10 @@ import path from "node:path";
 import { pathExists, readText } from "./fs.js";
 
 const OPENCODE_AGENT_NAMES = ["planner-sisyphus", "librarian", "explore", "oracle"];
+const SAFE_READ_ONLY_COMMANDS = new Set(["rg", "cat", "sed", "ls", "find", "git status", "git diff"]);
+const REQUIRED_WRITE_ALLOW_PATHS = [".agentdocs/tmp/", "changes/*/analysis/", "changes/*/review/", "changes/*/evidence/"];
+const REQUIRED_DENY_PATHS = ["secrets/", ".env*"];
+const REQUIRED_DENY_COMMANDS = ["rm", "mv", "git commit", "git push", "npm publish"];
 
 /**
  * @param {string} value
@@ -21,6 +25,72 @@ function readAgentState(raw, agentName) {
     present: !!entry && typeof entry === "object",
     enabled: !!(entry && typeof entry === "object" && entry.enabled === true),
     replacePlan: entry && typeof entry === "object" && typeof entry.replace_plan === "boolean" ? entry.replace_plan : null,
+    promptAppendConfigured: !!(
+      entry &&
+      typeof entry === "object" &&
+      typeof entry.prompt_append === "string" &&
+      entry.prompt_append.trim().length > 0
+    ),
+  };
+}
+
+/**
+ * @param {any} raw
+ */
+function readApprovalWhitelistState(raw) {
+  const policy =
+    raw &&
+    typeof raw === "object" &&
+    raw.aiws &&
+    typeof raw.aiws === "object" &&
+    raw.aiws.autonomy &&
+    typeof raw.aiws.autonomy === "object" &&
+    raw.aiws.autonomy.approval_whitelist &&
+    typeof raw.aiws.autonomy.approval_whitelist === "object"
+      ? raw.aiws.autonomy.approval_whitelist
+      : null;
+  const readOnlyCommands = Array.isArray(policy?.read_only_commands)
+    ? policy.read_only_commands.filter((value) => typeof value === "string" && value.trim().length > 0)
+    : [];
+  const writeAllowPaths = Array.isArray(policy?.write_allow_paths)
+    ? policy.write_allow_paths.filter((value) => typeof value === "string" && value.trim().length > 0)
+    : [];
+  const denyPaths = Array.isArray(policy?.deny_paths)
+    ? policy.deny_paths.filter((value) => typeof value === "string" && value.trim().length > 0)
+    : [];
+  const denyCommands = Array.isArray(policy?.deny_commands)
+    ? policy.deny_commands.filter((value) => typeof value === "string" && value.trim().length > 0)
+    : [];
+  const mode = typeof policy?.mode === "string" && policy.mode.trim().length > 0 ? policy.mode : "";
+  const hostPermissionMode =
+    typeof policy?.host_permission_mode === "string" && policy.host_permission_mode.trim().length > 0
+      ? policy.host_permission_mode
+      : "";
+  const enabled = policy?.enabled === true;
+  const safeReadOnlyCommands = readOnlyCommands.every((value) => SAFE_READ_ONLY_COMMANDS.has(value));
+  const requiredWritePathsPresent = REQUIRED_WRITE_ALLOW_PATHS.every((value) => writeAllowPaths.includes(value));
+  const requiredDenyPathsPresent = REQUIRED_DENY_PATHS.every((value) => denyPaths.includes(value));
+  const requiredDenyCommandsPresent = REQUIRED_DENY_COMMANDS.every((value) => denyCommands.includes(value));
+  const modeValid = mode === "assist-only";
+
+  return {
+    present: !!policy,
+    enabled,
+    mode,
+    hostPermissionMode,
+    readOnlyCommands,
+    writeAllowPaths,
+    denyPaths,
+    denyCommands,
+    configured:
+      enabled &&
+      modeValid &&
+      safeReadOnlyCommands &&
+      readOnlyCommands.length > 0 &&
+      requiredWritePathsPresent &&
+      requiredDenyPathsPresent &&
+      requiredDenyCommandsPresent &&
+      hostPermissionMode === "manual-only",
   };
 }
 
@@ -52,6 +122,45 @@ export async function detectOpenCodeEnvironment(workspaceRoot) {
   const agents = Object.fromEntries(OPENCODE_AGENT_NAMES.map((name) => [name, readAgentState(config, name)]));
   const enabledAgents = OPENCODE_AGENT_NAMES.filter((name) => agents[name]?.enabled === true);
   const recommendedAgentsReady = ["planner-sisyphus", "librarian", "explore", "oracle"].every((name) => agents[name]?.enabled === true);
+  const backgroundTasksConfigured = !!(config && typeof config === "object" && config.backgroundTasks && typeof config.backgroundTasks === "object");
+  const autoResumeEnabled = !!(
+    config &&
+    typeof config === "object" &&
+    config.experimental &&
+    typeof config.experimental === "object" &&
+    config.experimental.auto_resume === true
+  );
+  const approvalWhitelist = readApprovalWhitelistState(config);
+  const claudeSettingsExamplePath = path.join(workspaceRoot, ".claude", "settings.json.example");
+  const approvalWhitelistHelperPath = path.join(opencodeDir, "helpers", "approval-whitelist-check.sh");
+  const approvalWhitelistRunnerPath = path.join(opencodeDir, "helpers", "approval-whitelist-run.sh");
+  const approvalWhitelistWatchdogPath = path.join(opencodeDir, "helpers", "approval-whitelist-watchdog.sh");
+  const tmuxScanHelperPath = path.join(opencodeDir, "helpers", "tmux-swarm-scan.sh");
+  const tmuxRescueHelperPath = path.join(opencodeDir, "helpers", "tmux-swarm-rescue.sh");
+  const claudeSettingsExampleExists = await pathExists(claudeSettingsExamplePath);
+  const approvalWhitelistHelperExists = await pathExists(approvalWhitelistHelperPath);
+  const approvalWhitelistRunnerExists = await pathExists(approvalWhitelistRunnerPath);
+  const approvalWhitelistWatchdogExists = await pathExists(approvalWhitelistWatchdogPath);
+  const tmuxScanHelperExists = await pathExists(tmuxScanHelperPath);
+  const tmuxRescueHelperExists = await pathExists(tmuxRescueHelperPath);
+  const watchdogSuperviseReady =
+    configStatus === "loaded" &&
+    approvalWhitelist.configured &&
+    approvalWhitelistHelperExists &&
+    approvalWhitelistRunnerExists &&
+    approvalWhitelistWatchdogExists;
+  const autonomyReady =
+    configStatus === "loaded" &&
+    agents["planner-sisyphus"]?.promptAppendConfigured === true &&
+    backgroundTasksConfigured &&
+    autoResumeEnabled &&
+    approvalWhitelist.configured &&
+    claudeSettingsExampleExists &&
+    approvalWhitelistHelperExists &&
+    approvalWhitelistRunnerExists &&
+    approvalWhitelistWatchdogExists &&
+    tmuxScanHelperExists &&
+    tmuxRescueHelperExists;
 
   return {
     workspaceRoot,
@@ -67,10 +176,33 @@ export async function detectOpenCodeEnvironment(workspaceRoot) {
     recommendedAgentsReady,
     enabledAgents,
     agents,
+    backgroundTasksConfigured,
+    autoResumeEnabled,
+    approvalWhitelist,
+    watchdogSuperviseReady,
+    autonomyReady,
+    claudeSettingsExamplePath,
+    claudeSettingsExampleExists,
+    approvalWhitelistHelperPath,
+    approvalWhitelistHelperExists,
+    approvalWhitelistRunnerPath,
+    approvalWhitelistRunnerExists,
+    approvalWhitelistWatchdogPath,
+    approvalWhitelistWatchdogExists,
+    tmuxScanHelperPath,
+    tmuxScanHelperExists,
+    tmuxRescueHelperPath,
+    tmuxRescueHelperExists,
     rel: {
       opencodeDir: relativeOrDot(path.relative(workspaceRoot, opencodeDir)),
       configPath: relativeOrDot(path.relative(workspaceRoot, configPath)),
       examplePath: relativeOrDot(path.relative(workspaceRoot, examplePath)),
+      claudeSettingsExamplePath: relativeOrDot(path.relative(workspaceRoot, claudeSettingsExamplePath)),
+      approvalWhitelistHelperPath: relativeOrDot(path.relative(workspaceRoot, approvalWhitelistHelperPath)),
+      approvalWhitelistRunnerPath: relativeOrDot(path.relative(workspaceRoot, approvalWhitelistRunnerPath)),
+      approvalWhitelistWatchdogPath: relativeOrDot(path.relative(workspaceRoot, approvalWhitelistWatchdogPath)),
+      tmuxScanHelperPath: relativeOrDot(path.relative(workspaceRoot, tmuxScanHelperPath)),
+      tmuxRescueHelperPath: relativeOrDot(path.relative(workspaceRoot, tmuxRescueHelperPath)),
     },
   };
 }