@alecsibilia/luca 13.0.0-alpha.1 → 13.0.0-alpha.10

package/dist/chunks/branch.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.CRmaAfXR.mjs';
+import '../shared/luca.CI5IvdwC.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,13 +8,13 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { r as runWriteHandler, q as lucaBranchGuardTool } from '../shared/luca.DjDTeDCi.mjs';
+import { r as runWriteHandler, u as lucaBranchGuardTool } from '../shared/luca.BtwZ3m3l.mjs';
+import '../shared/luca.ig-qt2eC.mjs';
 import 'node:os';
-import '../shared/luca.CrXzXueR.mjs';
-import '../shared/luca.HZxBTBgD.mjs';
-import '../shared/luca.TSMg1t7I.mjs';
+import '../shared/luca.GSXJf0Tv.mjs';
+import '../shared/luca.LySXBNNL.mjs';
+import '../shared/luca.DbrDoFFH.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.B3Mimc0P.mjs';
 
 const guardCommand = defineCommand({
   meta: {

package/dist/chunks/checks.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.CRmaAfXR.mjs';
+import '../shared/luca.CI5IvdwC.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,13 +8,13 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { c as readJsonPayload, r as runWriteHandler, p as lucaChecksRunTool } from '../shared/luca.DjDTeDCi.mjs';
+import { f as readJsonPayload, r as runWriteHandler, t as lucaChecksRunTool } from '../shared/luca.BtwZ3m3l.mjs';
+import '../shared/luca.ig-qt2eC.mjs';
 import 'node:os';
-import '../shared/luca.CrXzXueR.mjs';
-import '../shared/luca.HZxBTBgD.mjs';
-import '../shared/luca.TSMg1t7I.mjs';
+import '../shared/luca.GSXJf0Tv.mjs';
+import '../shared/luca.LySXBNNL.mjs';
+import '../shared/luca.DbrDoFFH.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.B3Mimc0P.mjs';
 
 const runCommand = defineCommand({
   meta: {

package/dist/chunks/claim-verify.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import { resolve } from 'pathe';
-import '../shared/luca.CRmaAfXR.mjs';
+import '../shared/luca.CI5IvdwC.mjs';
 import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
 import 'node:fs/promises';
 import { join } from 'node:path';

package/dist/chunks/classify.mjs

@@ -1,5 +1,5 @@
 import { defineCommand } from 'citty';
-import { C as ClassifyComplexityInputSchema } from '../shared/luca.CRmaAfXR.mjs';
+import { C as ClassifyComplexityInputSchema } from '../shared/luca.CI5IvdwC.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';

package/dist/chunks/confidence.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
-import '../shared/luca.CRmaAfXR.mjs';
-import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.CrXzXueR.mjs';
+import '../shared/luca.CI5IvdwC.mjs';
+import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.GSXJf0Tv.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,15 +8,46 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { b as renderConfidenceJournalMarkdown, r as readConfidenceJournal, g as getConfidenceSummary } from '../shared/luca.HZxBTBgD.mjs';
+import { r as readConfidenceJournal, b as renderConfidenceJournalMarkdown, g as getConfidenceSummary } from '../shared/luca.LySXBNNL.mjs';
 import { l as logger } from '../shared/luca.dM-MKlNE.mjs';
 import 'zod';
-import { c as readJsonPayload, r as runWriteHandler, t as lucaConfidenceLogTool } from '../shared/luca.DjDTeDCi.mjs';
+import { f as readJsonPayload, r as runWriteHandler, w as lucaConfidenceLogTool } from '../shared/luca.BtwZ3m3l.mjs';
+import '../shared/luca.ig-qt2eC.mjs';
 import 'node:os';
-import '../shared/luca.TSMg1t7I.mjs';
+import '../shared/luca.DbrDoFFH.mjs';
 import 'consola';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.B3Mimc0P.mjs';
+
+function selectConfidenceGateActions(entries) {
+  const auto = [];
+  const research = [];
+  const ask = [];
+  for (const entry of entries) {
+    if (entry.resolution) {
+      if (entry.resolution === "auto") auto.push(entry);
+      else if (entry.resolution === "research") research.push(entry);
+      else if (entry.resolution === "ask") ask.push(entry);
+      else {
+        entry.resolution;
+        ask.push(entry);
+      }
+    } else if (entry.confidence === "high") {
+      auto.push(entry);
+    } else if (entry.confidence === "medium") {
+      auto.push(entry);
+    } else if (entry.confidence === "low" && entry.researchable === true) {
+      research.push(entry);
+    } else {
+      ask.push(entry);
+    }
+  }
+  return {
+    auto,
+    research,
+    ask,
+    counts: { auto: auto.length, research: research.length, ask: ask.length }
+  };
+}
 
 async function resolveSlug(opts) {
   if (opts.explicit) return opts.explicit;
@@ -87,6 +118,14 @@ const logCommand = defineCommand({
     "review-hint": {
       type: "string",
       description: "Optional. Suggested focus area for a human reviewer."
+    },
+    researchable: {
+      type: "boolean",
+      description: "Optional. Set true when the ambiguity is factual and resolvable by automated research; absent/false means human judgment is required (gate routes to ask)."
+    },
+    resolution: {
+      type: "string",
+      description: "Optional. Explicit gate routing override: auto | research | ask. Overrides confidence-derived bucketing when set."
     }
   },
   async run({ args }) {
@@ -101,6 +140,13 @@ const logCommand = defineCommand({
       }
       payload = fromFile;
     } else {
+      const resolution = args.resolution;
+      if (resolution !== void 0 && resolution !== "auto" && resolution !== "research" && resolution !== "ask") {
+        logger.error(
+          `luca confidence log: --resolution must be one of: auto, research, ask (got "${resolution}"). Run \`luca confidence log --help\` for usage.`
+        );
+        process.exit(1);
+      }
       payload = {
         phase: args.phase,
         wave: args.wave !== void 0 ? Number(args.wave) : void 0,
@@ -112,7 +158,9 @@ const logCommand = defineCommand({
         reasoning: args.reasoning,
         risk: args.risk,
         files: splitCsv(args.files),
-        ...args["review-hint"] !== void 0 ? { reviewHint: args["review-hint"] } : {}
+        ...args["review-hint"] !== void 0 ? { reviewHint: args["review-hint"] } : {},
+        ...args.researchable !== void 0 ? { researchable: args.researchable } : {},
+        ...resolution !== void 0 ? { resolution } : {}
       };
     }
     await runWriteHandler(
@@ -183,6 +231,27 @@ const renderCommand = defineCommand({
 `);
   }
 });
+const gateCommand = defineCommand({
+  meta: {
+    name: "gate",
+    description: "Bucket a phase's confidence entries into gate actions and emit a JSON object shaped { auto: [...], research: [...], ask: [...], counts: { auto, research, ask } } to stdout. Each entry lands in exactly one bucket: explicit resolution overrides first, then high/medium \u2192 auto, low+researchable \u2192 research, otherwise \u2192 ask (fail-toward-human)."
+  },
+  args: {
+    slug: {
+      type: "string",
+      description: "Phase slug (defaults to active phase)."
+    }
+  },
+  async run({ args }) {
+    const cwd = process.cwd();
+    const slug = await resolveSlug({ explicit: args.slug, cwd });
+    const actions = selectConfidenceGateActions(
+      readConfidenceJournal({ cwd, slug })
+    );
+    process.stdout.write(`${JSON.stringify(actions, null, 2)}
+`);
+  }
+});
 const confidenceCommand = defineCommand({
   meta: {
     name: "confidence",
@@ -192,7 +261,8 @@ const confidenceCommand = defineCommand({
     log: logCommand,
     read: readCommand,
     summary: summaryCommand,
-    render: renderCommand
+    render: renderCommand,
+    gate: gateCommand
   }
 });
 

package/dist/chunks/config-version-skew.mjs

@@ -0,0 +1,97 @@
+import { existsSync } from 'node:fs';
+import { writeFile, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { LUCA_VERSION } from '../index.mjs';
+import 'citty';
+import 'pathe';
+
+const CHECK_NAME = "Config version skew";
+function configPath() {
+  return join(process.cwd(), ".luca", "config.json");
+}
+function isDevVersion(v) {
+  return v === "0.0.0-dev" || v.includes("dev");
+}
+async function readConfig() {
+  const p = configPath();
+  if (!existsSync(p)) return null;
+  try {
+    const raw = JSON.parse(await readFile(p, "utf-8"));
+    return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+  } catch {
+    return null;
+  }
+}
+const configVersionSkewCheck = {
+  name: CHECK_NAME,
+  scope: "project",
+  async run() {
+    const pass = (message) => ({
+      name: CHECK_NAME,
+      status: "pass",
+      message,
+      fixCommand: null,
+      details: null
+    });
+    if (isDevVersion(LUCA_VERSION)) {
+      return pass("dev CLI build \u2014 version skew not checked");
+    }
+    const config = await readConfig();
+    if (config === null) {
+      return pass("no .luca/config.json to check");
+    }
+    const stored = config.lucaVersion;
+    if (typeof stored !== "string" || stored.length === 0) {
+      return pass("config.json has no lucaVersion to compare");
+    }
+    if (stored === LUCA_VERSION) {
+      return pass(`config.lucaVersion matches CLI (${LUCA_VERSION})`);
+    }
+    return {
+      name: CHECK_NAME,
+      status: "warning",
+      message: `config.lucaVersion ${stored} \u2260 installed CLI ${LUCA_VERSION}`,
+      fixCommand: "luca doctor --fix",
+      details: [
+        `.luca/config.json records lucaVersion="${stored}" but the installed CLI is ${LUCA_VERSION}.`,
+        `Skills/agents that branch on lucaVersion may behave as if on the older version.`,
+        `Run \`luca doctor --fix\` to reconcile (rewrites lucaVersion, preserves all other config keys).`
+      ].join("\n  ")
+    };
+  },
+  async fix() {
+    if (isDevVersion(LUCA_VERSION)) {
+      return { applied: [], errors: [] };
+    }
+    const config = await readConfig();
+    if (config === null) {
+      return { applied: [], errors: [] };
+    }
+    const stored = config.lucaVersion;
+    if (stored === LUCA_VERSION) {
+      return { applied: [], errors: [] };
+    }
+    try {
+      const next = { ...config, lucaVersion: LUCA_VERSION };
+      await writeFile(
+        configPath(),
+        JSON.stringify(next, null, 2) + "\n"
+      );
+      return {
+        applied: [
+          `Reconciled .luca/config.json lucaVersion ${typeof stored === "string" ? stored : "unset"} \u2192 ${LUCA_VERSION}`
+        ],
+        errors: []
+      };
+    } catch (err) {
+      return {
+        applied: [],
+        errors: [
+          `Failed to rewrite .luca/config.json lucaVersion: ${err.message}`
+        ]
+      };
+    }
+  }
+};
+
+export { configVersionSkewCheck };

package/dist/chunks/doctor.mjs

@@ -7,16 +7,32 @@ async function executeDoctor(options = {}) {
   logger.info("Running environment diagnostics...\n");
   const { bunRuntimeCheck } = await import('./bun-runtime.mjs');
   const { muninndbHealthCheck } = await import('./muninndb-health.mjs');
+  const { muninnMcpCheck } = await import('./muninn-mcp.mjs');
   const { staleMcpServerCheck } = await import('./stale-mcp-server.mjs');
+  const { staleGlobalSymlinksCheck } = await import('./stale-global-symlinks.mjs');
+  const { legacyPackageCheck } = await import('./legacy-package.mjs');
+  const { legacyClaudeArtifactsCheck } = await import('./legacy-claude-artifacts.mjs');
+  const { sharedTmpPayloadsCheck } = await import('./shared-tmp-payloads.mjs');
   const { strayLocalInstallCheck } = await import('./stray-local-install.mjs');
+  const { lucaGitignoreCheck } = await import('./luca-gitignore.mjs');
+  const { configVersionSkewCheck } = await import('./config-version-skew.mjs');
+  const { vaultConfigLocationCheck } = await import('./vault-config-location.mjs');
   const allChecks = [
     // Prerequisites
     bunRuntimeCheck,
     staleMcpServerCheck,
     // Global
     muninndbHealthCheck,
+    muninnMcpCheck,
+    staleGlobalSymlinksCheck,
+    legacyPackageCheck,
+    legacyClaudeArtifactsCheck,
+    sharedTmpPayloadsCheck,
     // Project (cwd-dependent)
-    strayLocalInstallCheck
+    strayLocalInstallCheck,
+    configVersionSkewCheck,
+    vaultConfigLocationCheck,
+    lucaGitignoreCheck
   ];
   const checks = scope ? allChecks.filter((check) => check.scope === scope) : allChecks;
   if (checks.length === 0) {

package/dist/chunks/hook.mjs

@@ -1,11 +1,11 @@
 import { defineCommand } from 'citty';
-import { c as coarsePhaseOf, a as classifyWritePath, A as AUDIT_PATH_PATTERN, W as WAVE_FILE_RE } from '../shared/luca.CRmaAfXR.mjs';
-import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.CrXzXueR.mjs';
+import { c as coarsePhaseOf, t as toLucaRelative, a as classifyWritePath, b as TMP_PATH_PATTERN, A as AUDIT_PATH_PATTERN, W as WAVE_FILE_RE } from '../shared/luca.CI5IvdwC.mjs';
+import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.GSXJf0Tv.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
-import { S as STEP_ARTIFACTS } from '../shared/luca.B3Mimc0P.mjs';
-import { p as phasePathFor } from '../shared/luca.TSMg1t7I.mjs';
+import { l as lucaStateClaimOwnerTool, S as STEP_ARTIFACTS } from '../shared/luca.ig-qt2eC.mjs';
+import { p as phasePathFor } from '../shared/luca.DbrDoFFH.mjs';
 import 'node:crypto';
 import 'node:module';
 import 'node:url';
@@ -72,6 +72,13 @@ function isToolAllowed({
 }
 
 const READONLY_COMMANDS = /* @__PURE__ */ new Set([
+  // Shell navigation/no-ops: mutate shell state, not files — benign for
+  // the file/repo-mutation policy this classifier enforces. `cd` is the
+  // big one: agents prefix nearly every command with `cd <dir> && …`, so
+  // omitting it made every compound command classify as a mutate.
+  "cd",
+  "pushd",
+  "popd",
   "ls",
   "cat",
   "grep",
@@ -87,7 +94,32 @@ const READONLY_COMMANDS = /* @__PURE__ */ new Set([
   "echo",
   "printf",
   "true",
-  "false"
+  "false",
+  // Read-only text filters. These read stdin/files and write to stdout —
+  // they never mutate files on their own. Omitting them made any pipeline
+  // through a filter (e.g. `find . | sort`) promote to bash-mutate via the
+  // unknown-command fallback, blocking read-only inspection in restrictive
+  // phases (v13 run report, M1). `tee`/`xargs` are deliberately EXCLUDED:
+  // `tee` writes files and `xargs` runs an arbitrary (possibly mutating)
+  // command, so they stay conservative.
+  "sort",
+  "uniq",
+  "cut",
+  "tr",
+  "comm",
+  "diff",
+  "jq",
+  "rg",
+  "column",
+  "nl",
+  "tac",
+  "rev",
+  "paste",
+  "fold",
+  "join"
+  // NOTE: `playwright-cli` is NOT in this set — it has a dedicated
+  // clause (step 4c in classifySubcommand) that extracts `--filename`
+  // output paths and enforces the `.playwright-cli/` artifact dir.
 ]);
 const GIT_READONLY_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "status",
@@ -184,18 +216,29 @@ const PKG_MUTATE_PATTERNS = [
   ["pnpm", "add"]
 ];
 const ALWAYS_DENIED_COMMANDS = /* @__PURE__ */ new Set(["eval", "source", "."]);
+const LUCA_TOPLEVEL_READ = /* @__PURE__ */ new Set(["version", "telemetry", "rules"]);
+const LUCA_TOPLEVEL_WRITE = /* @__PURE__ */ new Set([
+  "init",
+  "vault:init",
+  "retro",
+  "claim-verify",
+  "classify",
+  "doctor",
+  "repair"
+]);
 const LUCA_READ_VERBS = /* @__PURE__ */ new Set([
   "read",
   "current",
   "list",
   "guard",
+  "aggregate",
   "filter-stale",
   "detect-convergence",
   "regression-check"
 ]);
 const LUCA_NOUN_VERBS = {
-  state: /* @__PURE__ */ new Set(["read", "advance"]),
-  phase: /* @__PURE__ */ new Set(["current"]),
+  state: /* @__PURE__ */ new Set(["read", "advance", "claim-owner", "set-current-phase"]),
+  phase: /* @__PURE__ */ new Set(["current", "advance", "archive"]),
   roadmap: /* @__PURE__ */ new Set(["read", "create"]),
   preferences: /* @__PURE__ */ new Set(["read", "write"]),
   todo: /* @__PURE__ */ new Set(["add", "list", "update"]),
@@ -208,13 +251,22 @@ const LUCA_NOUN_VERBS = {
   checks: /* @__PURE__ */ new Set(["run"]),
   branch: /* @__PURE__ */ new Set(["guard"]),
   workflow: /* @__PURE__ */ new Set(["reset"]),
-  confidence: /* @__PURE__ */ new Set(["log"])
+  confidence: /* @__PURE__ */ new Set(["log"]),
+  // Read-side surfaces over the per-phase verify.json files.
+  verification: /* @__PURE__ */ new Set(["read", "aggregate"])
 };
 function classifyLucaCommand(rest) {
+  if (rest.some((t) => ["--help", "-h", "--version"].includes(t))) {
+    return "bash-readonly";
+  }
   const noun = rest.find((t) => !t.startsWith("-"));
-  if (!noun) return void 0;
+  if (!noun) return "bash-readonly";
   const verbs = LUCA_NOUN_VERBS[noun];
-  if (!verbs) return void 0;
+  if (!verbs) {
+    if (LUCA_TOPLEVEL_READ.has(noun)) return "bash-readonly";
+    if (LUCA_TOPLEVEL_WRITE.has(noun)) return "luca-write";
+    return void 0;
+  }
   const afterNoun = rest.slice(rest.indexOf(noun) + 1);
   const verb = afterNoun.find((t) => !t.startsWith("-"));
   if (!verb || !verbs.has(verb)) {
@@ -344,6 +396,20 @@ function classifySubcommand(sub) {
       return { category: lucaCategory, targetPaths: [] };
     }
   }
+  if (cmd === "playwright-cli") {
+    const target = extractFilenameFlag(rest);
+    if (target !== void 0) {
+      const inArtifactDir = target.startsWith(".playwright-cli/") && !target.split("/").includes("..");
+      return {
+        category: inArtifactDir && !sub.redirect ? "bash-readonly" : "bash-mutate",
+        targetPaths: [...targetsFromRedirect, target]
+      };
+    }
+    return {
+      category: sub.redirect ? "bash-mutate" : "bash-readonly",
+      targetPaths: targetsFromRedirect
+    };
+  }
   if (cmd === "bunx" && tokens.includes("tsc") && tokens.includes("--noEmit")) {
     return {
       category: sub.redirect ? "bash-mutate" : "bash-readonly",
@@ -358,6 +424,16 @@ function classifySubcommand(sub) {
       };
     }
   }
+  if (cmd === "sed" || cmd === "awk") {
+    const sedInPlace = cmd === "sed" && rest.some((a) => a === "--in-place" || a.startsWith("-i"));
+    const awkInPlace = cmd === "awk" && rest.some((a, i) => a === "-i" && rest[i + 1] === "inplace");
+    if (!sedInPlace && !awkInPlace) {
+      return {
+        category: sub.redirect ? "bash-mutate" : "bash-readonly",
+        targetPaths: targetsFromRedirect
+      };
+    }
+  }
   if (MUTATE_COMMANDS.has(cmd)) {
     const lastArg = cmd === "cp" || cmd === "mv" || cmd === "ln" ? lastNonFlag(rest) : void 0;
     const sedTarget = cmd === "sed" && rest.includes("-i") ? rest[rest.length - 1] : void 0;
@@ -380,6 +456,20 @@ function classifySubcommand(sub) {
     targetPaths: targetsFromRedirect
   };
 }
+function extractFilenameFlag(args) {
+  for (let i = 0; i < args.length; i += 1) {
+    const a = args[i];
+    if (a.startsWith("--filename=")) {
+      const value = a.slice("--filename=".length);
+      return value.length > 0 ? value : void 0;
+    }
+    if (a === "--filename") {
+      const value = args[i + 1];
+      return value !== void 0 && !value.startsWith("-") ? value : void 0;
+    }
+  }
+  return void 0;
+}
 function lastNonFlag(args) {
   for (let i = args.length - 1; i >= 0; i -= 1) {
     if (!args[i].startsWith("-")) return args[i];
@@ -476,9 +566,21 @@ async function handleStageGateHook(opts) {
   }
   const toolName = parsed.tool_name ?? parsed.toolName;
   const toolInput = parsed.tool_input ?? parsed.toolInput;
+  const sessionId = parsed.session_id ?? parsed.sessionId;
   const cwd = opts.cwd ?? process.cwd();
   const homedir = opts.homedir ?? process.env.HOME;
   const state = await loadCurrentState({ cwd });
+  if (toolName === "Bash" && sessionId && state.ownerSessionId !== sessionId && isStateAdvanceCommand(
+    toolInput?.command ?? ""
+  )) {
+    try {
+      await lucaStateClaimOwnerTool.handler({ sessionId }, { cwd });
+      state.ownerSessionId = sessionId;
+    } catch (err) {
+      log(`stage-gate: owner stamp skipped (${err.message})`);
+    }
+  }
+  const isBystander = Boolean(state.ownerSessionId) && Boolean(sessionId) && state.ownerSessionId !== sessionId;
   const phase = coarsePhaseOf(state.pipelineStep);
   if (phase === "IDLE") {
     log(
@@ -494,11 +596,12 @@ async function handleStageGateHook(opts) {
       log(`stage-gate: ${toolName} without file_path \u2014 allowing`);
       return { exitCode: 0, toolName, toolInput, decision: "allow" };
     }
-    const pc = classifyWritePath(targetPath, { homedir });
+    const relTarget = toLucaRelative(targetPath, cwd);
+    const pc = classifyWritePath(targetPath, { homedir, cwd });
     if (pc.class === "denied") {
       pathBlockReason = `${toolName} to '${targetPath}' is always denied: ${pc.reason ?? "forbidden path"}`;
     } else if (pc.class === "planning-general" || pc.class === "planning-audit") {
-      const gate = artifactPathGate(targetPath, state.pipelineStep, state);
+      const gate = artifactPathGate(relTarget, state.pipelineStep, state);
       if (gate.kind === "block") {
         const msg = `stage-gate BLOCK: ${toolName} ${gate.reason} (pipelineStep=${state.pipelineStep})`;
         log(msg);
@@ -555,6 +658,12 @@ async function handleStageGateHook(opts) {
     log("stage-gate: could not classify tool \u2014 allowing");
     return { exitCode: 0, toolName, toolInput, decision: "allow" };
   }
+  if (isBystander) {
+    log(
+      `stage-gate: session ${sessionId} is not the run owner (${state.ownerSessionId}) \u2014 exempting ${toolName} (category=${category}) from the phase=${phase} matrix`
+    );
+    return { exitCode: 0, toolName, toolInput, decision: "allow" };
+  }
   const allowed = isToolAllowed({ phase, category });
   if (!allowed) {
     const msg = `stage-gate BLOCK: ${toolName} (category=${category}) is not allowed in phase=${phase} (pipelineStep=${state.pipelineStep})`;
@@ -572,6 +681,22 @@ async function handleStageGateHook(opts) {
   );
   return { exitCode: 0, toolName, toolInput, decision: "allow" };
 }
+function isStateAdvanceCommand(command) {
+  if (!command.includes("advance")) return false;
+  let entries;
+  try {
+    entries = parse(command);
+  } catch {
+    return false;
+  }
+  const toks = entries.filter((e) => typeof e === "string");
+  for (let i = 0; i <= toks.length - 3; i += 1) {
+    if (toks[i] === "luca" && toks[i + 1] === "state" && toks[i + 2] === "advance") {
+      return true;
+    }
+  }
+  return false;
+}
 const FIXED_PHASE_FILE_ARTIFACTS = /* @__PURE__ */ new Set([
   "research",
   "context",
@@ -584,6 +709,9 @@ const FIXED_PHASE_FILE_ARTIFACTS = /* @__PURE__ */ new Set([
   "execute/progress"
 ]);
 function artifactPathGate(targetPath, pipelineStep, state) {
+  if (TMP_PATH_PATTERN.test(targetPath)) {
+    return { kind: "allow" };
+  }
   const legalArtifacts = STEP_ARTIFACTS[pipelineStep];
   if (legalArtifacts.length === 0) {
     return {