@alecsibilia/luca 13.0.0-alpha.13 → 13.0.0-alpha.14

package/dist/chunks/branch.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { t as lucaBranchGuardTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { t as lucaBranchGuardTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const guardCommand = defineCommand({
   meta: {

package/dist/chunks/checks.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { s as lucaChecksRunTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { s as lucaChecksRunTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const runCommand = defineCommand({
   meta: {

package/dist/chunks/claim-verify.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import { resolve } from 'pathe';
-import { v as verifyFile } from '../shared/luca.BDFQnOdW.mjs';
+import { v as verifyFile } from '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';

package/dist/chunks/classify.mjs

@@ -1,5 +1,5 @@
 import { defineCommand } from 'citty';
-import { C as ClassifyComplexityInputSchema } from '../shared/luca.BDFQnOdW.mjs';
+import { C as ClassifyComplexityInputSchema } from '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';

package/dist/chunks/confidence.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
-import '../shared/luca.BDFQnOdW.mjs';
-import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.B15qErL2.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
+import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.OxvM40dI.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,18 +8,18 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { r as readConfidenceJournal, b as renderConfidenceJournalMarkdown, g as getConfidenceSummary } from '../shared/luca.YEUgoPFK.mjs';
+import { r as readConfidenceJournal, b as renderConfidenceJournalMarkdown, g as getConfidenceSummary } from '../shared/luca.S_KvKqlx.mjs';
 import { l as logger } from '../shared/luca.dM-MKlNE.mjs';
 import 'zod';
-import { v as lucaConfidenceLogTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { v as lucaConfidenceLogTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import 'consola';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 function selectConfidenceGateActions(entries) {
   const auto = [];

package/dist/chunks/hook.mjs

@@ -1,18 +1,18 @@
 import { defineCommand } from 'citty';
-import { c as coarsePhaseOf, t as toLucaRelative, a as classifyWritePath, b as TMP_PATH_PATTERN, A as AUDIT_PATH_PATTERN, W as WAVE_FILE_RE } from '../shared/luca.BDFQnOdW.mjs';
-import { l as loadCurrentState, S as STEP_ARTIFACTS, r as resolveActiveSlug } from '../shared/luca.B15qErL2.mjs';
+import { c as coarsePhaseOf, t as toLucaRelative, a as classifyWritePath, b as TMP_PATH_PATTERN, A as AUDIT_PATH_PATTERN, W as WAVE_FILE_RE } from '../shared/luca.DnzyY7Vh.mjs';
+import { l as loadCurrentState, S as STEP_ARTIFACTS, r as resolveActiveSlug } from '../shared/luca.OxvM40dI.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
-import { p as phasePathFor } from '../shared/luca.BKflEntw.mjs';
+import { p as phasePathFor } from '../shared/luca.Bg_VHA2r.mjs';
 import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
+import { tmpdir } from 'node:os';
 import { parse } from 'shell-quote';
-import { l as lucaStateClaimOwnerTool } from '../shared/luca.DpeRJDkV.mjs';
+import { l as lucaStateClaimOwnerTool } from '../shared/luca.92gxSuz7.mjs';
 import 'zod';
-import 'node:os';
 
 const STAGE_TOOL_MATRIX = {
   IDLE: {
@@ -572,6 +572,9 @@ async function handleStageGateHook(opts) {
   const sessionId = parsed.session_id ?? parsed.sessionId;
   const cwd = opts.cwd ?? process.cwd();
   const homedir = opts.homedir ?? process.env.HOME;
+  const tmpdirs = opts.tmpdirs ?? [process.env.TMPDIR, tmpdir()].filter(
+    (d) => Boolean(d)
+  );
   const state = await loadCurrentState({ cwd });
   if (toolName === "Bash" && sessionId && state.ownerSessionId !== sessionId && isStateAdvanceCommand(
     toolInput?.command ?? ""
@@ -600,9 +603,14 @@ async function handleStageGateHook(opts) {
       return { exitCode: 0, toolName, toolInput, decision: "allow" };
     }
     const relTarget = toLucaRelative(targetPath, cwd);
-    const pc = classifyWritePath(targetPath, { homedir, cwd });
+    const pc = classifyWritePath(targetPath, { homedir, cwd, tmpdirs });
     if (pc.class === "denied") {
       pathBlockReason = `${toolName} to '${targetPath}' is always denied: ${pc.reason ?? "forbidden path"}`;
+    } else if (pc.class === "ephemeral") {
+      log(
+        `stage-gate: ${toolName} to '${targetPath}' is ephemeral scratch \u2014 allowing`
+      );
+      return { exitCode: 0, toolName, toolInput, decision: "allow" };
     } else if (pc.class === "planning-general" || pc.class === "planning-audit") {
       const gate = artifactPathGate(relTarget, state.pipelineStep, state);
       if (gate.kind === "block") {
@@ -630,7 +638,7 @@ async function handleStageGateHook(opts) {
       pathBlockReason = `Bash command is always denied: ${bashResult.reason ?? "forbidden command"}`;
     } else {
       for (const target of bashResult.targetPaths) {
-        const pc = classifyWritePath(target, { homedir });
+        const pc = classifyWritePath(target, { homedir, tmpdirs });
         if (pc.class === "denied") {
           pathBlockReason = `Bash writes to denied path '${target}': ${pc.reason ?? "forbidden path"}`;
           break;
@@ -779,6 +787,8 @@ function pathClassToToolCategory(c) {
       return "planning-write-general";
     case "planning-audit":
       return "planning-write-audit";
+    case "ephemeral":
+      throw new Error("pathClassToToolCategory called with ephemeral");
     case "denied":
       throw new Error("pathClassToToolCategory called with denied");
   }

package/dist/chunks/init.mjs

@@ -1,17 +1,17 @@
 import * as p from '@clack/prompts';
 import { defineCommand, runMain } from 'citty';
 import { join } from 'pathe';
-import { w as writeProjectSkeleton } from '../shared/luca.DYSBzNqG.mjs';
+import { w as writeProjectSkeleton } from '../shared/luca.BRGd51XD.mjs';
 import { existsSync, statSync, chmodSync } from 'node:fs';
 import { readFile, writeFile, rename, unlink, mkdir, readdir, copyFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join as join$1, dirname, delimiter } from 'node:path';
 import { d as defaultClaudeHome, a as defaultAntigravityHome, r as resolveBundledArtifactsForHooks, i as installSkills } from '../shared/luca.41dcdyd6.mjs';
-import { d as detectProjectContext, s as suggestVaultName, a as autoCreateVault, w as writeVaultConfig } from '../shared/luca.B-u10ROM.mjs';
+import { d as detectProjectContext, s as suggestVaultName, a as autoCreateVault, w as writeVaultConfig } from '../shared/luca.C466HI-y.mjs';
 import { l as logger } from '../shared/luca.dM-MKlNE.mjs';
 import { M as MuninndbInstallResultSchema, r as resolvePlatformTarget, g as getLucaHomePaths, a as MUNINNDB_BINARY_NAME, b as getCommonBinaryPaths, c as resolveMuninndbPort, d as checkMuninndbService, e as MuninndbServiceStatusSchema, w as waitForMuninndbHealthy, f as ensureLucaHome, h as checkMuninndbBinary } from '../shared/luca.BfjhRHhj.mjs';
 import { c as checkPrerequisites, p as promptBunInstall } from '../shared/luca.DTomPq7I.mjs';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'zod';
 import 'node:child_process';
 import 'node:crypto';

package/dist/chunks/luca-gitignore.mjs

@@ -1,11 +1,11 @@
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { e as ensureLucaGitignore, L as LUCA_GITIGNORE_ENTRIES } from '../shared/luca.DYSBzNqG.mjs';
+import { e as ensureLucaGitignore, L as LUCA_GITIGNORE_ENTRIES } from '../shared/luca.BRGd51XD.mjs';
 import 'node:os';
 import 'pathe';
 import 'node:url';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'zod';
 import 'node:child_process';
 import 'node:crypto';

package/dist/chunks/phase.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { c as lucaPhaseCurrentTool, d as lucaPhaseAdvanceTool, e as lucaPhaseArchiveTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { c as lucaPhaseCurrentTool, d as lucaPhaseAdvanceTool, e as lucaPhaseArchiveTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const currentCommand = defineCommand({
   meta: {

package/dist/chunks/plan.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { f as lucaPlanLintTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { f as lucaPlanLintTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const lintCommand = defineCommand({
   meta: {

package/dist/chunks/pr-review.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { o as lucaPrReviewDetectConvergenceTool, p as lucaPrReviewFilterStaleTool, q as lucaPrReviewRegressionCheckTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { o as lucaPrReviewDetectConvergenceTool, p as lucaPrReviewFilterStaleTool, q as lucaPrReviewRegressionCheckTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const filterStaleCommand = defineCommand({
   meta: {

package/dist/chunks/preferences.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { i as lucaPreferencesReadTool, j as lucaPreferencesWriteTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { i as lucaPreferencesReadTool, j as lucaPreferencesWriteTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const readCommand = defineCommand({
   meta: {

package/dist/chunks/repair.mjs

@@ -2,7 +2,7 @@ import { defineCommand } from 'citty';
 import { existsSync } from 'node:fs';
 import { readFile, rm } from 'node:fs/promises';
 import { join } from 'node:path';
-import { l as lucaStateSchema } from '../shared/luca.BDFQnOdW.mjs';
+import { l as lucaStateSchema } from '../shared/luca.DnzyY7Vh.mjs';
 import 'node:crypto';
 import 'node:module';
 import 'node:url';

package/dist/chunks/repo.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { r as lucaRepoCleanupApplyTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { r as lucaRepoCleanupApplyTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const cleanupApplyCommand = defineCommand({
   meta: {

package/dist/chunks/retro.mjs

@@ -1,5 +1,5 @@
 import { defineCommand } from 'citty';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -7,14 +7,14 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { a as analyzeRun, g as gatherRunArtifacts, r as renderPostmortemMarkdown, c as computePostmortemExitCode } from '../shared/luca.D_sXMXRZ.mjs';
-import { l as listRuns } from '../shared/luca.YEUgoPFK.mjs';
+import { a as analyzeRun, g as gatherRunArtifacts, r as renderPostmortemMarkdown, c as computePostmortemExitCode } from '../shared/luca.B4XKevaZ.mjs';
+import { l as listRuns } from '../shared/luca.S_KvKqlx.mjs';
 import { l as logger } from '../shared/luca.dM-MKlNE.mjs';
 import 'zod';
 import 'node:os';
-import '../shared/luca.Dmpy9SlE.mjs';
-import '../shared/luca.BKflEntw.mjs';
-import '../shared/luca.BKsihSAK.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
+import '../shared/luca.D-08LKzR.mjs';
 import 'pathe';
 import 'consola';
 

package/dist/chunks/roadmap.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { g as lucaRoadmapReadTool, h as lucaRoadmapCreateTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { g as lucaRoadmapReadTool, h as lucaRoadmapCreateTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const readCommand = defineCommand({
   meta: {

package/dist/chunks/rules.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import { join as join$1 } from 'pathe';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import { existsSync, readdirSync, statSync, readFileSync } from 'node:fs';
 import 'node:fs/promises';
 import { isAbsolute, resolve, join, extname } from 'node:path';
@@ -8,14 +8,14 @@ import 'node:crypto';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
 import 'node:child_process';
-import { a as analyzeRun, g as gatherRunArtifacts } from '../shared/luca.D_sXMXRZ.mjs';
-import { l as listRuns } from '../shared/luca.YEUgoPFK.mjs';
+import { a as analyzeRun, g as gatherRunArtifacts } from '../shared/luca.B4XKevaZ.mjs';
+import { l as listRuns } from '../shared/luca.S_KvKqlx.mjs';
 import { l as logger } from '../shared/luca.dM-MKlNE.mjs';
 import 'zod';
 import 'node:os';
-import '../shared/luca.Dmpy9SlE.mjs';
-import '../shared/luca.BKflEntw.mjs';
-import '../shared/luca.BKsihSAK.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
+import '../shared/luca.D-08LKzR.mjs';
 import 'consola';
 
 let tsModuleCache = void 0;

package/dist/chunks/state.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { l as lucaStateSetCurrentPhaseTool, a as lucaStateAdvanceTool, b as lucaStateReadTool } from '../shared/luca.CbIDM-ci.mjs';
-import { l as lucaStateClaimOwnerTool } from '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { l as lucaStateSetCurrentPhaseTool, a as lucaStateAdvanceTool, b as lucaStateReadTool } from '../shared/luca.CZfqdBsl.mjs';
+import { l as lucaStateClaimOwnerTool } from '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const readCommand = defineCommand({
   meta: {

package/dist/chunks/stray-local-install.mjs

@@ -1,7 +1,7 @@
 import { existsSync, lstatSync } from 'node:fs';
 import { rm, writeFile, readdir, rmdir } from 'node:fs/promises';
 import { join } from 'node:path';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:crypto';
 import 'node:module';
 import 'node:url';

package/dist/chunks/telemetry.mjs

@@ -1,5 +1,5 @@
 import { defineCommand } from 'citty';
-import { R as RunIdSchema, L as LUCA_DIR_ROOT, T as TelemetryRecordSchema } from '../shared/luca.BDFQnOdW.mjs';
+import { R as RunIdSchema, L as LUCA_DIR_ROOT, T as TelemetryRecordSchema } from '../shared/luca.DnzyY7Vh.mjs';
 import { mkdirSync, appendFileSync } from 'node:fs';
 import 'node:fs/promises';
 import { join, dirname } from 'node:path';

package/dist/chunks/todo.mjs

@@ -1,4 +1,4 @@
-import { d as TodoPriority } from '../shared/luca.BDFQnOdW.mjs';
+import { d as TodoPriority } from '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:url';
 import 'node:child_process';
 import { defineCommand } from 'citty';
 import 'zod';
-import { k as lucaTodoUpdateTool, m as lucaTodoListTool, n as lucaTodoAddTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { k as lucaTodoUpdateTool, m as lucaTodoListTool, n as lucaTodoAddTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, b as readJsonPayload, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const addCommand = defineCommand({
   meta: {

package/dist/chunks/vault-init.mjs

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync } from 'node:fs';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs/promises';
 import 'node:path';
 import { l as loadCurrentConfig } from '../shared/luca.CQ3g1xrD.mjs';
@@ -10,7 +10,7 @@ import 'node:child_process';
 import * as p from '@clack/prompts';
 import { defineCommand } from 'citty';
 import { join } from 'pathe';
-import { d as detectProjectContext, r as runVaultWizard, w as writeVaultConfig, b as writeApiKeyToEnv, e as ensureEnvInGitignore, v as verifyVaultConnection } from '../shared/luca.B-u10ROM.mjs';
+import { d as detectProjectContext, r as runVaultWizard, w as writeVaultConfig, b as writeApiKeyToEnv, e as ensureEnvInGitignore, v as verifyVaultConnection } from '../shared/luca.C466HI-y.mjs';
 import 'zod';
 import 'node:os';
 import '../shared/luca.BZc5veeE.mjs';

package/dist/chunks/verification.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
-import '../shared/luca.BDFQnOdW.mjs';
-import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.B15qErL2.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
+import { l as loadCurrentState, r as resolveActiveSlug } from '../shared/luca.OxvM40dI.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,13 +8,13 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { r as readVerificationResult, a as aggregateVerificationResults } from '../shared/luca.Dmpy9SlE.mjs';
-import { l as listPhaseSlugs } from '../shared/luca.BKsihSAK.mjs';
+import { r as readVerificationResult, a as aggregateVerificationResults } from '../shared/luca.D1iTA_aN.mjs';
+import { l as listPhaseSlugs } from '../shared/luca.D-08LKzR.mjs';
 import { l as logger } from '../shared/luca.dM-MKlNE.mjs';
-import { r as rejectUnknownFlags } from '../shared/luca.3OdFfCDq.mjs';
+import { r as rejectUnknownFlags } from '../shared/luca.DBcPn3_9.mjs';
 import 'zod';
 import 'node:os';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import 'pathe';
 import 'consola';
 

package/dist/chunks/workflow.mjs

@@ -1,6 +1,6 @@
 import { defineCommand } from 'citty';
 import 'zod';
-import '../shared/luca.BDFQnOdW.mjs';
+import '../shared/luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -8,16 +8,16 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { u as lucaWorkflowResetTool } from '../shared/luca.CbIDM-ci.mjs';
-import '../shared/luca.DpeRJDkV.mjs';
-import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.3OdFfCDq.mjs';
+import { u as lucaWorkflowResetTool } from '../shared/luca.CZfqdBsl.mjs';
+import '../shared/luca.92gxSuz7.mjs';
+import { r as rejectUnknownFlags, a as runWriteHandler } from '../shared/luca.DBcPn3_9.mjs';
 import 'node:os';
-import '../shared/luca.B15qErL2.mjs';
-import '../shared/luca.YEUgoPFK.mjs';
-import '../shared/luca.BKflEntw.mjs';
+import '../shared/luca.OxvM40dI.mjs';
+import '../shared/luca.S_KvKqlx.mjs';
+import '../shared/luca.Bg_VHA2r.mjs';
 import '../shared/luca.BAqmbI4n.mjs';
 import '../shared/luca.CQ3g1xrD.mjs';
-import '../shared/luca.Dmpy9SlE.mjs';
+import '../shared/luca.D1iTA_aN.mjs';
 
 const resetCommand = defineCommand({
   meta: {

package/dist/claude/.claude/hooks/context-refresher.ts

@@ -13604,7 +13604,8 @@ var LucaArtifactKind = exports_external.enum([
   "milestone.audit",
   "telemetry.run",
   "archive.phase",
-  "tmp.handoff"
+  "tmp.handoff",
+  "tmp.preview"
 ]);
 var PhaseSlugSchema = exports_external.string().regex(PHASE_SLUG_RE, {
   message: 'Phase slug must be <NN-kebab-case>, e.g. "01-auth-rewrite" (NN zero-padded).'

package/dist/claude/.claude/hooks/continuation-messages.ts

@@ -13598,7 +13598,8 @@ var LucaArtifactKind = exports_external.enum([
   "milestone.audit",
   "telemetry.run",
   "archive.phase",
-  "tmp.handoff"
+  "tmp.handoff",
+  "tmp.preview"
 ]);
 var PhaseSlugSchema = exports_external.string().regex(PHASE_SLUG_RE, {
   message: 'Phase slug must be <NN-kebab-case>, e.g. "01-auth-rewrite" (NN zero-padded).'

package/dist/claude/.claude/hooks/pipeline-guard.ts

@@ -13598,7 +13598,8 @@ var LucaArtifactKind = exports_external.enum([
   "milestone.audit",
   "telemetry.run",
   "archive.phase",
-  "tmp.handoff"
+  "tmp.handoff",
+  "tmp.preview"
 ]);
 var PhaseSlugSchema = exports_external.string().regex(PHASE_SLUG_RE, {
   message: 'Phase slug must be <NN-kebab-case>, e.g. "01-auth-rewrite" (NN zero-padded).'

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { defineCommand, runMain as runMain$1 } from 'citty';
 import 'pathe';
 
 async function resolveVersion() {
-  return "13.0.0-alpha.13";
+  return "13.0.0-alpha.14";
 }
 const LUCA_VERSION = await resolveVersion();
 

package/dist/shared/{luca.DpeRJDkV.mjs → luca.92gxSuz7.mjs}

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { mkdir, writeFile, rename, rm, open, stat, readFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { D as lucaStateSchemaTolerant } from './luca.BDFQnOdW.mjs';
+import { D as lucaStateSchemaTolerant } from './luca.DnzyY7Vh.mjs';
 import 'node:crypto';
 import 'node:module';
 import 'node:url';

package/dist/shared/{luca.D_sXMXRZ.mjs → luca.B4XKevaZ.mjs}

@@ -1,4 +1,4 @@
-import './luca.BDFQnOdW.mjs';
+import './luca.DnzyY7Vh.mjs';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:path';
@@ -6,9 +6,9 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'node:child_process';
-import { r as readConfidenceJournal, a as readLedgerForRun } from './luca.YEUgoPFK.mjs';
-import { r as readVerificationResult } from './luca.Dmpy9SlE.mjs';
-import { l as listPhaseSlugs } from './luca.BKsihSAK.mjs';
+import { r as readConfidenceJournal, a as readLedgerForRun } from './luca.S_KvKqlx.mjs';
+import { r as readVerificationResult } from './luca.D1iTA_aN.mjs';
+import { l as listPhaseSlugs } from './luca.D-08LKzR.mjs';
 
 function fingerprint(input) {
   let hash = 0;

package/dist/shared/{luca.DYSBzNqG.mjs → luca.BRGd51XD.mjs}

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { l as lucaStateSchema } from './luca.BDFQnOdW.mjs';
+import { l as lucaStateSchema } from './luca.DnzyY7Vh.mjs';
 import 'node:crypto';
 import 'node:module';
 import 'node:url';

package/dist/shared/{luca.BKflEntw.mjs → luca.Bg_VHA2r.mjs}

@@ -1,4 +1,4 @@
-import { P as PhaseSlugSchema, L as LUCA_DIR_ROOT, F as PHASE_FILE_PATHS } from './luca.BDFQnOdW.mjs';
+import { P as PhaseSlugSchema, L as LUCA_DIR_ROOT, F as PHASE_FILE_PATHS } from './luca.DnzyY7Vh.mjs';
 
 function phasePathFor(slug, file) {
   PhaseSlugSchema.parse(slug);

package/dist/shared/{luca.B-u10ROM.mjs → luca.C466HI-y.mjs}

@@ -1,7 +1,7 @@
 import { existsSync, chmodSync } from 'node:fs';
 import { join, basename } from 'pathe';
 import { writeFile } from 'node:fs/promises';
-import './luca.BDFQnOdW.mjs';
+import './luca.DnzyY7Vh.mjs';
 import 'node:path';
 import 'node:crypto';
 import 'node:module';

package/dist/shared/{luca.CbIDM-ci.mjs → luca.CZfqdBsl.mjs}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { P as PhaseSlugSchema, L as LUCA_DIR_ROOT, e as ProjectPreferencesSchema, V as VerificationResultSchema, f as ConfidenceCategorySchema, g as ConfidenceLevelSchema, h as lucaRootPaths, S as ShadowScanFindingSchema, i as RoadmapPhaseSchema, l as lucaStateSchema, j as PipelineStep, k as isLegalTransition, m as PIPELINE_TRANSITIONS, n as PIPELINE_STEP_TO_COARSE_PHASE, o as PipelineStepValues, p as TodoIdSchema, q as TodoAreaSchema, d as TodoPriority, s as slugFromTitle, r as TodoSchema, u as todoConceptFor, w as TodoStatus, x as TODO_CONCEPT_PREFIX, y as VerificationRefSchema } from './luca.BDFQnOdW.mjs';
-import { l as loadCurrentState, r as resolveActiveSlug, S as STEP_ARTIFACTS } from './luca.B15qErL2.mjs';
+import { P as PhaseSlugSchema, L as LUCA_DIR_ROOT, e as ProjectPreferencesSchema, V as VerificationResultSchema, f as ConfidenceCategorySchema, g as ConfidenceLevelSchema, h as lucaRootPaths, S as ShadowScanFindingSchema, i as RoadmapPhaseSchema, l as lucaStateSchema, j as PipelineStep, k as isLegalTransition, m as PIPELINE_TRANSITIONS, n as PIPELINE_STEP_TO_COARSE_PHASE, o as PipelineStepValues, p as TodoIdSchema, q as TodoAreaSchema, d as TodoPriority, s as slugFromTitle, r as TodoSchema, u as todoConceptFor, w as TodoStatus, x as TODO_CONCEPT_PREFIX, y as VerificationRefSchema } from './luca.DnzyY7Vh.mjs';
+import { l as loadCurrentState, r as resolveActiveSlug, S as STEP_ARTIFACTS } from './luca.OxvM40dI.mjs';
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { readFile, readdir, mkdir, rename, appendFile, unlink, rm } from 'node:fs/promises';
 import { join, resolve, dirname, relative, sep } from 'node:path';
@@ -8,12 +8,12 @@ import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import { spawnSync } from 'node:child_process';
-import { c as appendConfidenceEntry, d as appendLedger } from './luca.YEUgoPFK.mjs';
-import { m as mutateState, w as writeAtomicFile, a as withStateLock } from './luca.DpeRJDkV.mjs';
-import { p as phasePathFor } from './luca.BKflEntw.mjs';
+import { c as appendConfidenceEntry, d as appendLedger } from './luca.S_KvKqlx.mjs';
+import { m as mutateState, w as writeAtomicFile, a as withStateLock } from './luca.92gxSuz7.mjs';
+import { p as phasePathFor } from './luca.Bg_VHA2r.mjs';
 import { s as sanitizeControlChars } from './luca.BAqmbI4n.mjs';
 import { l as loadCurrentConfig } from './luca.CQ3g1xrD.mjs';
-import { f as findCriterion } from './luca.Dmpy9SlE.mjs';
+import { f as findCriterion } from './luca.D1iTA_aN.mjs';
 
 function archivedPhasePathFor(slug) {
   PhaseSlugSchema.parse(slug);

package/dist/shared/{luca.BKsihSAK.mjs → luca.D-08LKzR.mjs}

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'pathe';
-import { E as PHASE_SLUG_RE } from './luca.BDFQnOdW.mjs';
+import { E as PHASE_SLUG_RE } from './luca.DnzyY7Vh.mjs';
 import 'node:fs/promises';
 import 'node:path';
 import 'node:crypto';

package/dist/shared/{luca.Dmpy9SlE.mjs → luca.D1iTA_aN.mjs}

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { V as VerificationResultSchema } from './luca.BDFQnOdW.mjs';
-import { p as phasePathFor } from './luca.BKflEntw.mjs';
+import { V as VerificationResultSchema } from './luca.DnzyY7Vh.mjs';
+import { p as phasePathFor } from './luca.Bg_VHA2r.mjs';
 
 function readVerificationResult(opts) {
   const p = join(opts.cwd, phasePathFor(opts.slug, "verify"));

package/dist/shared/{luca.3OdFfCDq.mjs → luca.DBcPn3_9.mjs}

@@ -1,6 +1,6 @@
 import { readFile } from 'node:fs/promises';
-import './luca.BDFQnOdW.mjs';
-import { W as WRITE_COMMAND_PHASES, l as loadCurrentState } from './luca.B15qErL2.mjs';
+import './luca.DnzyY7Vh.mjs';
+import { W as WRITE_COMMAND_PHASES, l as loadCurrentState } from './luca.OxvM40dI.mjs';
 import 'node:fs';
 import 'node:path';
 import 'node:crypto';

package/dist/shared/{luca.BDFQnOdW.mjs → luca.DnzyY7Vh.mjs}

@@ -153,6 +153,7 @@ const SEMVER_TAG_RE = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$
 const REVIEWER_NAME_RE = /^[a-z][a-z0-9-]*[a-z0-9]$/;
 const RUN_ID_RE = /^[A-Za-z0-9_-]+$/;
 const TMP_FILE_RE = /^[a-z][a-z0-9-]*\.json$/;
+const TMP_PREVIEW_FILE_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.[a-z0-9]+$/i;
 const LUCA_DIR_ROOT = ".luca";
 const lucaRootPaths = {
   state: `${LUCA_DIR_ROOT}/state.json`,
@@ -203,7 +204,10 @@ z.enum([
   "archive.phase",
   // Ephemeral CLI-handoff scratch (.luca/tmp/<name>.json) — repo-scoped,
   // gitignored, not a pipeline artifact.
-  "tmp.handoff"
+  "tmp.handoff",
+  // Ephemeral browser preview (.luca/tmp/previews/<name>) — repo-scoped,
+  // gitignored, not a pipeline artifact. Allowed in any pipelineStep.
+  "tmp.preview"
 ]);
 const PhaseSlugSchema = z.string().regex(PHASE_SLUG_RE, {
   message: 'Phase slug must be <NN-kebab-case>, e.g. "01-auth-rewrite" (NN zero-padded).'
@@ -249,6 +253,18 @@ const SYSTEM_DIR_PATTERN = /^\/(etc|usr|var|System|bin|sbin)(\/|$)/;
 const GIT_DIR_PATTERN = /(^|\/)\.git(\/|$)/;
 const HOME_DENIED_SUBDIRS = [".claude", ".luca"];
 const SHARED_TMP_LUCA_PATTERN = /^\/(private\/)?tmp\/luca-/;
+const BUILTIN_TMP_PREFIXES = ["/tmp/", "/private/tmp/"];
+function isEphemeralOsTemp(path, tmpdirs) {
+  const p = path.replace(/\\/g, "/");
+  if (!p.startsWith("/")) return false;
+  const prefixes = [...BUILTIN_TMP_PREFIXES];
+  for (const dir of tmpdirs) {
+    if (!dir) continue;
+    const norm = dir.replace(/\\/g, "/").replace(/\/+$/, "");
+    if (norm.startsWith("/")) prefixes.push(`${norm}/`);
+  }
+  return prefixes.some((prefix) => p.startsWith(prefix));
+}
 const reAnchorless = (re) => re.source.replace(/^\^/, "").replace(/\$$/, "");
 const AUDIT_PATH_PATTERN = new RegExp(
   `^\\.luca/phases/${reAnchorless(PHASE_SLUG_RE)}/audits/${reAnchorless(
@@ -278,16 +294,19 @@ function classifyWritePath(path, opts = {}) {
       reason: "writes under .git/ are never allowed"
     };
   }
-  if (SYSTEM_DIR_PATTERN.test(path)) {
+  if (SHARED_TMP_LUCA_PATTERN.test(path)) {
     return {
       class: "denied",
-      reason: "writes under system directories (/etc, /usr, /var, /System, /bin, /sbin) are never allowed"
+      reason: "luca CLI handoff payloads must be repo-scoped \u2014 write to .luca/tmp/<kebab-name>.json instead (shared /tmp/luca-* files collide across concurrently-running repos)"
     };
   }
-  if (SHARED_TMP_LUCA_PATTERN.test(path)) {
+  if (isEphemeralOsTemp(path, opts.tmpdirs ?? [])) {
+    return { class: "ephemeral" };
+  }
+  if (SYSTEM_DIR_PATTERN.test(path)) {
     return {
       class: "denied",
-      reason: "luca CLI handoff payloads must be repo-scoped \u2014 write to .luca/tmp/<kebab-name>.json instead (shared /tmp/luca-* files collide across concurrently-running repos)"
+      reason: "writes under system directories (/etc, /usr, /var, /System, /bin, /sbin) are never allowed"
     };
   }
   for (const subdir of HOME_DENIED_SUBDIRS) {
@@ -309,6 +328,10 @@ function classifyWritePath(path, opts = {}) {
   }
   const rel = toLucaRelative(path, opts.cwd);
   if (rel.startsWith(".luca/") || rel === ".luca") {
+    const preview = rel.match(/^\.luca\/tmp\/previews\/([^/]+)$/);
+    if (preview && TMP_PREVIEW_FILE_RE.test(preview[1])) {
+      return { class: "ephemeral" };
+    }
     if (AUDIT_PATH_PATTERN.test(rel)) {
       return { class: "planning-audit" };
     }

package/dist/shared/{luca.B15qErL2.mjs → luca.OxvM40dI.mjs}

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { D as lucaStateSchemaTolerant, P as PhaseSlugSchema } from './luca.BDFQnOdW.mjs';
+import { D as lucaStateSchemaTolerant, P as PhaseSlugSchema } from './luca.DnzyY7Vh.mjs';
 
 async function loadCurrentState(opts) {
   const statePath = join(opts.cwd, ".luca", "state.json");

package/dist/shared/{luca.YEUgoPFK.mjs → luca.S_KvKqlx.mjs}

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, mkdirSync, appendFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { h as lucaRootPaths, z as LedgerEntrySchema, B as ConfidenceEntrySchema } from './luca.BDFQnOdW.mjs';
-import { p as phasePathFor } from './luca.BKflEntw.mjs';
+import { h as lucaRootPaths, z as LedgerEntrySchema, B as ConfidenceEntrySchema } from './luca.DnzyY7Vh.mjs';
+import { p as phasePathFor } from './luca.Bg_VHA2r.mjs';
 
 function appendLedger(opts) {
   const entry = {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@alecsibilia/luca",
   "description": "Luca — spec-driven agentic development workflow for Claude Code (umbrella; bundles luca-cli, luca-core, luca-tools)",
-  "version": "13.0.0-alpha.13",
+  "version": "13.0.0-alpha.14",
   "license": "Apache-2.0",
   "author": "Alec Sibilia <sibilia.alec@gmail.com>",
   "homepage": "https://github.com/asibilia/luca-framework#readme",