@astrosheep/keiyaku 2.9.3 → 2.9.5

package/build/config/settings/schema.js

@@ -1,185 +1,15 @@
 import { z } from "zod";
-import { CLAUDE_SETTING_SOURCES, } from "../../keiyaku.js";
-const tomlValueSchema = z.lazy(() => z.union([
-    z.string(),
-    z.number(),
-    z.boolean(),
-    z.array(tomlValueSchema),
-    z.record(z.string(), tomlValueSchema),
-]));
-const structuredTomlValueSchema = z.record(z.string(), tomlValueSchema);
-const executableSchema = z.string().superRefine((value, ctx) => {
-    if (value.length === 0 || /\s/.test(value) || value.includes("\"") || value.includes("'")) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "must be a single program name token with no spaces or quotes.",
-        });
-    }
-});
-const nonblankOptionalString = z
-    .string()
-    .refine((value) => value.trim().length > 0, { message: "must not be blank." })
-    .optional();
-const providerCommonFields = {
-    description: nonblankOptionalString,
-};
-const providerEnvSchema = z.record(z.string(), z.string()).optional();
-function refinePiEnvInjection(data, ctx) {
-    if (data.env === undefined)
-        return;
-    if (Object.keys(data.env).length === 0)
-        return;
-    ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ["env"],
-        message: "env injection not supported for provider pi",
-    });
-}
-const CODEX_SDK_FORBIDDEN_THREAD_OPTIONS_KEYS = [
-    "model",
-    "modelReasoningEffort",
-    "sandboxMode",
-    "networkAccessEnabled",
-    "webSearchMode",
-    "approvalPolicy",
-    "workingDirectory",
-    "skipGitRepoCheck",
-];
-const FORBIDDEN_CONFIG_KEYS = [
-    "model",
-    "model_reasoning_effort",
-];
-function isConfigKeyForbidden(key) {
-    return FORBIDDEN_CONFIG_KEYS.includes(key);
-}
-const claudeSettingSourceSchema = z.enum(CLAUDE_SETTING_SOURCES);
-const writableRootItemSchema = z.string().superRefine((value, ctx) => {
-    if (value.length === 0) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not be empty." });
-        return;
-    }
-    if (value.startsWith("~")) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not begin with tilde." });
-        return;
-    }
-    if (value.includes("\0")) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not contain NUL byte." });
-        return;
-    }
-    if (/\$[A-Za-z_]/.test(value) || /\$\{/.test(value)) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not contain environment variable references." });
-        return;
-    }
-});
-export const providerInstanceSchema = z.discriminatedUnion("kind", [
-    z
-        .object({
-        kind: z.literal("codex-sdk"),
-        ...providerCommonFields,
-        executable: executableSchema.optional(),
-        profile: z.string().optional(),
-        config: structuredTomlValueSchema.optional(),
-        threadOptions: structuredTomlValueSchema.optional(),
-    })
-        .strict()
-        .superRefine((data, ctx) => {
-        if (data.threadOptions) {
-            for (const key of CODEX_SDK_FORBIDDEN_THREAD_OPTIONS_KEYS) {
-                if (key in data.threadOptions) {
-                    ctx.addIssue({
-                        code: z.ZodIssueCode.custom,
-                        path: ["threadOptions", key],
-                        message: `"${key}" is owned by the Akuma or Keiyaku execution, not this provider instance`,
-                    });
-                }
-            }
-        }
-        if (data.config) {
-            for (const key of Object.keys(data.config)) {
-                if (isConfigKeyForbidden(key)) {
-                    ctx.addIssue({
-                        code: z.ZodIssueCode.custom,
-                        path: ["config", key],
-                        message: `"${key}" is owned by the Akuma or Keiyaku execution, not this provider instance`,
-                    });
-                }
-            }
-        }
-    }),
-    z
-        .object({
-        kind: z.literal("codex-app-server"),
-        ...providerCommonFields,
-        executable: executableSchema.optional(),
-        profile: z.string().optional(),
-        config: structuredTomlValueSchema.optional(),
-        writableRoots: z.array(writableRootItemSchema).optional(),
-        env: providerEnvSchema,
-    })
-        .strict()
-        .superRefine((data, ctx) => {
-        if (data.config) {
-            for (const key of Object.keys(data.config)) {
-                if (isConfigKeyForbidden(key)) {
-                    ctx.addIssue({
-                        code: z.ZodIssueCode.custom,
-                        path: ["config", key],
-                        message: `"${key}" is owned by the Akuma or Keiyaku execution, not this provider instance`,
-                    });
-                }
-            }
-        }
-    }),
-    z
-        .object({
-        kind: z.literal("claude-agent-sdk"),
-        ...providerCommonFields,
-        executable: executableSchema.optional(),
-        settingSources: z.array(claudeSettingSourceSchema).optional(),
-        env: providerEnvSchema,
-    })
-        .strict(),
-    z
-        .object({
-        kind: z.literal("opencode-sdk"),
-        ...providerCommonFields,
-        executable: executableSchema.optional(),
-        env: providerEnvSchema,
-    })
-        .strict(),
-    z
-        .object({
-        kind: z.literal("pi"),
-        ...providerCommonFields,
-        env: providerEnvSchema,
-    })
-        .strict()
-        .superRefine(refinePiEnvInjection),
-]);
+import { BUILTIN_PROVIDER_INSTANCE_CANDIDATES as REGISTRY_BUILTIN_PROVIDER_INSTANCE_CANDIDATES, providerInstanceSchema as registryProviderInstanceSchema, } from "../../agents/providers/registry.js";
+export const providerInstanceSchema = registryProviderInstanceSchema;
+export const BUILTIN_PROVIDER_INSTANCE_CANDIDATES = REGISTRY_BUILTIN_PROVIDER_INSTANCE_CANDIDATES;
 const PROVIDER_INSTANCE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 export const providerInstanceNameSchema = z
     .string()
     .max(64, "must contain at most 64 characters.")
     .regex(PROVIDER_INSTANCE_NAME_PATTERN, "must match ^[a-z0-9][a-z0-9-]*$.");
-export const BUILTIN_PROVIDER_INSTANCE_CANDIDATES = {
-    "codex-sdk": { name: "codex-sdk", source: "builtin", instance: { kind: "codex-sdk", executable: "codex" } },
-    "codex-app-server": {
-        name: "codex-app-server",
-        source: "builtin",
-        instance: { kind: "codex-app-server", executable: "codex" },
-    },
-    "claude-agent-sdk": {
-        name: "claude-agent-sdk",
-        source: "builtin",
-        instance: { kind: "claude-agent-sdk", executable: "claude", settingSources: ["project"] },
-    },
-    "opencode-sdk": {
-        name: "opencode-sdk",
-        source: "builtin",
-        instance: { kind: "opencode-sdk", executable: "opencode" },
-    },
-    pi: { name: "pi", source: "builtin", instance: { kind: "pi" } },
-};
+// Ensure the registry builtin map stays keyed by the closed provider vocabulary.
+const _builtinCheck = BUILTIN_PROVIDER_INSTANCE_CANDIDATES;
+void _builtinCheck;
 const AGENT_NAME_PATTERN = /^[a-zA-Z0-9]+(?:[.-][a-zA-Z0-9]+)*$/;
 export const agentNameSchema = z
     .string()

package/build/core/addressing.js

@@ -1,9 +1,13 @@
 import * as path from "node:path";
 import { FlowError } from "../flow-error.js";
+import { errorContainsAnyPattern, NOT_GIT_REPOSITORY_PATTERNS } from "../git/core.js";
+import { commissionSlug, formatCommissionCoordinate } from "./ids.js";
 import { listContractIds, readLedger } from "./ledger.js";
 import { isResponseArtifactId } from "./response-artifact-id.js";
-import { stableRepoRoot } from "./worktree-path.js";
+import { activeContractBoundByEngineWorktree, stableRepoRoot } from "./worktree-path.js";
+import { assertNoRenewRecoverySession } from "./renew-session.js";
 import { deriveContractState, isTerminalState, } from "./status/lifecycle.js";
+const AMBIGUOUS_OBJECTIVE_MAX_CHARS = 60;
 function normalizeAddressQuery(raw) {
     const value = raw.startsWith("@") ? raw.slice(1) : raw;
     if (!value.trim()) {
@@ -17,8 +21,8 @@ class AddressedFlowError extends FlowError {
     constructor(error, carrier) {
         super(error.code, error.message, {
             cause: error,
-            hints: error.hints,
             review: error.review,
+            facts: error.facts,
         });
         this.name = error.name;
         this[ADDRESS_CARRIER] = carrier;
@@ -108,9 +112,8 @@ export class AddressResolutionError extends FlowError {
         this.attempt = attempt;
     }
 }
-function contractSlug(contractId) {
-    const separator = contractId.indexOf(".");
-    return separator > 0 ? contractId.slice(0, separator) : contractId;
+function candidatePlace(candidate) {
+    return candidate.bind.data.workspace === "worktree" ? candidate.bind.data.place ?? null : null;
 }
 async function commissionAddressCandidates(cwd) {
     const ids = await listContractIds(cwd);
@@ -135,9 +138,9 @@ function matchCommissionAddress(query, candidates) {
         const matches = [];
         if (candidate.contractId === query)
             matches.push({ ...candidate, spelling: "id" });
-        if (contractSlug(candidate.contractId) === query)
+        if (commissionSlug(candidate.contractId) === query)
             matches.push({ ...candidate, spelling: "slug" });
-        if (candidate.active && candidate.bind.data.place === query) {
+        if (candidate.active && candidatePlace(candidate) === query) {
             matches.push({ ...candidate, spelling: "place" });
         }
         return matches;
@@ -146,16 +149,28 @@ function matchCommissionAddress(query, candidates) {
 function attemptCandidates(candidates) {
     return candidates.map((candidate) => ({
         commissionId: candidate.contractId,
-        place: candidate.bind.data.place ?? null,
+        place: candidatePlace(candidate),
         name: candidate.bind.data.name,
         objective: candidate.bind.data.objective,
         lifecycle: candidate.lifecycle,
         target: { branch: candidate.bind.data.target },
     }));
 }
-function formatAmbiguousCandidate(query, candidate) {
-    const label = candidate.matchedBy ?? "candidate";
-    return `${label} @${query}: ${candidate.name} · ${candidate.objective} · commission ${candidate.commissionId}`;
+function truncateObjectiveFirstLine(objective) {
+    const firstLine = objective.split(/\r?\n/, 1)[0]?.trim() ?? "";
+    if (firstLine.length <= AMBIGUOUS_OBJECTIVE_MAX_CHARS)
+        return firstLine;
+    return `${firstLine.slice(0, AMBIGUOUS_OBJECTIVE_MAX_CHARS)}…`;
+}
+function formatAmbiguousCandidate(candidate) {
+    const coordinate = formatCommissionCoordinate({
+        commissionId: candidate.commissionId,
+        place: candidate.place,
+    });
+    const objective = truncateObjectiveFirstLine(candidate.objective);
+    return [coordinate, objective || undefined, candidate.commissionId]
+        .filter((part) => part !== undefined)
+        .join(" · ");
 }
 async function resolvedRepository(cwd) {
     return { kind: "repository", stableRoot: await stableRepoRoot(cwd) };
@@ -166,7 +181,7 @@ function buildResolvedAddress(input) {
         workdir: input.workdir,
         binding: { kind: "commission", commissionId: input.candidate.contractId },
         spelling: { asTyped: input.asTyped, source: input.source, matchedBy: input.matchedBy },
-        place: { display: input.candidate.bind.data.place ?? null },
+        place: { display: candidatePlace(input.candidate) },
         lifecycle: input.candidate.lifecycle,
         target: { branch: input.candidate.bind.data.target },
         inference: input.inference,
@@ -188,8 +203,8 @@ export function buildUncommissionedRepositoryAddress(input) {
         inference: input.inference,
     });
 }
-export async function resolveContractAddress(cwd, raw, source = raw?.startsWith("@") ? "at-address" : "explicit-flag") {
-    const workdir = path.resolve(cwd);
+export async function resolveContractAddress(cwd, raw, source = raw?.startsWith("@") ? "at-address" : "explicit-flag", effectiveDirectory = cwd) {
+    const workdir = path.resolve(effectiveDirectory);
     const repo = await resolvedRepository(cwd);
     if (raw !== undefined) {
         const query = normalizeAddressQuery(raw);
@@ -216,7 +231,7 @@ export async function resolveContractAddress(cwd, raw, source = raw?.startsWith(
             candidates: matches.map((candidate) => ({
                 commissionId: candidate.contractId,
                 matchedBy: candidate.spelling,
-                place: candidate.bind.data.place ?? null,
+                place: candidatePlace(candidate),
                 name: candidate.bind.data.name,
                 objective: candidate.bind.data.objective,
                 lifecycle: candidate.lifecycle,
@@ -238,9 +253,34 @@ export async function resolveContractAddress(cwd, raw, source = raw?.startsWith(
         if (matches.length === 0) {
             throw new AddressResolutionError("EMPTY_PARAM", `unknown contract address @${query}`, attempt);
         }
-        throw new AddressResolutionError("CONTRACT_AMBIGUOUS", `contract address @${query} is ambiguous: ${attempt.candidates.map((candidate) => formatAmbiguousCandidate(query, candidate)).join("; ")}; use a full @commission-id`, attempt);
+        throw new AddressResolutionError("CONTRACT_AMBIGUOUS", `@${query} is ambiguous:\n${attempt.candidates.map((candidate) => `  ${formatAmbiguousCandidate(candidate)}`).join("\n")}\nuse a full @commission-id`, attempt);
     }
     const candidates = await commissionAddressCandidates(repo.stableRoot);
+    let boundContractId;
+    try {
+        const effectiveRepo = await stableRepoRoot(workdir);
+        if (effectiveRepo === repo.stableRoot) {
+            boundContractId = await activeContractBoundByEngineWorktree(workdir);
+        }
+    }
+    catch (error) {
+        if (!errorContainsAnyPattern(error, NOT_GIT_REPOSITORY_PATTERNS))
+            throw error;
+    }
+    if (boundContractId) {
+        const candidate = candidates.find((item) => item.active && item.contractId === boundContractId);
+        if (candidate) {
+            return buildResolvedAddress({
+                repo,
+                workdir,
+                candidate,
+                matchedBy: "id",
+                asTyped: `@${candidate.contractId}`,
+                source: "worktree-binding",
+                inference: ["verified active engine worktree binding"],
+            });
+        }
+    }
     const operable = candidates.filter((candidate) => candidate.active);
     const attempt = {
         repo,
@@ -265,3 +305,13 @@ export async function resolveContractAddress(cwd, raw, source = raw?.startsWith(
         ? "no active commission found; pass @place, @slug, full @commission-id, or --contract <addr>"
         : "multiple active commissions found; pass @place, @slug, full @commission-id, or --contract <addr>", attempt);
 }
+export async function resolveExistingContractAddress(cwd, raw, source = raw?.startsWith("@") ? "at-address" : "explicit-flag", effectiveDirectory = cwd) {
+    const address = await resolveContractAddress(cwd, raw, source, effectiveDirectory);
+    try {
+        await assertNoRenewRecoverySession(address.repo.stableRoot, address.binding.commissionId);
+    }
+    catch (error) {
+        throw attachAddressCarrier(error, address);
+    }
+    return address;
+}

package/build/core/amend.js

@@ -1,15 +1,63 @@
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
 import { FlowError } from "../flow-error.js";
 import { getCurrentBranch, requireGitRepository } from "../git/branches.js";
-import { KEIYAKU_FILE } from "../keiyaku.js";
-import { activeLedgerRef, appendWithRetry, readLedger } from "./ledger.js";
-import { renderContractView } from "./contract-view.js";
+import { activeLedgerRef, appendWithRetry } from "./ledger.js";
+import { refreshContractView } from "./contract-view.js";
 import { deriveContractState, isTerminalState } from "./status/lifecycle.js";
 import { resolveContractAddress, withResolvedAddress } from "./addressing.js";
 import { resolveDefaultBranch } from "./status/drift.js";
-import { assertCleanWorkingTree } from "./arc.js";
-import { normalizeScopePattern } from "./scope.js";
+import { markdownSourceSections, normalizeScopePattern, validateScopeFragmentLines } from "./scope.js";
+import { normalizeSectionTitle } from "./markdown/titles.js";
+import { resolveContractDeliveryCwd } from "./worktree-path.js";
+function amendScopeHeading(name) {
+    return `## Scope ${name[0].toUpperCase()}${name.slice(1)}`;
+}
+function parseAmendScopeSections(markdown) {
+    const sections = {};
+    for (const section of markdownSourceSections(markdown)) {
+        if (section.level !== 2)
+            continue;
+        const title = normalizeSectionTitle(section.title);
+        if (title === "scope add") {
+            throw new FlowError("INVALID_KEIYAKU_DRAFT", "Scope Add is obsolete; use ## Scope Append with a fenced gitignore-subset block");
+        }
+        if (title !== "scope append")
+            continue;
+        if (sections.append) {
+            throw new FlowError("INVALID_KEIYAKU_DRAFT", `amend input may contain ${amendScopeHeading("append")} at most once`);
+        }
+        sections.append = {
+            name: "append",
+            start: section.start,
+            contentStart: section.contentStart,
+            end: section.end,
+        };
+    }
+    let prose = markdown;
+    for (const section of Object.values(sections).sort((left, right) => right.start - left.start)) {
+        prose = `${prose.slice(0, section.start)}${prose.slice(section.end)}`;
+    }
+    return { sections, prose };
+}
+function scopePatterns(markdown, section) {
+    return validateScopeFragmentLines(markdown.slice(section.contentStart, section.end).split(/\r?\n/), {
+        heading: amendScopeHeading(section.name),
+        emptyMessage: `amend input has an empty ${amendScopeHeading(section.name)} section`,
+    });
+}
+export function buildAmendInput(markdown, cwd, contractId, contractAddressSource) {
+    const { sections, prose } = parseAmendScopeSections(markdown);
+    const append = sections.append ? scopePatterns(markdown, sections.append) : [];
+    if (!prose.trim()) {
+        throw new FlowError("EMPTY_PARAM", "amendment cannot be empty");
+    }
+    return {
+        cwd,
+        ...(contractId ? { contractId } : {}),
+        ...(contractAddressSource ? { contractAddressSource } : {}),
+        amendment: prose,
+        ...(sections.append ? { scopeDelta: { add: append } } : {}),
+    };
+}
 function requireAmendment(value) {
     if (!value.trim())
         throw new FlowError("EMPTY_PARAM", "amendment cannot be empty");
@@ -24,13 +72,6 @@ function assertContractOperable(contractId, entries) {
         throw new FlowError("INTERNAL_STATE", `contract ${contractId} is terminal (${state.state})`);
     }
 }
-async function renderUpdatedContract(cwd, contractId) {
-    const ledger = await readLedger(cwd, contractId);
-    if (!ledger) {
-        throw new FlowError("INTERNAL_STATE", `contract ${contractId} active ledger disappeared before render`);
-    }
-    await fs.writeFile(path.join(cwd, KEIYAKU_FILE), renderContractView({ id: contractId, entries: ledger.entries }), "utf8");
-}
 function normalizeScopeDelta(scopeDelta) {
     if (!scopeDelta)
         return undefined;
@@ -43,6 +84,7 @@ function normalizeScopeDelta(scopeDelta) {
 export async function amendContract(input) {
     const amendment = requireAmendment(input.amendment);
     const scopeDelta = normalizeScopeDelta(input.scopeDelta);
+    const renderCwd = input.renderCwd ?? input.cwd;
     const at = new Date(input.nowMs).toISOString();
     const ref = activeLedgerRef(input.contractId);
     let amendmentNumber = 0;
@@ -67,20 +109,21 @@ export async function amendContract(input) {
     if (amendmentNumber === 0) {
         throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} active ledger disappeared during amend`);
     }
-    await renderUpdatedContract(input.cwd, input.contractId);
+    await refreshContractView({ ledgerCwd: input.cwd, renderCwd, contractId: input.contractId });
     return { contractId: input.contractId, amendmentNumber, ledgerHead: result.head };
 }
 export async function amendKeiyaku(input) {
     await requireGitRepository(input.cwd, "amend");
-    const address = await resolveContractAddress(input.cwd, input.contractId, input.contractAddressSource);
+    const address = input.address ?? await resolveContractAddress(input.cwd, input.contractId, input.contractAddressSource);
     return await withResolvedAddress(address, async () => {
         const contractId = address.binding.commissionId;
-        await assertCleanWorkingTree(input.cwd, []);
+        const renderCwd = await resolveContractDeliveryCwd(input.cwd, contractId);
         const amendment = requireAmendment(input.amendment);
-        const currentBranch = await getCurrentBranch(input.cwd);
+        const currentBranch = await getCurrentBranch(renderCwd);
         const baseBranch = (await resolveDefaultBranch(input.cwd))?.branch ?? currentBranch;
         const amended = await amendContract({
             cwd: input.cwd,
+            renderCwd,
             contractId,
             actor: "keiyaku",
             nowMs: Date.now(),

package/build/core/arc.js

@@ -2,63 +2,18 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { requireText, FlowError } from "../flow-error.js";
 import { getCurrentBranch, requireGitRepository } from "../git/branches.js";
-import { DIRTY_FILE_CATEGORY, getDirtyFiles, renderDirtyFileStatusLine } from "../git/worktree.js";
+import { assertCleanTrackedWorkingTree } from "../git/worktree.js";
 import { KEIYAKU_FILE, ACTOR_IDENTITY } from "../keiyaku.js";
-import { buildDirtyWorktreeArtifactHint } from "./hints.js";
 import { normalizeInlineTitle } from "./markdown/titles.js";
-import { parseCommandMarkdown, requireMarkdownTextSection, requireMarkdownTitle, } from "./command-io.js";
+import { parseCommandMarkdown, requireMarkdownTextSection, requireMarkdownTitle, } from "./command-markdown.js";
 import { resolveContractAddress, withResolvedAddress } from "./addressing.js";
 import { activeLedgerRef, appendWithRetry, readLedger } from "./ledger.js";
-import { renderContractView } from "./contract-view.js";
-import { findOpenArc, getMaxArc, sealCurrentArc } from "./seal.js";
+import { refreshContractView } from "./contract-view.js";
+import { appendScopeTerms, findOpenArc, getMaxArc, sealCurrentArc } from "./seal.js";
 import { deriveContractState, isTerminalState } from "./status/lifecycle.js";
 import { resolveDefaultBranch } from "./status/drift.js";
 import { persistResponseHistory } from "./transcripts.js";
-const DIRTY_WORKTREE_LIST_LIMIT = 10;
-const KEIYAKU_ARTIFACT_DIR_PREFIX = ".keiyaku/";
-function normalizePathForDirtyMatch(cwd, filePath) {
-    const normalizedPath = filePath.trim();
-    if (!normalizedPath)
-        return "";
-    const repoRelativePath = path.isAbsolute(normalizedPath) ? path.relative(cwd, normalizedPath) : normalizedPath;
-    const platformNormalizedPath = path.normalize(repoRelativePath.replace(/[\\/]+/g, path.sep));
-    return platformNormalizedPath.split(path.sep).join("/").replace(/^\.\/+/, "").replace(/^\/+/, "");
-}
-function pathSegments(normalizedPath) {
-    return normalizedPath.split("/").filter((segment) => segment.length > 0 && segment !== ".");
-}
-function matchesIgnorePattern(filePath, ignorePattern) {
-    const patternSegments = pathSegments(ignorePattern);
-    const fileSegments = pathSegments(filePath);
-    return patternSegments.length > 0
-        && fileSegments.length >= patternSegments.length
-        && patternSegments.every((segment, index) => fileSegments[index] === segment);
-}
-export function filterDirtyFilesByAllowlist(cwd, dirtyFiles, ignorePatterns) {
-    const ignoredPaths = Array.from(new Set((ignorePatterns ?? []).map((pattern) => normalizePathForDirtyMatch(cwd, pattern)).filter(Boolean)));
-    return {
-        dirtyFiles: dirtyFiles.filter((file) => {
-            const normalizedFilePath = normalizePathForDirtyMatch(cwd, file.path);
-            return !ignoredPaths.some((ignoredPath) => matchesIgnorePattern(normalizedFilePath, ignoredPath));
-        }),
-        ignoredPaths,
-    };
-}
-export function filterBlockingDirtyFiles(dirtyFiles) {
-    return dirtyFiles.filter((file) => file.category !== DIRTY_FILE_CATEGORY.untracked);
-}
-export async function assertCleanWorkingTree(cwd, ignorePatterns) {
-    const blockingDirtyFiles = filterBlockingDirtyFiles(await getDirtyFiles(cwd));
-    const { dirtyFiles } = filterDirtyFilesByAllowlist(cwd, blockingDirtyFiles, ignorePatterns);
-    if (dirtyFiles.length === 0)
-        return;
-    const hasDirtyKeiyakuArtifacts = dirtyFiles.some((file) => normalizePathForDirtyMatch(cwd, file.path).startsWith(KEIYAKU_ARTIFACT_DIR_PREFIX));
-    const shown = dirtyFiles.slice(0, DIRTY_WORKTREE_LIST_LIMIT);
-    const list = shown.map((file) => `  ${renderDirtyFileStatusLine(file)}`).join("\n");
-    const overflowCount = dirtyFiles.length - shown.length;
-    const overflowLine = overflowCount > 0 ? `\n  ... (+${overflowCount} more)` : "";
-    throw new FlowError("DIRTY_WORKTREE", `Uncommitted changes detected in working tree:\n${list}${overflowLine}\n\nBlocking changes must be committed or stashed before proceeding.`, hasDirtyKeiyakuArtifacts ? { hints: [buildDirtyWorktreeArtifactHint()] } : undefined);
-}
+import { resolveContractDeliveryCwd } from "./worktree-path.js";
 export function buildArcViews(entries) {
     const arcs = new Map();
     for (const entry of entries) {
@@ -96,29 +51,31 @@ function assertArcOpenable(contractId, entries) {
         throw new FlowError("INTERNAL_STATE", `contract ${contractId} cannot open arc from state ${state.state}`);
     }
 }
-async function renderUpdatedContract(cwd, contractId) {
-    const ledger = await readLedger(cwd, contractId);
-    if (!ledger) {
-        throw new FlowError("INTERNAL_STATE", `contract ${contractId} active ledger disappeared before render`);
-    }
-    await fs.writeFile(path.join(cwd, KEIYAKU_FILE), renderContractView({ id: contractId, entries: ledger.entries }), "utf8");
-}
 export async function openArc(input) {
     const title = requireText("title", input.title);
     const objective = requireText("objective", input.objective);
     const brief = requireText("brief", input.brief);
+    const renderCwd = input.renderCwd ?? input.cwd;
     const ledger = await readLedger(input.cwd, input.contractId);
     if (!ledger) {
         throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} not found or not active`);
     }
     assertArcOpenable(input.contractId, ledger.entries);
-    const sealed = await sealCurrentArc({
+    await appendScopeTerms({
         cwd: input.cwd,
-        renderCwd: input.cwd,
+        renderCwd,
+        contractId: input.contractId,
+        patterns: input.appendScope,
+        actor: input.actor,
+        nowMs: input.nowMs,
+    });
+    // Seal capture needs delivery HEAD; ledger append may use hub or delivery (shared refs).
+    const sealed = await sealCurrentArc({
+        cwd: renderCwd,
+        renderCwd,
         contractId: input.contractId,
         sealedBy: "arc",
         nowMs: input.nowMs,
-        waivePaths: input.waivePaths,
     });
     const at = new Date(input.nowMs).toISOString();
     let arcNumber = 0;
@@ -140,10 +97,10 @@ export async function openArc(input) {
     if (!result.ok || arcNumber === 0) {
         throw new FlowError("INTERNAL_STATE", `contract ${input.contractId} active ledger disappeared during arc`);
     }
-    await renderUpdatedContract(input.cwd, input.contractId);
+    await refreshContractView({ ledgerCwd: input.cwd, renderCwd, contractId: input.contractId });
     return { contractId: input.contractId, arc: arcNumber, ledgerHead: result.head, sealed };
 }
-export function buildArcInput(content, cwd, waivePaths = [], contractId, contractAddressSource) {
+export function buildArcInput(content, cwd, appendScope = [], contractId, contractAddressSource) {
     const parts = parseCommandMarkdown(content);
     return {
         cwd,
@@ -152,7 +109,7 @@ export function buildArcInput(content, cwd, waivePaths = [], contractId, contrac
         title: requireMarkdownTitle(parts),
         objective: requireMarkdownTextSection(parts, "Objective"),
         brief: requireMarkdownTextSection(parts, "Brief"),
-        waivePaths,
+        appendScope,
     };
 }
 async function readBranchLabels(cwd) {
@@ -162,11 +119,13 @@ async function readBranchLabels(cwd) {
 }
 export async function arcKeiyaku(input) {
     await requireGitRepository(input.cwd, "arc");
-    const address = await resolveContractAddress(input.cwd, input.contractId, input.contractAddressSource);
+    const address = input.address ?? await resolveContractAddress(input.cwd, input.contractId, input.contractAddressSource);
     return await withResolvedAddress(address, async () => {
-        await assertCleanWorkingTree(input.cwd, []);
+        const contractId = address.binding.commissionId;
+        const renderCwd = await resolveContractDeliveryCwd(input.cwd, contractId);
+        await assertCleanTrackedWorkingTree(renderCwd);
         try {
-            await fs.access(path.join(input.cwd, KEIYAKU_FILE));
+            await fs.access(path.join(renderCwd, KEIYAKU_FILE));
         }
         catch {
             throw new FlowError("MISSING_PROTOCOL_FILES", `missing protocol file for current keiyaku (${KEIYAKU_FILE})`);
@@ -174,22 +133,22 @@ export async function arcKeiyaku(input) {
         const title = normalizeInlineTitle(requireText("title", input.title));
         const objective = requireText("objective", input.objective);
         const brief = requireText("brief", input.brief);
-        const contractId = address.binding.commissionId;
+        const nowMs = Date.now();
         const opened = await openArc({
             cwd: input.cwd,
+            renderCwd,
             contractId,
             actor: ACTOR_IDENTITY,
-            nowMs: Date.now(),
+            nowMs,
             title,
             objective,
             brief,
-            waivePaths: input.waivePaths,
+            appendScope: input.appendScope,
         });
-        const { currentBranch, baseBranch } = await readBranchLabels(input.cwd);
+        const { currentBranch, baseBranch } = await readBranchLabels(renderCwd);
         const summary = opened.sealed
             ? `a${opened.sealed.arc} sealed; a${opened.arc} open: ${title}.`
             : `a${opened.arc} open: ${title}.`;
-        const diff = opened.sealed?.incrementalDiff ?? "working tree untouched";
         let responsePath;
         let artifactId;
         try {
@@ -202,7 +161,7 @@ export async function arcKeiyaku(input) {
                 brief,
                 ledgerCommit: opened.ledgerHead,
                 summary,
-                diff,
+                emptyDiffLabel: "working tree untouched",
                 ...(opened.sealed ? { sealed: opened.sealed } : {}),
             });
             responsePath = persisted.responsePath;
@@ -217,7 +176,8 @@ export async function arcKeiyaku(input) {
             currentBranch,
             baseBranch,
             commit: opened.ledgerHead,
-            diff,
+            // CLI/render synthesizes public face bytes from sealed typed facts.
+            diff: "",
             summary,
             title,
             objective,