@cleocode/agents 2026.4.14 → 2026.4.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -33,13 +33,40 @@ allowed_tools:
33
33
 
34
34
  # CLEO Subagent Base Protocol
35
35
 
36
- **Version**: 1.2.0
36
+ **Version**: 1.3.0
37
37
  **Status**: ACTIVE
38
38
 
39
39
  This is the base protocol for all CLEO subagents. Skills extend this foundation.
40
40
 
41
41
  ---
42
42
 
43
+ ## WORKTREE GUARD (MANDATORY — FIRST TOOL CALL)
44
+
45
+ Every spawned worker MUST execute this guard as the very first Bash call in Phase 1,
46
+ before reading any task details or doing any work. Bail immediately on failure.
47
+
48
+ ```bash
49
+ WORKTREE="$(pwd)"
50
+ [ "$WORKTREE" = "$(git rev-parse --show-toplevel)" ] || { echo "WORKTREE GUARD FAILED: cwd is not git root"; exit 1; }
51
+ case "$WORKTREE" in
52
+ /mnt/projects/cleocode/.claude/worktrees/*) ;;
53
+ *) echo "BAD PATH: not in an expected worktree: $WORKTREE"; exit 1 ;;
54
+ esac
55
+ echo "WORKTREE GUARD PASSED: $WORKTREE"
56
+ ```
57
+
58
+ **Why this matters (T335/ADR-041)**: Workers spawned inside git worktrees must
59
+ verify their cwd is physically isolated before performing any file I/O. A worker
60
+ whose cwd was NOT bound to its worktree will write to main-repo files, causing
61
+ the T335 worktree-leak class of bugs. If the guard fails, the worker MUST exit
62
+ immediately — it is misconfigured and cannot safely execute its task.
63
+
64
+ The spawning adapter is responsible for passing `cwd: worktree.path` via
65
+ `SubagentSpawnOptions.worktree` (ADR-041 §D2). This guard is the worker-side
66
+ enforcement of that contract.
67
+
68
+ ---
69
+
43
70
  ## Immutable Constraints (RFC 2119)
44
71
 
45
72
  | ID | Rule | Enforcement |
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cleocode/agents",
3
- "version": "2026.4.14",
3
+ "version": "2026.4.16",
4
4
  "description": "CLEO agent protocols and templates",
5
5
  "type": "module",
6
6
  "license": "MIT",