@cleocode/git-shim 2026.4.154 → 2026.4.157

package/dist/boundary.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Result returned by a boundary predicate when an operation must be blocked.
+ *
+ * Stable shape so callers can render consistent error envelopes.
+ *
+ * @task T1591
+ */
+export interface BoundaryViolation {
+    /** CLEO error code (`E_GIT_BOUNDARY_*`). */
+    code: 'E_GIT_BOUNDARY_WORKTREE_PATH' | 'E_GIT_BOUNDARY_COMMIT_TASK_ID' | 'E_GIT_BOUNDARY_MERGE_FORBIDDEN' | 'E_GIT_BOUNDARY_CHERRY_PICK_TASK_BRANCH';
+    /** Which boundary letter (a/b/c/d) — kept in audit log for grouping. */
+    boundary: 'a' | 'b' | 'c' | 'd';
+    /** Short human-readable summary of the violation. */
+    message: string;
+    /** Suggested operator action (always includes the override path). */
+    remediation: string;
+    /** Free-form context attached to the audit record. */
+    context: Record<string, string>;
+}
+/**
+ * Boundary (a) — Worktree-path enforcement.
+ *
+ * Rejects `git add` of a path outside the active worktree. The shim runs
+ * with `cwd === process.cwd()`, so any relative path is rooted there.
+ * Absolute paths are checked verbatim.
+ *
+ * `git add` flags that don't take paths (`-A`, `--all`, `-u`, `--update`,
+ * `-i`, `--interactive`, `-p`, `--patch`) are allowed as-is — git itself
+ * scopes them to the current repo, which is the worktree.
+ *
+ * @param args - argv slice after the `add` subcommand.
+ * @param cwd - Current working directory at invocation time.
+ * @param worktreePath - Active worktree root.
+ * @returns Violation when an explicit path escapes the worktree, else null.
+ *
+ * @task T1591
+ */
+export declare function validateAddPaths(args: ReadonlyArray<string>, cwd: string, worktreePath: string): BoundaryViolation | null;
+/**
+ * Extract every commit-message subject from a `git commit` invocation.
+ *
+ * Handles `-m <msg>`, `--message <msg>`, `-m=<msg>`, `--message=<msg>`. Each
+ * occurrence contributes to a multi-paragraph commit; the **first** message is
+ * the subject. We validate every `-m` since git concatenates them with blank
+ * lines.
+ *
+ * @param args - argv slice after the `commit` subcommand.
+ * @returns The list of message values present, in order.
+ *
+ * @task T1591
+ */
+export declare function extractCommitMessages(args: ReadonlyArray<string>): string[];
+/**
+ * Determine whether the given commit invocation will produce a new commit.
+ *
+ * Read-only flags like `--dry-run`, `--allow-empty-message`, the absence of
+ * `-m` (which opens an editor — caught by the editor-side hook in T1588), and
+ * `--amend` without `-m` all pass through. The shim only enforces when a
+ * subject is supplied inline.
+ *
+ * @param args - argv slice after the `commit` subcommand.
+ * @returns true when at least one inline `-m` message was supplied.
+ *
+ * @task T1591
+ */
+export declare function commitHasInlineMessage(args: ReadonlyArray<string>): boolean;
+/**
+ * Boundary (b) — Commit T-ID gate.
+ *
+ * Rejects `git commit -m "<msg>"` when the subject lacks a CLEO task ID
+ * (`T<NUM>`). Multi-`-m` invocations validate the FIRST message (the
+ * subject — git concatenates subsequent `-m` values as paragraphs).
+ *
+ * @param args - argv slice after the `commit` subcommand.
+ * @param expectedTaskId - Optional hard-anchor: when provided, the subject
+ *   must contain this exact ID, not just any `T<NUM>`.
+ * @returns Violation when the inline subject lacks a task ID, else null.
+ *
+ * @task T1591
+ */
+export declare function validateCommitSubject(args: ReadonlyArray<string>, expectedTaskId: string | null): BoundaryViolation | null;
+/**
+ * Boundary (c) — Merge restriction.
+ *
+ * Rejects `git merge` invocations from agent worktrees unless the
+ * `CLEO_ORCHESTRATE_MERGE` env var is set. That env var is supplied
+ * exclusively by `completeAgentWorktreeViaMerge` (ADR-062 / T1587), so a
+ * direct `git merge` from an agent will always fail.
+ *
+ * Merge subcommand variants that DON'T merge (`--abort`, `--continue`,
+ * `--quit`) pass through.
+ *
+ * @param args - argv slice after the `merge` subcommand.
+ * @param env - Snapshot of relevant env vars.
+ * @returns Violation when merge is blocked, else null.
+ *
+ * @task T1591
+ * @adr ADR-062
+ */
+export declare function validateMergeAllowed(args: ReadonlyArray<string>, env: {
+    CLEO_ORCHESTRATE_MERGE?: string;
+}): BoundaryViolation | null;
+/**
+ * Boundary (d) — Cherry-pick refusal from worktree branches.
+ *
+ * Rejects `git cherry-pick <ref>` when `<ref>` is a `task/T<NUM>` branch.
+ * Cherry-pick from those branches is the deprecated integration path
+ * (ADR-062 supersedes it with `git merge --no-ff`).
+ *
+ * Also catches `git cherry-pick task/T<NUM>..HEAD` and similar range syntax.
+ *
+ * @param args - argv slice after the `cherry-pick` subcommand.
+ * @returns Violation when a task-branch ref is referenced, else null.
+ *
+ * @task T1591
+ * @adr ADR-062
+ */
+export declare function validateCherryPickSource(args: ReadonlyArray<string>): BoundaryViolation | null;
+//# sourceMappingURL=boundary.d.ts.map

package/dist/boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.d.ts","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAuBA;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,IAAI,EACA,8BAA8B,GAC9B,+BAA+B,GAC/B,gCAAgC,GAChC,wCAAwC,CAAC;IAC7C,wEAAwE;IACxE,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAChC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAQD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,iBAAiB,GAAG,IAAI,CAyB1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAoB3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAE3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,iBAAiB,GAAG,IAAI,CAgC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,GAAG,EAAE;IAAE,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,iBAAiB,GAAG,IAAI,CAoB1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAoB9F"}

package/dist/boundary.js

@@ -0,0 +1,242 @@
+/**
+ * Boundary-enforcement predicates for the git-shim (T1591 L2 fence).
+ *
+ * Pure functions — no I/O, no spawning. Each predicate returns either
+ * `null` (allowed) or a {@link BoundaryViolation} (must block).
+ *
+ * The four T1591 boundaries:
+ *
+ * 1. **(a) Worktree-path enforcement** — `git add <path>` MUST stage files
+ *    inside the active worktree. Cross-worktree adds are blocked.
+ * 2. **(b) Commit T-ID gate** — `git commit -m "<msg>"` MUST embed `T<NUM>`
+ *    in the subject line.
+ * 3. **(c) Merge restriction** — `git merge` is blocked unless
+ *    `CLEO_ORCHESTRATE_MERGE=1` (set by `completeAgentWorktreeViaMerge`).
+ * 4. **(d) Cherry-pick refusal** — `git cherry-pick <ref>` is blocked when
+ *    `<ref>` matches `task/T\d+` (T1587 anti-pattern).
+ *
+ * @task T1591
+ * @adr ADR-062
+ */
+import { isAbsolute, resolve } from 'node:path';
+import { isPathInsideWorktree } from './worktree-path.js';
+/** Regex that matches CLEO task IDs in commit subjects. Project-agnostic. */
+const TASK_ID_PATTERN = /\bT\d+\b/;
+/** Regex that matches a worktree branch ref (`task/T<NUM>`). */
+const TASK_BRANCH_PATTERN = /^task\/T\d+$/;
+/**
+ * Boundary (a) — Worktree-path enforcement.
+ *
+ * Rejects `git add` of a path outside the active worktree. The shim runs
+ * with `cwd === process.cwd()`, so any relative path is rooted there.
+ * Absolute paths are checked verbatim.
+ *
+ * `git add` flags that don't take paths (`-A`, `--all`, `-u`, `--update`,
+ * `-i`, `--interactive`, `-p`, `--patch`) are allowed as-is — git itself
+ * scopes them to the current repo, which is the worktree.
+ *
+ * @param args - argv slice after the `add` subcommand.
+ * @param cwd - Current working directory at invocation time.
+ * @param worktreePath - Active worktree root.
+ * @returns Violation when an explicit path escapes the worktree, else null.
+ *
+ * @task T1591
+ */
+export function validateAddPaths(args, cwd, worktreePath) {
+    // Walk through args; non-flag arguments are pathspecs.
+    for (const arg of args) {
+        if (arg.startsWith('-'))
+            continue; // flag — skip
+        // Pathspec leaders like `:` or `:/` are skipped — git treats them specially.
+        if (arg === '.' || arg === '*' || arg === '')
+            continue;
+        if (arg.startsWith(':'))
+            continue;
+        const absolute = isAbsolute(arg) ? arg : resolve(cwd, arg);
+        if (!isPathInsideWorktree(absolute, worktreePath)) {
+            return {
+                code: 'E_GIT_BOUNDARY_WORKTREE_PATH',
+                boundary: 'a',
+                message: `git add refused — path "${arg}" resolves outside agent worktree (${worktreePath})`,
+                remediation: 'Stage only files inside the worktree. To bypass for emergency hotfix set CLEO_ALLOW_GIT=1 (audited).',
+                context: {
+                    attempted_path: arg,
+                    resolved_path: absolute,
+                    worktree_path: worktreePath,
+                },
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Extract every commit-message subject from a `git commit` invocation.
+ *
+ * Handles `-m <msg>`, `--message <msg>`, `-m=<msg>`, `--message=<msg>`. Each
+ * occurrence contributes to a multi-paragraph commit; the **first** message is
+ * the subject. We validate every `-m` since git concatenates them with blank
+ * lines.
+ *
+ * @param args - argv slice after the `commit` subcommand.
+ * @returns The list of message values present, in order.
+ *
+ * @task T1591
+ */
+export function extractCommitMessages(args) {
+    const messages = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === undefined)
+            continue;
+        if (a === '-m' || a === '--message') {
+            const next = args[i + 1];
+            if (next !== undefined)
+                messages.push(next);
+            i++;
+            continue;
+        }
+        if (a.startsWith('-m=')) {
+            messages.push(a.slice(3));
+            continue;
+        }
+        if (a.startsWith('--message=')) {
+            messages.push(a.slice('--message='.length));
+        }
+    }
+    return messages;
+}
+/**
+ * Determine whether the given commit invocation will produce a new commit.
+ *
+ * Read-only flags like `--dry-run`, `--allow-empty-message`, the absence of
+ * `-m` (which opens an editor — caught by the editor-side hook in T1588), and
+ * `--amend` without `-m` all pass through. The shim only enforces when a
+ * subject is supplied inline.
+ *
+ * @param args - argv slice after the `commit` subcommand.
+ * @returns true when at least one inline `-m` message was supplied.
+ *
+ * @task T1591
+ */
+export function commitHasInlineMessage(args) {
+    return extractCommitMessages(args).length > 0;
+}
+/**
+ * Boundary (b) — Commit T-ID gate.
+ *
+ * Rejects `git commit -m "<msg>"` when the subject lacks a CLEO task ID
+ * (`T<NUM>`). Multi-`-m` invocations validate the FIRST message (the
+ * subject — git concatenates subsequent `-m` values as paragraphs).
+ *
+ * @param args - argv slice after the `commit` subcommand.
+ * @param expectedTaskId - Optional hard-anchor: when provided, the subject
+ *   must contain this exact ID, not just any `T<NUM>`.
+ * @returns Violation when the inline subject lacks a task ID, else null.
+ *
+ * @task T1591
+ */
+export function validateCommitSubject(args, expectedTaskId) {
+    const messages = extractCommitMessages(args);
+    if (messages.length === 0)
+        return null; // editor flow — handled by hooks (T1588)
+    const subject = messages[0] ?? '';
+    if (expectedTaskId) {
+        // Anchor check: subject must contain the active worktree's task ID.
+        const literal = new RegExp(`\\b${expectedTaskId}\\b`);
+        if (!literal.test(subject)) {
+            return {
+                code: 'E_GIT_BOUNDARY_COMMIT_TASK_ID',
+                boundary: 'b',
+                message: `git commit refused — subject "${subject}" missing task ID "${expectedTaskId}"`,
+                remediation: `Include "${expectedTaskId}" in the subject (e.g. "feat(${expectedTaskId}): …"). Bypass with CLEO_ALLOW_GIT=1 (audited).`,
+                context: { subject, expected_task_id: expectedTaskId },
+            };
+        }
+        return null;
+    }
+    // No expected ID — fall back to any `T<NUM>` (project-agnostic CLEO convention).
+    if (!TASK_ID_PATTERN.test(subject)) {
+        return {
+            code: 'E_GIT_BOUNDARY_COMMIT_TASK_ID',
+            boundary: 'b',
+            message: `git commit refused — subject "${subject}" missing CLEO task ID (T<NUM>)`,
+            remediation: 'Add a task ID to the subject (e.g. "fix(T1234): …"). Bypass with CLEO_ALLOW_GIT=1 (audited).',
+            context: { subject },
+        };
+    }
+    return null;
+}
+/**
+ * Boundary (c) — Merge restriction.
+ *
+ * Rejects `git merge` invocations from agent worktrees unless the
+ * `CLEO_ORCHESTRATE_MERGE` env var is set. That env var is supplied
+ * exclusively by `completeAgentWorktreeViaMerge` (ADR-062 / T1587), so a
+ * direct `git merge` from an agent will always fail.
+ *
+ * Merge subcommand variants that DON'T merge (`--abort`, `--continue`,
+ * `--quit`) pass through.
+ *
+ * @param args - argv slice after the `merge` subcommand.
+ * @param env - Snapshot of relevant env vars.
+ * @returns Violation when merge is blocked, else null.
+ *
+ * @task T1591
+ * @adr ADR-062
+ */
+export function validateMergeAllowed(args, env) {
+    // Allow control-flow flags that don't perform a merge.
+    for (const arg of args) {
+        if (arg === '--abort' || arg === '--continue' || arg === '--quit') {
+            return null;
+        }
+    }
+    if (env.CLEO_ORCHESTRATE_MERGE === '1')
+        return null;
+    return {
+        code: 'E_GIT_BOUNDARY_MERGE_FORBIDDEN',
+        boundary: 'c',
+        message: 'git merge refused — agents MUST NOT merge directly (ADR-062 / T1587)',
+        remediation: 'Use `cleo orchestrate complete <taskId>` so the orchestrator runs git merge --no-ff with the right env. Bypass with CLEO_ALLOW_GIT=1 (audited).',
+        context: {
+            args: args.join(' '),
+        },
+    };
+}
+/**
+ * Boundary (d) — Cherry-pick refusal from worktree branches.
+ *
+ * Rejects `git cherry-pick <ref>` when `<ref>` is a `task/T<NUM>` branch.
+ * Cherry-pick from those branches is the deprecated integration path
+ * (ADR-062 supersedes it with `git merge --no-ff`).
+ *
+ * Also catches `git cherry-pick task/T<NUM>..HEAD` and similar range syntax.
+ *
+ * @param args - argv slice after the `cherry-pick` subcommand.
+ * @returns Violation when a task-branch ref is referenced, else null.
+ *
+ * @task T1591
+ * @adr ADR-062
+ */
+export function validateCherryPickSource(args) {
+    for (const arg of args) {
+        if (arg.startsWith('-'))
+            continue;
+        // Range syntax like `task/T123..HEAD` or `task/T123^..task/T123`.
+        const refs = arg.split(/\.{2,3}/);
+        for (const ref of refs) {
+            const trimmed = ref.replace(/[\^~].*$/, '');
+            if (TASK_BRANCH_PATTERN.test(trimmed)) {
+                return {
+                    code: 'E_GIT_BOUNDARY_CHERRY_PICK_TASK_BRANCH',
+                    boundary: 'd',
+                    message: `git cherry-pick refused — source ref "${trimmed}" is an agent worktree branch (ADR-062: use git merge --no-ff)`,
+                    remediation: 'Run `cleo orchestrate complete <taskId>` to integrate via merge. Bypass with CLEO_ALLOW_GIT=1 (audited).',
+                    context: { source_ref: trimmed, original_arg: arg },
+                };
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=boundary.js.map

package/dist/boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../src/boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA0B1D,6EAA6E;AAC7E,MAAM,eAAe,GAAG,UAAU,CAAC;AAEnC,gEAAgE;AAChE,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA2B,EAC3B,GAAW,EACX,YAAoB;IAEpB,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,cAAc;QACjD,6EAA6E;QAC7E,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACvD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,IAAI,EAAE,8BAA8B;gBACpC,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,2BAA2B,GAAG,sCAAsC,YAAY,GAAG;gBAC5F,WAAW,EACT,sGAAsG;gBACxG,OAAO,EAAE;oBACP,cAAc,EAAE,GAAG;oBACnB,aAAa,EAAE,QAAQ;oBACvB,aAAa,EAAE,YAAY;iBAC5B;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA2B;IAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA2B;IAChE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA2B,EAC3B,cAA6B;IAE7B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IACjF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElC,IAAI,cAAc,EAAE,CAAC;QACnB,oEAAoE;QACpE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,cAAc,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,IAAI,EAAE,+BAA+B;gBACrC,QAAQ,EAAE,GAAG;gBACb,OAAO,EAAE,iCAAiC,OAAO,sBAAsB,cAAc,GAAG;gBACxF,WAAW,EAAE,YAAY,cAAc,gCAAgC,cAAc,iDAAiD;gBACtI,OAAO,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE;aACvD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,iCAAiC,OAAO,iCAAiC;YAClF,WAAW,EACT,8FAA8F;YAChG,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA2B,EAC3B,GAAwC;IAExC,uDAAuD;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEpD,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,sEAAsE;QAC/E,WAAW,EACT,iJAAiJ;QACnJ,OAAO,EAAE;YACP,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA2B;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,kEAAkE;QAClE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,IAAI,EAAE,wCAAwC;oBAC9C,QAAQ,EAAE,GAAG;oBACb,OAAO,EAAE,yCAAyC,OAAO,gEAAgE;oBACzH,WAAW,EACT,0GAA0G;oBAC5G,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE;iBACpD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -1,18 +1,22 @@
 /**
- * @cleocode/git-shim — Harness-agnostic git branch-mutation fence.
+ * @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591).
  *
- * Exports the denylist utilities so other packages can inspect the
- * blocked operation table without executing the shim binary.
- *
- * The shim binary itself lives at `dist/shim.js` and is registered
- * as the `git` bin entry in package.json.
+ * Re-exports the denylist + boundary predicates so other packages can inspect
+ * the shim's enforcement without executing the binary. The shim binary itself
+ * lives at `dist/shim.js` and is registered as the `git` bin entry in
+ * package.json.
  *
  * @task T1118
  * @task T1121
+ * @task T1591
  * @packageDocumentation
  */
-export type {} from './denylist.js';
+export type { AuditOutcome, AuditRecord } from './audit-log.js';
+export { resolveAuditLogPath, writeAuditRecord } from './audit-log.js';
+export type { BoundaryViolation } from './boundary.js';
+export { commitHasInlineMessage, extractCommitMessages, validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
 export { findDeniedOp, GIT_OP_DENYLIST, RESTRICTED_ROLES } from './denylist.js';
+export { extractTaskIdFromWorktreePath, isInsideWorktreesRoot, isPathInsideWorktree, resolveActiveWorktree, resolveCleoWorktreesRoot, resolveProjectWorktreeRoot, } from './worktree-path.js';
 /**
  * Install the shim symlink so that `git` resolves to this shim when
  * the shim directory is on PATH.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC/F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC/F"}

package/dist/index.js

@@ -1,17 +1,20 @@
 /**
- * @cleocode/git-shim — Harness-agnostic git branch-mutation fence.
+ * @cleocode/git-shim — Harness-agnostic git fence (T1118 + T1591).
  *
- * Exports the denylist utilities so other packages can inspect the
- * blocked operation table without executing the shim binary.
- *
- * The shim binary itself lives at `dist/shim.js` and is registered
- * as the `git` bin entry in package.json.
+ * Re-exports the denylist + boundary predicates so other packages can inspect
+ * the shim's enforcement without executing the binary. The shim binary itself
+ * lives at `dist/shim.js` and is registered as the `git` bin entry in
+ * package.json.
  *
  * @task T1118
  * @task T1121
+ * @task T1591
  * @packageDocumentation
  */
+export { resolveAuditLogPath, writeAuditRecord } from './audit-log.js';
+export { commitHasInlineMessage, extractCommitMessages, validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
 export { findDeniedOp, GIT_OP_DENYLIST, RESTRICTED_ROLES } from './denylist.js';
+export { extractTaskIdFromWorktreePath, isInsideWorktreesRoot, isPathInsideWorktree, resolveActiveWorktree, resolveCleoWorktreesRoot, resolveProjectWorktreeRoot, } from './worktree-path.js';
 /**
  * Install the shim symlink so that `git` resolves to this shim when
  * the shim directory is on PATH.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,WAAmB;IAC3E,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtC,qDAAqD;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;YAC3D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnC,wCAAwC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvE,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,WAAmB;IAC3E,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtC,qDAAqD;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;YAC3D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnC,wCAAwC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/shim.d.ts

@@ -1,30 +1,32 @@
 #!/usr/bin/env node
 /**
- * git-shim — harness-agnostic git branch-mutation fence (T1118 L2).
+ * git-shim — harness-agnostic git fence (T1118 L2 + T1591 boundary fence).
  *
  * Usage: place this binary on PATH BEFORE real git, and export:
  *   CLEO_AGENT_ROLE=worker   (or lead|subagent)
- *   CLEO_WORKTREE_ROOT=<path>
+ *   CLEO_WORKTREE_ROOT=<path>   (optional — auto-detected from cwd)
+ *   CLEO_TASK_ID=T<NUM>        (optional — auto-detected from worktree path)
  *
- * Behaviour:
- *   - If CLEO_AGENT_ROLE is a restricted role AND the git subcommand is in
- *     the denylist AND CLEO_ALLOW_BRANCH_OPS is not set: print structured
- *     error to stderr, exit 1.
- *   - If CLEO_ALLOW_BRANCH_OPS=1: log a warning and pass through (escape hatch).
- *   - Otherwise: exec real git with all original args (zero overhead path).
+ * Layered enforcement (in order, all under restricted-role gate):
+ *   1. T1118 denylist (branch-mutation ops). Bypass: `CLEO_ALLOW_BRANCH_OPS=1`.
+ *   2. T1591 boundary fence:
+ *      (a) git add path inside worktree
+ *      (b) git commit subject contains T-ID
+ *      (c) git merge requires CLEO_ORCHESTRATE_MERGE=1
+ *      (d) git cherry-pick refuses task/T<NUM> source
+ *      Bypass any of (a)-(d): `CLEO_ALLOW_GIT=1` (audited).
  *
- * The real git binary is resolved from CLEO_REAL_GIT_PATH env (override) or
- * discovered by walking PATH and skipping any entry that resolves to this
- * shim itself (detected via CLEO_SHIM_MARKER env set by the shim installer).
+ * Audit log at `<XDG>/cleo/audit/git-shim.jsonl` (override `CLEO_AUDIT_LOG_PATH`).
  *
  * Exit codes:
- *   0   — passthrough succeeded (real git exited 0)
- *   1   — git op blocked by shim
- *   77  — well-known CLEO_GIT_BLOCKED sentinel (same as exit 1 but distinguishable)
+ *   0   — passthrough succeeded
+ *   1   — generic shim error (real git not found)
+ *   77  — CLEO_GIT_BLOCKED sentinel (legacy denylist + new boundary fence)
  *   N   — real git exit code propagated
  *
  * @task T1118
  * @task T1121
+ * @task T1591
  */
 export {};
 //# sourceMappingURL=shim.d.ts.map

package/dist/shim.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shim.d.ts","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG"}
+{"version":3,"file":"shim.d.ts","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG"}