@cleocode/git-shim 2026.4.154 → 2026.4.158

package/dist/shim.js

@@ -1,35 +1,40 @@
 #!/usr/bin/env node
 /**
- * git-shim — harness-agnostic git branch-mutation fence (T1118 L2).
+ * git-shim — harness-agnostic git fence (T1118 L2 + T1591 boundary fence).
  *
  * Usage: place this binary on PATH BEFORE real git, and export:
  *   CLEO_AGENT_ROLE=worker   (or lead|subagent)
- *   CLEO_WORKTREE_ROOT=<path>
+ *   CLEO_WORKTREE_ROOT=<path>   (optional — auto-detected from cwd)
+ *   CLEO_TASK_ID=T<NUM>        (optional — auto-detected from worktree path)
  *
- * Behaviour:
- *   - If CLEO_AGENT_ROLE is a restricted role AND the git subcommand is in
- *     the denylist AND CLEO_ALLOW_BRANCH_OPS is not set: print structured
- *     error to stderr, exit 1.
- *   - If CLEO_ALLOW_BRANCH_OPS=1: log a warning and pass through (escape hatch).
- *   - Otherwise: exec real git with all original args (zero overhead path).
+ * Layered enforcement (in order, all under restricted-role gate):
+ *   1. T1118 denylist (branch-mutation ops). Bypass: `CLEO_ALLOW_BRANCH_OPS=1`.
+ *   2. T1591 boundary fence:
+ *      (a) git add path inside worktree
+ *      (b) git commit subject contains T-ID
+ *      (c) git merge requires CLEO_ORCHESTRATE_MERGE=1
+ *      (d) git cherry-pick refuses task/T<NUM> source
+ *      Bypass any of (a)-(d): `CLEO_ALLOW_GIT=1` (audited).
  *
- * The real git binary is resolved from CLEO_REAL_GIT_PATH env (override) or
- * discovered by walking PATH and skipping any entry that resolves to this
- * shim itself (detected via CLEO_SHIM_MARKER env set by the shim installer).
+ * Audit log at `<XDG>/cleo/audit/git-shim.jsonl` (override `CLEO_AUDIT_LOG_PATH`).
  *
  * Exit codes:
- *   0   — passthrough succeeded (real git exited 0)
- *   1   — git op blocked by shim
- *   77  — well-known CLEO_GIT_BLOCKED sentinel (same as exit 1 but distinguishable)
+ *   0   — passthrough succeeded
+ *   1   — generic shim error (real git not found)
+ *   77  — CLEO_GIT_BLOCKED sentinel (legacy denylist + new boundary fence)
  *   N   — real git exit code propagated
  *
  * @task T1118
  * @task T1121
+ * @task T1591
  */
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { writeAuditRecord } from './audit-log.js';
+import { validateAddPaths, validateCherryPickSource, validateCommitSubject, validateMergeAllowed, } from './boundary.js';
 import { findDeniedOp, RESTRICTED_ROLES } from './denylist.js';
+import { resolveActiveWorktree } from './worktree-path.js';
 /** Sentinel exit code for a shim-blocked git operation. */
 const BLOCKED_EXIT_CODE = 77;
 /**
@@ -48,27 +53,24 @@ function getAgentRole() {
  *
  * Strategy:
  * 1. If CLEO_REAL_GIT_PATH env is set, use it (override for testing).
- * 2. Walk PATH entries, skip the first one that contains CLEO_SHIM_MARKER.
+ * 2. Walk PATH entries, skip any that contain CLEO_SHIM_MARKER.
  * 3. Fall back to /usr/bin/git, /usr/local/bin/git, /opt/homebrew/bin/git.
  *
  * @returns Absolute path to real git, or null if not found.
  */
 function resolveRealGit() {
-    // Explicit override wins — useful for tests.
     const override = process.env['CLEO_REAL_GIT_PATH'];
     if (override && existsSync(override))
         return override;
     const shimMarker = process.env['CLEO_SHIM_MARKER'] ?? '.cleo/bin/git-shim';
     const pathDirs = (process.env['PATH'] ?? '').split(':');
     for (const dir of pathDirs) {
-        // Skip directories that look like the shim directory.
         if (dir.includes(shimMarker))
             continue;
         const candidate = join(dir, 'git');
         if (existsSync(candidate))
             return candidate;
     }
-    // Hard fallbacks for common installations.
     const fallbacks = ['/usr/bin/git', '/usr/local/bin/git', '/opt/homebrew/bin/git'];
     for (const fb of fallbacks) {
         if (existsSync(fb))
@@ -86,24 +88,103 @@ function resolveRealGit() {
  * @param context - Additional key/value context.
  */
 function emitBlockedError(code, message, context) {
-    process.stderr.write(JSON.stringify({
+    process.stderr.write(`${JSON.stringify({
         cleo_error: true,
         code,
         message,
         ...context,
-    }) + '\n');
-    // Also emit a plain-text line so human readers can understand without parsing.
-    process.stderr.write(`[git-shim] BLOCKED: ${message}\n` +
-        `[git-shim] Set CLEO_ALLOW_BRANCH_OPS=1 to bypass (audited).\n`);
+    })}\n`);
+    process.stderr.write(`[git-shim] BLOCKED: ${message}\n`);
+}
+/**
+ * Emit a boundary violation to stderr in a uniform format.
+ *
+ * @param violation - Predicate-emitted violation.
+ * @param subcommand - Git subcommand under inspection.
+ */
+function emitBoundaryViolation(violation, subcommand) {
+    emitBlockedError(violation.code, violation.message, {
+        boundary: violation.boundary,
+        subcommand,
+        ...violation.context,
+    });
+    process.stderr.write(`[git-shim] FIX: ${violation.remediation}\n`);
+}
+/**
+ * Apply the four T1591 boundary checks for the given subcommand.
+ *
+ * @param subcommand - Git subcommand (argv[0]).
+ * @param args - Remaining argv entries.
+ * @returns A boundary violation when blocked, else null.
+ */
+function evaluateBoundaries(subcommand, args) {
+    const cwd = process.cwd();
+    const active = resolveActiveWorktree(cwd);
+    // Boundary (a) — git add path inside worktree (only meaningful when active).
+    if (subcommand === 'add' && active) {
+        const v = validateAddPaths(args, cwd, active.worktreePath);
+        if (v)
+            return v;
+    }
+    // Boundary (b) — commit subject contains a task ID.
+    if (subcommand === 'commit') {
+        const expected = active ? active.taskId : null;
+        const v = validateCommitSubject(args, expected);
+        if (v)
+            return v;
+    }
+    // Boundary (c) — merge gated by CLEO_ORCHESTRATE_MERGE.
+    if (subcommand === 'merge') {
+        const v = validateMergeAllowed(args, {
+            CLEO_ORCHESTRATE_MERGE: process.env['CLEO_ORCHESTRATE_MERGE'],
+        });
+        if (v)
+            return v;
+    }
+    // Boundary (d) — cherry-pick rejects task/T<NUM> sources.
+    if (subcommand === 'cherry-pick') {
+        const v = validateCherryPickSource(args);
+        if (v)
+            return v;
+    }
+    return null;
+}
+/**
+ * Build a structured audit record for the current invocation.
+ *
+ * @param outcome - "blocked" | "bypassed-allow-git" | "bypassed-orchestrate-merge".
+ * @param boundary - Which boundary fired (a-d, or "denylist").
+ * @param code - CLEO error code.
+ * @param subcommand - Git subcommand.
+ * @param args - Argv tail.
+ * @param context - Free-form per-violation context.
+ * @returns Fully populated audit record.
+ */
+function buildAuditRecord(outcome, boundary, code, subcommand, args, context) {
+    const cwd = process.cwd();
+    const active = resolveActiveWorktree(cwd);
+    return {
+        ts: new Date().toISOString(),
+        outcome,
+        boundary,
+        code,
+        subcommand,
+        args,
+        cwd,
+        worktree_path: active?.worktreePath ?? null,
+        task_id: active?.taskId ?? null,
+        role: process.env['CLEO_AGENT_ROLE'] ?? null,
+        context,
+    };
 }
 /**
  * Main shim entry point.
  *
- * Reads argv, env, applies the denylist, and either blocks or passes through
- * to the real git binary.
+ * Reads argv, env, applies the denylist + the boundary fence, and either
+ * blocks or passes through to the real git binary.
  */
 function main() {
-    const argv = process.argv.slice(2); // strip "node" and shim path
+    const argv = process.argv.slice(2);
     const subcommand = argv[0];
     // Fast path: no subcommand → pass through (git with no args shows usage).
     if (!subcommand) {
@@ -128,11 +209,14 @@ function main() {
         process.exit(result.status ?? 1);
         return;
     }
-    // Check escape hatch — operator has explicitly permitted this one invocation.
-    const allowBranchOps = process.env['CLEO_ALLOW_BRANCH_OPS'] === '1';
     const remainingArgs = argv.slice(1);
+    const allowBranchOps = process.env['CLEO_ALLOW_BRANCH_OPS'] === '1';
+    const allowGit = process.env['CLEO_ALLOW_GIT'] === '1';
+    // ---------------------------------------------------------------------------
+    // Layer 1 — T1118 denylist (branch-mutation ops).
+    // ---------------------------------------------------------------------------
     const denied = findDeniedOp(subcommand, remainingArgs);
-    if (denied && !allowBranchOps) {
+    if (denied && !allowBranchOps && !allowGit) {
         const worktreeRoot = process.env['CLEO_WORKTREE_ROOT'] ?? '(unknown)';
         emitBlockedError('E_GIT_OP_BLOCKED', `git ${subcommand}${denied.flag ? ` ${denied.flag}` : ''} is not allowed for role '${role}': ${denied.reason}`, {
             subcommand,
@@ -140,15 +224,36 @@ function main() {
             role,
             worktree_root: worktreeRoot,
         });
+        writeAuditRecord(buildAuditRecord('blocked', 'denylist', 'E_GIT_OP_BLOCKED', subcommand, remainingArgs, {
+            flag: denied.flag ?? '',
+            reason: denied.reason,
+        }));
+        process.exit(BLOCKED_EXIT_CODE);
+        return;
+    }
+    if (denied && (allowBranchOps || allowGit)) {
+        process.stderr.write(`[git-shim] WARNING: ${allowBranchOps ? 'CLEO_ALLOW_BRANCH_OPS' : 'CLEO_ALLOW_GIT'}=1 ` +
+            `bypassed denylist for 'git ${subcommand}' (role=${role}). This bypass is audited.\n`);
+        writeAuditRecord(buildAuditRecord('bypassed-allow-git', 'denylist', 'E_GIT_OP_BLOCKED', subcommand, remainingArgs, { flag: denied.flag ?? '', reason: denied.reason }));
+    }
+    // ---------------------------------------------------------------------------
+    // Layer 2 — T1591 boundary fence (a/b/c/d).
+    // ---------------------------------------------------------------------------
+    const violation = evaluateBoundaries(subcommand, remainingArgs);
+    if (violation && !allowGit) {
+        emitBoundaryViolation(violation, subcommand);
+        writeAuditRecord(buildAuditRecord('blocked', violation.boundary, violation.code, subcommand, remainingArgs, violation.context));
         process.exit(BLOCKED_EXIT_CODE);
         return;
     }
-    if (denied && allowBranchOps) {
-        // Escape hatch used — log an audit warning.
-        process.stderr.write(`[git-shim] WARNING: CLEO_ALLOW_BRANCH_OPS=1 bypassed block for ` +
-            `'git ${subcommand}' (role=${role}). This bypass is audited.\n`);
+    if (violation && allowGit) {
+        process.stderr.write(`[git-shim] WARNING: CLEO_ALLOW_GIT=1 bypassed boundary ${violation.boundary} ` +
+            `(${violation.code}) for 'git ${subcommand}' (role=${role}). This bypass is audited.\n`);
+        writeAuditRecord(buildAuditRecord('bypassed-allow-git', violation.boundary, violation.code, subcommand, remainingArgs, violation.context));
     }
+    // ---------------------------------------------------------------------------
     // Pass through to real git.
+    // ---------------------------------------------------------------------------
     const realGit = resolveRealGit();
     if (!realGit) {
         process.stderr.write('[git-shim] ERROR: real git binary not found on PATH\n');

package/dist/shim.js.map

@@ -1 +1 @@
-{"version":3,"file":"shim.js","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc;IACrB,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,oBAAoB,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,sDAAsD;QACtD,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IAClF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,OAA+B;IACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,UAAU,EAAE,IAAI;QAChB,IAAI;QACJ,OAAO;QACP,GAAG,OAAO;KACX,CAAC,GAAG,IAAI,CACV,CAAC;IACF,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,OAAO,IAAI;QAChC,+DAA+D,CAClE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,0EAA0E;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAE5B,gEAAgE;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;IAEpE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEvD,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,WAAW,CAAC;QACtE,gBAAgB,CACd,kBAAkB,EAClB,OAAO,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,6BAA6B,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,EAC9G;YACE,UAAU;YACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,IAAI;YACJ,aAAa,EAAE,YAAY;SAC5B,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,4CAA4C;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iEAAiE;YAC/D,QAAQ,UAAU,WAAW,IAAI,8BAA8B,CAClE,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"shim.js","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAEL,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,oBAAoB,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IAClF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,OAA+B;IACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,UAAU,EAAE,IAAI;QAChB,IAAI;QACJ,OAAO;QACP,GAAG,OAAO;KACX,CAAC,IAAI,CACP,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,SAA4B,EAAE,UAAkB;IAC7E,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE;QAClD,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,UAAU;QACV,GAAG,SAAS,CAAC,OAAO;KACrB,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,UAAkB,EAAE,IAAc;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE1C,6EAA6E;IAC7E,IAAI,UAAU,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,oDAAoD;IACpD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE;YACnC,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,0DAA0D;IAC1D,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CACvB,OAA+B,EAC/B,QAAiC,EACjC,IAAY,EACZ,UAAkB,EAClB,IAAc,EACd,OAA+B;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,OAAO;QACP,QAAQ;QACR,IAAI;QACJ,UAAU;QACV,IAAI;QACJ,GAAG;QACH,aAAa,EAAE,MAAM,EAAE,YAAY,IAAI,IAAI;QAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI;QAC/B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAC5C,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,0EAA0E;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAE5B,gEAAgE;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC;IAEvD,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,MAAM,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,WAAW,CAAC;QACtE,gBAAgB,CACd,kBAAkB,EAClB,OAAO,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,6BAA6B,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,EAC9G;YACE,UAAU;YACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,IAAI;YACJ,aAAa,EAAE,YAAY;SAC5B,CACF,CAAC;QACF,gBAAgB,CACd,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE;YACrF,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CACH,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,KAAK;YACrF,8BAA8B,UAAU,WAAW,IAAI,8BAA8B,CACxF,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CACnD,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4CAA4C;IAC5C,8EAA8E;IAC9E,MAAM,SAAS,GAAG,kBAAkB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAChE,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,qBAAqB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7C,gBAAgB,CACd,gBAAgB,CACd,SAAS,EACT,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,IAAI,EACd,UAAU,EACV,aAAa,EACb,SAAS,CAAC,OAAO,CAClB,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,SAAS,CAAC,QAAQ,GAAG;YAC7E,IAAI,SAAS,CAAC,IAAI,cAAc,UAAU,WAAW,IAAI,8BAA8B,CAC1F,CAAC;QACF,gBAAgB,CACd,gBAAgB,CACd,oBAAoB,EACpB,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,IAAI,EACd,UAAU,EACV,aAAa,EACb,SAAS,CAAC,OAAO,CAClB,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4BAA4B;IAC5B,8EAA8E;IAC9E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/worktree-path.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Compute the canonical worktrees-by-project root used by CLEO.
+ *
+ * @returns Absolute path to `<XDG>/cleo/worktrees/`.
+ *
+ * @task T1591
+ */
+export declare function resolveCleoWorktreesRoot(): string;
+/**
+ * Compute the per-project worktree root.
+ *
+ * @param projectRoot - Absolute path to the project.
+ * @returns Absolute path to `<XDG>/cleo/worktrees/<projectHash>/`.
+ *
+ * @task T1591
+ */
+export declare function resolveProjectWorktreeRoot(projectRoot: string): string;
+/**
+ * Check whether the given path is inside the canonical worktrees tree.
+ *
+ * Project-agnostic: matches the global worktrees root, not a specific project.
+ *
+ * @param cwdPath - Absolute path to check.
+ * @returns true if the path is inside `<XDG>/cleo/worktrees/`.
+ *
+ * @task T1591
+ */
+export declare function isInsideWorktreesRoot(cwdPath: string): boolean;
+/**
+ * Extract the task ID from a worktree path.
+ *
+ * Path layout: `<XDG>/cleo/worktrees/<projectHash>/<taskId>/...`
+ * The taskId is the path segment immediately after the projectHash.
+ *
+ * @param cwdPath - Absolute path inside a worktree.
+ * @returns The task ID segment, or null if the path is not inside the worktrees root.
+ *
+ * @task T1591
+ */
+export declare function extractTaskIdFromWorktreePath(cwdPath: string): string | null;
+/**
+ * Resolve the agent worktree boundary for the current shim invocation.
+ *
+ * Strategy (in order):
+ * 1. `CLEO_WORKTREE_ROOT` env — explicit worktree path injected by the spawn prompt.
+ * 2. Walk up from `cwd` until a directory under `<XDG>/cleo/worktrees/<projectHash>/<taskId>/`
+ *    is found.
+ * 3. Return null when not inside any worktree.
+ *
+ * @param cwd - Working directory at shim invocation time.
+ * @returns The worktree root path + task ID, or null when not inside a worktree.
+ *
+ * @task T1591
+ */
+export declare function resolveActiveWorktree(cwd: string): {
+    worktreePath: string;
+    taskId: string;
+} | null;
+/**
+ * Check whether an absolute path lives inside the given worktree.
+ *
+ * @param targetPath - Absolute path to test.
+ * @param worktreePath - Absolute path to the worktree root.
+ * @returns true if `targetPath` is the worktree or a descendant.
+ *
+ * @task T1591
+ */
+export declare function isPathInsideWorktree(targetPath: string, worktreePath: string): boolean;
+//# sourceMappingURL=worktree-path.d.ts.map

package/dist/worktree-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-path.d.ts","sourceRoot":"","sources":["../src/worktree-path.ts"],"names":[],"mappings":"AAqBA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAGjD;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGtE;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,GACV;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA+BjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAItF"}

package/dist/worktree-path.js

@@ -0,0 +1,146 @@
+/**
+ * Worktree-path resolution for the git-shim (T1591 L2 boundary fence).
+ *
+ * Mirrors `@cleocode/core::resolveAgentWorktreeRoot` so the shim can decide
+ * "is this `cwd` inside an agent worktree?" without taking a runtime
+ * dependency on `@cleocode/core` (the shim must stay lean — it spawns on every
+ * git invocation).
+ *
+ * The shim resolves the worktree root via XDG env-paths convention:
+ *   `$XDG_DATA_HOME/cleo/worktrees/<projectHash>/<taskId>/`
+ *   fallback: `~/.local/share/cleo/worktrees/<projectHash>/<taskId>/`
+ *
+ * `<projectHash>` is sha256(projectRoot)[:16].
+ *
+ * @task T1591
+ * @adr ADR-062
+ */
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { isAbsolute, join, normalize, resolve } from 'node:path';
+/**
+ * Compute the canonical worktrees-by-project root used by CLEO.
+ *
+ * @returns Absolute path to `<XDG>/cleo/worktrees/`.
+ *
+ * @task T1591
+ */
+export function resolveCleoWorktreesRoot() {
+    const xdgData = process.env['XDG_DATA_HOME'] ?? join(homedir(), '.local', 'share');
+    return join(xdgData, 'cleo', 'worktrees');
+}
+/**
+ * Compute the per-project worktree root.
+ *
+ * @param projectRoot - Absolute path to the project.
+ * @returns Absolute path to `<XDG>/cleo/worktrees/<projectHash>/`.
+ *
+ * @task T1591
+ */
+export function resolveProjectWorktreeRoot(projectRoot) {
+    const projectHash = createHash('sha256').update(projectRoot).digest('hex').slice(0, 16);
+    return join(resolveCleoWorktreesRoot(), projectHash);
+}
+/**
+ * Check whether the given path is inside the canonical worktrees tree.
+ *
+ * Project-agnostic: matches the global worktrees root, not a specific project.
+ *
+ * @param cwdPath - Absolute path to check.
+ * @returns true if the path is inside `<XDG>/cleo/worktrees/`.
+ *
+ * @task T1591
+ */
+export function isInsideWorktreesRoot(cwdPath) {
+    const worktreesRoot = resolveCleoWorktreesRoot();
+    const normalized = resolve(cwdPath);
+    const normalizedRoot = resolve(worktreesRoot);
+    return (normalized === normalizedRoot ||
+        normalized.startsWith(`${normalizedRoot}/`) ||
+        normalized.startsWith(`${normalizedRoot}\\`));
+}
+/**
+ * Extract the task ID from a worktree path.
+ *
+ * Path layout: `<XDG>/cleo/worktrees/<projectHash>/<taskId>/...`
+ * The taskId is the path segment immediately after the projectHash.
+ *
+ * @param cwdPath - Absolute path inside a worktree.
+ * @returns The task ID segment, or null if the path is not inside the worktrees root.
+ *
+ * @task T1591
+ */
+export function extractTaskIdFromWorktreePath(cwdPath) {
+    const worktreesRoot = resolveCleoWorktreesRoot();
+    const normalized = resolve(cwdPath);
+    const normalizedRoot = resolve(worktreesRoot);
+    if (!normalized.startsWith(`${normalizedRoot}/`) &&
+        !normalized.startsWith(`${normalizedRoot}\\`)) {
+        return null;
+    }
+    const remainder = normalized.slice(normalizedRoot.length + 1);
+    const segments = remainder.split(/[/\\]/).filter(Boolean);
+    // segments = [projectHash, taskId, ...rest]
+    if (segments.length < 2)
+        return null;
+    return segments[1] ?? null;
+}
+/**
+ * Resolve the agent worktree boundary for the current shim invocation.
+ *
+ * Strategy (in order):
+ * 1. `CLEO_WORKTREE_ROOT` env — explicit worktree path injected by the spawn prompt.
+ * 2. Walk up from `cwd` until a directory under `<XDG>/cleo/worktrees/<projectHash>/<taskId>/`
+ *    is found.
+ * 3. Return null when not inside any worktree.
+ *
+ * @param cwd - Working directory at shim invocation time.
+ * @returns The worktree root path + task ID, or null when not inside a worktree.
+ *
+ * @task T1591
+ */
+export function resolveActiveWorktree(cwd) {
+    // Explicit env-driven path wins.
+    const envWorktree = process.env['CLEO_WORKTREE_ROOT'];
+    if (envWorktree && isAbsolute(envWorktree)) {
+        const taskId = process.env['CLEO_TASK_ID'] ?? extractTaskIdFromWorktreePath(envWorktree);
+        if (taskId) {
+            return { worktreePath: resolve(envWorktree), taskId };
+        }
+    }
+    // Walk up from cwd until we find a path that matches the worktree layout.
+    if (!isInsideWorktreesRoot(cwd))
+        return null;
+    const worktreesRoot = resolve(resolveCleoWorktreesRoot());
+    let candidate = resolve(cwd);
+    // Climb until parent is the projectHash directory (one level under worktreesRoot).
+    while (candidate !== '/' && candidate.length > worktreesRoot.length) {
+        const parent = normalize(join(candidate, '..'));
+        // parent should be `<worktreesRoot>/<projectHash>`.
+        if (parent.startsWith(`${worktreesRoot}/`) &&
+            parent.split(/[/\\]/).filter(Boolean).length ===
+                worktreesRoot.split(/[/\\]/).filter(Boolean).length + 1) {
+            const taskId = candidate.split(/[/\\]/).pop() ?? '';
+            return taskId ? { worktreePath: candidate, taskId } : null;
+        }
+        if (parent === candidate)
+            break;
+        candidate = parent;
+    }
+    return null;
+}
+/**
+ * Check whether an absolute path lives inside the given worktree.
+ *
+ * @param targetPath - Absolute path to test.
+ * @param worktreePath - Absolute path to the worktree root.
+ * @returns true if `targetPath` is the worktree or a descendant.
+ *
+ * @task T1591
+ */
+export function isPathInsideWorktree(targetPath, worktreePath) {
+    const t = resolve(targetPath);
+    const w = resolve(worktreePath);
+    return t === w || t.startsWith(`${w}/`) || t.startsWith(`${w}\\`);
+}
+//# sourceMappingURL=worktree-path.js.map

package/dist/worktree-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-path.js","sourceRoot":"","sources":["../src/worktree-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,wBAAwB,EAAE,EAAE,WAAW,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,aAAa,GAAG,wBAAwB,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,CACL,UAAU,KAAK,cAAc;QAC7B,UAAU,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC;QAC3C,UAAU,CAAC,UAAU,CAAC,GAAG,cAAc,IAAI,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,aAAa,GAAG,wBAAwB,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,IACE,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC;QAC5C,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,cAAc,IAAI,CAAC,EAC7C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,4CAA4C;IAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW;IAEX,iCAAiC;IACjC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACtD,IAAI,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,6BAA6B,CAAC,WAAW,CAAC,CAAC;QACzF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,aAAa,GAAG,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC1D,IAAI,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,mFAAmF;IACnF,OAAO,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,oDAAoD;QACpD,IACE,MAAM,CAAC,UAAU,CAAC,GAAG,aAAa,GAAG,CAAC;YACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM;gBAC1C,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EACzD,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,YAAoB;IAC3E,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/git-shim",
-  "version": "2026.4.154",
+  "version": "2026.4.158",
   "private": false,
   "type": "module",
   "description": "Harness-agnostic git shim for CLEO agent branch-protection (T1118)",
@@ -32,7 +32,7 @@
   "author": "CLEO Code <hello@cleocode.dev>",
   "license": "MIT",
   "dependencies": {
-    "@cleocode/contracts": "2026.4.154"
+    "@cleocode/contracts": "2026.4.158"
   },
   "devDependencies": {
     "@types/node": "^24.3.0",