@delegance/claude-autopilot 7.4.3 → 7.6.0

package/CHANGELOG.md

@@ -2,6 +2,152 @@
 
 - v5.6 Phase 7 (docs reconciliation) — pending.
 
+## 7.6.0 (2026-05-10)
+
+**v7.6.0 — Go scaffold support.** Minor release. Promotes Go from
+"detected-but-unsupported" (exit 3 in v7.4/v7.5) to a first-class
+scaffold target, matching the Node + Python + FastAPI shape.
+
+**New:** `claude-autopilot scaffold --from-spec <spec.md> --stack go`
+(or auto-detected when the spec's `## Files` section lists `go.mod`
+or `main.go`).
+
+Generates for a basic spec:
+
+- `go.mod` — `module <basename(cwd)>` + `go 1.22`, with an inline
+  comment documenting that the module path is the local-scaffold
+  default and should be replaced with the full hosted path
+  (e.g. `github.com/<user>/<name>`) before publishing.
+- `main.go` — `package main` + Hello world (skipped when the spec
+  uses a `cmd/<name>/main.go` layout).
+- `main_test.go` — `TestSmoke` stub for table-driven tests.
+- `.gitignore` — idempotent augmentation: appends `vendor/`,
+  `*.exe`, `*.test` if not already present.
+
+**Name normalization.** `basename(cwd)` lowercased, whitespace
+collapsed to `-`. Dots + hyphens preserved (valid Go module path
+chars). Path-invalid characters (`/`, `\`, control bytes) reject
+with a clear error.
+
+**Never overwrites.** `go.mod`, `main.go`, `main_test.go`, and
+existing `.gitignore` entries are preserved — matches the Python
+scaffolder pattern.
+
+**Polyglot detection (codex CRITICAL pass-1).** `detectStack()` now
+scans `## Files` for ALL supported stack signals (Node, Python, Go)
+and exits 3 with `polyglot spec — pass --stack to disambiguate` when
+more than one supported stack is present. Previously the check was
+Node-vs-Python only; v7.6 closes the gap so e.g. `package.json` +
+`go.mod` together correctly fail-loud instead of silently picking one.
+
+**`--list-stacks`** now shows Go under Supported and drops it from
+Recognized-but-unsupported. Rust + Ruby remain detection-only; the
+Rust scaffolder is deferred to **v7.7.0** (out of scope here).
+
+**Rust deferred.** `Cargo.toml` still exits 3 ("rust detected but
+not supported until v7.7"). Targeted for v7.7.0 alongside the same
+shape (Cargo.toml + `src/main.rs` + a smoke test).
+
+## 7.5.0 (2026-05-10)
+
+**v7.5.0 — route-sensitivity-tiered membership revocation.** Minor
+release. Closes W4 from the v7.4.1 codex strategic review without
+adding infrastructure (Redis / Realtime / KV all rejected — see
+`docs/specs/v7.5.0-route-sensitivity.md` for the trade-off analysis).
+
+**Problem.** v7.0 Phase 6 caches `check_membership_status` for 60s
+in an HMAC-signed cookie. Worst-case revocation window = 60s for
+EVERY dashboard request, including admin-class mutations and
+sensitive reads where ≤1-request revocation is the bar.
+
+**Solution.** Split the policy by route sensitivity instead of
+tightening globally:
+
+| Tier | Revocation window | Behavior |
+|---|---|---|
+| LOW (default) | ≤60s | v7.0 cookie cache (no change) |
+| HIGH (mutations + sensitive reads) | ≤1 request | Skip cookie, always RPC |
+
+HIGH list (locked in code, codex-reviewed): mutations on any
+`/api/dashboard/*` route + GETs under
+`/api/dashboard/orgs/:id/{audit,cost,cost.csv,sso/**,members/**,billing/**}`
++ all `/api/dashboard/api-keys/*` (including GET — codex pass-2 W4
+flagged the listing as sensitive).
+
+**Defense in depth (codex pass-2 CRITICAL #3).** Middleware regex
+matching is brittle — a new sensitive handler that's not yet in
+`HIGH_SENSITIVITY_PATTERNS` would default to LOW. Mitigation: every
+high-sensitivity route handler now calls
+`assertActiveMembershipForOrg()` at the top as the inner correctness
+gate. Middleware is the outer optimization (skips the cookie cache);
+the handler call is the inner gate (doesn't depend on the regex
+list staying in sync).
+
+**Path-vs-active-org assertion (codex pass-2 CRITICAL #2).** For
+high-sensitivity org-scoped routes the middleware also extracts
+`:orgId` from the request path and asserts it matches the
+`cao_active_org` cookie. A user active in Org A reaching an Org B
+URL gets a 403/302 immediately — defense against a sloppy
+downstream handler.
+
+**New files:**
+
+- `apps/web/lib/middleware/route-sensitivity.ts` (~85 LOC) —
+  `HIGH_SENSITIVITY_PATTERNS` + `isHighSensitivityRoute()`.
+- `apps/web/lib/dashboard/assert-active-membership-for-org.ts`
+  (~165 LOC) — defense-in-depth helper + `respondToMembershipError()`
+  response builder.
+- `apps/web/__tests__/middleware/route-sensitivity.test.ts` (24
+  cases — spec list of 7 + non-GET coverage + boundary regex tests
+  for codex pass-2 W4/W5).
+- `apps/web/__tests__/middleware/revocation-integration.test.ts`
+  (8 cases — disabled-with-fresh-cookie + low-tier cache-still-wins
+  + helper error-mapping integration).
+- `apps/web/__tests__/lib/dashboard/assert-active-membership-for-org.test.ts`
+  (16 cases — 4 error codes + happy path + UUID validation +
+  respondToMembershipError variants).
+
+**Modified files:**
+
+- `apps/web/middleware.ts` — sensitivity branch BEFORE cookie verify;
+  parseOrgIdFromPath check on high-sensitivity routes; skip cookie
+  mint on high-sensitivity success.
+- 10 route handlers wired with `assertActiveMembershipForOrg()` as
+  the first authorization step (members CRUD + invite + enable +
+  disable; org PATCH; audit; cost JSON + CSV; SSO disconnect +
+  required + setup + domains + verify).
+
+**Test regressions promoted to v7.5.0 expectations:** 8 existing
+tests that asserted the OLD pre-helper behavior (non-member → 404
+via RPC's `not_admin`, disabled-user → `not_owner`/`not_admin`) now
+assert the NEW uniform helper behavior (non-member → 403
+`no_membership`; disabled-user → 403 `member_disabled`). Status
+codes unchanged for the disabled-user cases; status code for
+non-member shifted from 404 → 403 with a non-enumerating body code.
+Comments inline in each updated test point at this v7.5.0 trade-off.
+
+**Test count:** 621 → 669 (+48 web). CLI suite unchanged at 1606
+(no CLI changes).
+
+**Codex traceability:**
+
+| Finding | Resolution |
+|---|---|
+| Pass-1 C1 (W4 not closed) | Reframed: route-tier closes the security/compliance subset of W4. |
+| Pass-1 C2 (Vercel/ECS confusion) | False positive — explicit deployment-context section in spec. |
+| Pass-1 W1 (Redis ROI) | False positive — autopilot.dev has no Redis. |
+| Pass-1 W3 (route-sensitivity split) | **Adopted as the central design.** |
+| Pass-2 CRITICAL #2 (path-vs-activeOrg) | `parseOrgIdFromPath` + middleware assertion. |
+| Pass-2 CRITICAL #3 (regex bypass risk) | `assertActiveMembershipForOrg()` defense-in-depth helper called at top of every HIGH handler. |
+| Pass-2 W4 (api-keys GET sensitivity) | `/api/dashboard/api-keys/*` (including GET) added to HIGH list. |
+| Pass-2 W5 (boundary pattern correctness) | Anchored regex with explicit `/`/`$` terminator; tests cover `/costume`, `/auditor`, trailing-slash, nested-path. |
+
+**Out of scope.** Vercel KV / Realtime websocket (deferred), JWT-
+side revocation (v7.1 already collapses ingest to ≤1 request),
+configurable sensitivity classification (locked in code on purpose),
+wrapper `withActiveMembershipRequired()` decorator (deferred to
+v7.6+ refactor; the explicit call is sufficient for v7.5.0).
+
 ## 7.4.3 (2026-05-11)
 
 **v7.4.3 — FastAPI scaffold respects spec-derived package name.**

package/dist/src/cli/help-text.js

@@ -28,7 +28,7 @@ export const HELP_GROUPS = [
         verbs: [
             { verb: 'init', summary: 'Scaffold guardrail.config.yaml + auto-detect migrate stack (writes .autopilot/stack.md)' },
             { verb: 'setup', summary: 'Auto-detect stack, write config, install pre-push hook' },
-            { verb: 'scaffold', summary: 'Scaffold project skeleton from a spec markdown (--from-spec <path> [--stack node|python|fastapi])' },
+            { verb: 'scaffold', summary: 'Scaffold project skeleton from a spec markdown (--from-spec <path> [--stack node|python|fastapi|go])' },
             { verb: 'autopilot', summary: 'Multi-phase orchestrator — run scan → spec → plan → implement under one runId (v6.2.0)' },
             { verb: 'brainstorm', summary: 'Pipeline entry point (Claude Code skill — see /brainstorm)' },
             { verb: 'spec', summary: 'Spec-writing pointer (Claude Code skill — see /brainstorm)' },

package/dist/src/cli/index.js

@@ -934,6 +934,7 @@ switch (subcommand) {
     case 'scaffold': {
         // v7.2.0 — `claude-autopilot scaffold --from-spec <path>`
         // v7.4.0 — `--stack <node|python|fastapi>` + `--list-stacks`.
+        // v7.6.0 — `--stack go`.
         if (boolFlag('list-stacks')) {
             const { printStackList } = await import("./scaffold.js");
             printStackList();
@@ -942,8 +943,8 @@ switch (subcommand) {
         const fromSpec = flag('from-spec');
         const dryRun = boolFlag('dry-run');
         const stackArg = flag('stack');
-        if (stackArg && !['node', 'python', 'fastapi'].includes(stackArg)) {
-            console.error(`\x1b[31m[claude-autopilot] --stack "${stackArg}" not recognized — supported: node, python, fastapi\x1b[0m`);
+        if (stackArg && !['node', 'python', 'fastapi', 'go'].includes(stackArg)) {
+            console.error(`\x1b[31m[claude-autopilot] --stack "${stackArg}" not recognized — supported: node, python, fastapi, go\x1b[0m`);
             console.error(`  See: claude-autopilot scaffold --list-stacks`);
             process.exit(3);
         }

package/dist/src/cli/scaffold/go.d.ts

@@ -0,0 +1,27 @@
+import type { ScaffoldResult, ScaffoldRunContext } from './types.ts';
+/**
+ * Normalize a basename into a valid Go module name.
+ *
+ * - lowercased
+ * - whitespace runs collapse to a single `-`
+ * - dots + hyphens preserved (Go modules allow them)
+ * - empty result falls back to `app`
+ *
+ * Throws on path-invalid characters (`/`, `\`, NUL, other control chars) —
+ * the caller is expected to surface this as a scaffold error.
+ */
+export declare function normalizeGoModuleName(raw: string): string;
+/** Build the go.mod body. Inline comment documents the local-default. */
+export declare function buildGoMod(moduleName: string): string;
+/** Build main.go body — minimal Hello world package. */
+export declare function buildMainGo(): string;
+/** Build main_test.go body — table-test friendly smoke test. */
+export declare function buildMainTestGo(): string;
+/**
+ * Augment `.gitignore` with Go-standard ignores. Idempotent: if `vendor/`
+ * already appears the second invocation leaves it alone. Creates the file
+ * if it doesn't exist.
+ */
+export declare function augmentGitignore(existing: string | null): string;
+export declare function scaffoldGo(ctx: ScaffoldRunContext): Promise<ScaffoldResult>;
+//# sourceMappingURL=go.d.ts.map

package/dist/src/cli/scaffold/go.js

@@ -0,0 +1,225 @@
+// v7.6.0 — Go scaffolder.
+//
+// Mirrors the Python scaffolder shape:
+//   - single `scaffoldGo()` exported entrypoint
+//   - pure-function helpers (name normalization, builders) for unit tests
+//   - never overwrites existing files (matches `· exists` log pattern)
+//   - tracks filesCreated / dirsCreated / filesSkippedExisting for return
+//
+// Output for a basic spec (`## Files` listing go.mod + main.go + main_test.go):
+//   - go.mod with `module <basename(cwd)>` and `go 1.22`. Inline comment
+//     documents the local-scaffold-default per codex NOTE (not a real
+//     hosted module path — users override before publishing).
+//   - main.go: package main + Hello world (only when not under cmd/<name>/)
+//   - main_test.go: smoke test
+//   - .gitignore augmentation: appends `vendor/`, `*.exe`, `*.test`
+//     idempotently — if already present, leaves them alone.
+//
+// Name normalization: lowercased basename(cwd), whitespace -> `-`. Dots and
+// hyphens preserved (Go module paths permit them). Path-invalid chars
+// (`/`, `\`, control chars) are rejected with a clear error.
+import * as fs from 'node:fs';
+import * as fsAsync from 'node:fs/promises';
+import * as path from 'node:path';
+const PASS = '\x1b[32m✓\x1b[0m';
+const SKIP = '\x1b[2m·\x1b[0m';
+const DIM = (t) => `\x1b[2m${t}\x1b[0m`;
+/**
+ * Normalize a basename into a valid Go module name.
+ *
+ * - lowercased
+ * - whitespace runs collapse to a single `-`
+ * - dots + hyphens preserved (Go modules allow them)
+ * - empty result falls back to `app`
+ *
+ * Throws on path-invalid characters (`/`, `\`, NUL, other control chars) —
+ * the caller is expected to surface this as a scaffold error.
+ */
+export function normalizeGoModuleName(raw) {
+    // eslint-disable-next-line no-control-regex
+    if (/[\/\\\x00-\x1f]/.test(raw)) {
+        throw new Error(`invalid Go module name "${raw}" — path/control characters not allowed`);
+    }
+    const lower = raw.toLowerCase();
+    const collapsed = lower.replace(/\s+/g, '-');
+    return collapsed.length > 0 ? collapsed : 'app';
+}
+/** Build the go.mod body. Inline comment documents the local-default. */
+export function buildGoMod(moduleName) {
+    return `// NOTE: module name is the local-scaffold default (basename of cwd).
+// Replace with your full module path (e.g. github.com/<user>/${moduleName})
+// before publishing or running \`go install\`.
+module ${moduleName}
+
+go 1.22
+`;
+}
+/** Build main.go body — minimal Hello world package. */
+export function buildMainGo() {
+    return [
+        'package main',
+        '',
+        'import "fmt"',
+        '',
+        'func main() {',
+        '\tfmt.Println("Hello, world!")',
+        '}',
+        '',
+    ].join('\n');
+}
+/** Build main_test.go body — table-test friendly smoke test. */
+export function buildMainTestGo() {
+    return [
+        'package main',
+        '',
+        'import "testing"',
+        '',
+        'func TestSmoke(t *testing.T) {',
+        '\t// Smoke test scaffolded by claude-autopilot. Replace with real',
+        '\t// table-driven cases for your package under test.',
+        '}',
+        '',
+    ].join('\n');
+}
+/** Lines to append to .gitignore. Idempotent — only adds missing entries. */
+const GO_GITIGNORE_LINES = ['vendor/', '*.exe', '*.test'];
+/**
+ * Augment `.gitignore` with Go-standard ignores. Idempotent: if `vendor/`
+ * already appears the second invocation leaves it alone. Creates the file
+ * if it doesn't exist.
+ */
+export function augmentGitignore(existing) {
+    const lines = existing ? existing.split('\n') : [];
+    const present = new Set(lines.map(l => l.trim()));
+    const toAdd = GO_GITIGNORE_LINES.filter(l => !present.has(l));
+    if (toAdd.length === 0)
+        return existing ?? '';
+    const prefix = existing && !existing.endsWith('\n') ? existing + '\n' : (existing ?? '');
+    return prefix + toAdd.join('\n') + '\n';
+}
+/**
+ * True when the spec lists ONLY a `cmd/<name>/main.go` style entrypoint
+ * (no top-level main.go). In that case we skip generating the top-level
+ * main.go — the spec author intends the cmd/ layout.
+ */
+function specHasCmdMainOnly(paths) {
+    const hasTopMain = paths.includes('main.go');
+    const hasCmdMain = paths.some(p => /^cmd\/[^/]+\/main\.go$/.test(p));
+    return hasCmdMain && !hasTopMain;
+}
+export async function scaffoldGo(ctx) {
+    const { cwd, parsed, dryRun } = ctx;
+    const moduleName = normalizeGoModuleName(path.basename(cwd));
+    const filesCreated = [];
+    const filesSkippedExisting = [];
+    const dirsCreated = [];
+    // Files we generate with content rather than empty placeholders.
+    const MANAGED_FILES = new Set(['go.mod', 'main.go', 'main_test.go', '.gitignore']);
+    // 1) Create directories implied by spec paths.
+    const dirs = new Set();
+    for (const p of parsed.paths) {
+        const d = path.dirname(p);
+        if (d && d !== '.')
+            dirs.add(d);
+    }
+    for (const d of dirs) {
+        const abs = path.join(cwd, d);
+        if (fs.existsSync(abs))
+            continue;
+        if (!dryRun)
+            await fsAsync.mkdir(abs, { recursive: true });
+        dirsCreated.push(d);
+        console.log(`  ${PASS}  mkdir   ${DIM(d + '/')}`);
+    }
+    // 2) Empty-placeholder pass for spec paths we don't manage.
+    for (const p of parsed.paths) {
+        if (MANAGED_FILES.has(p))
+            continue;
+        const abs = path.join(cwd, p);
+        if (fs.existsSync(abs)) {
+            filesSkippedExisting.push(p);
+            console.log(`  ${SKIP}  exists  ${DIM(p)}`);
+            continue;
+        }
+        if (!dryRun) {
+            await fsAsync.mkdir(path.dirname(abs), { recursive: true });
+            await fsAsync.writeFile(abs, '', 'utf8');
+        }
+        filesCreated.push(p);
+        console.log(`  ${PASS}  touch   ${DIM(p)}`);
+    }
+    // 3) go.mod — never overwrite.
+    const goModAbs = path.join(cwd, 'go.mod');
+    if (fs.existsSync(goModAbs)) {
+        filesSkippedExisting.push('go.mod');
+        console.log(`  ${SKIP}  exists  ${DIM('go.mod (preserved)')}`);
+    }
+    else {
+        if (!dryRun)
+            await fsAsync.writeFile(goModAbs, buildGoMod(moduleName), 'utf8');
+        filesCreated.push('go.mod');
+        console.log(`  ${PASS}  write   ${DIM(`go.mod (module ${moduleName}, go 1.22)`)}`);
+    }
+    // 4) main.go — only if the spec doesn't push us to a cmd/<name>/ layout.
+    const cmdOnly = specHasCmdMainOnly(parsed.paths);
+    if (!cmdOnly) {
+        const mainAbs = path.join(cwd, 'main.go');
+        if (fs.existsSync(mainAbs)) {
+            filesSkippedExisting.push('main.go');
+            console.log(`  ${SKIP}  exists  ${DIM('main.go (preserved)')}`);
+        }
+        else {
+            if (!dryRun)
+                await fsAsync.writeFile(mainAbs, buildMainGo(), 'utf8');
+            filesCreated.push('main.go');
+            console.log(`  ${PASS}  write   ${DIM('main.go (package main + Hello)')}`);
+        }
+    }
+    // 5) main_test.go — only when we also wrote main.go (same cmd-only guard).
+    if (!cmdOnly) {
+        const testAbs = path.join(cwd, 'main_test.go');
+        if (fs.existsSync(testAbs)) {
+            filesSkippedExisting.push('main_test.go');
+            console.log(`  ${SKIP}  exists  ${DIM('main_test.go (preserved)')}`);
+        }
+        else {
+            if (!dryRun)
+                await fsAsync.writeFile(testAbs, buildMainTestGo(), 'utf8');
+            filesCreated.push('main_test.go');
+            console.log(`  ${PASS}  write   ${DIM('main_test.go (TestSmoke stub)')}`);
+        }
+    }
+    // 6) .gitignore — idempotent augmentation.
+    const giAbs = path.join(cwd, '.gitignore');
+    const existing = fs.existsSync(giAbs) ? await fsAsync.readFile(giAbs, 'utf8') : null;
+    const augmented = augmentGitignore(existing);
+    if (existing === null) {
+        if (!dryRun)
+            await fsAsync.writeFile(giAbs, augmented, 'utf8');
+        filesCreated.push('.gitignore');
+        console.log(`  ${PASS}  write   ${DIM('.gitignore (vendor/, *.exe, *.test)')}`);
+    }
+    else if (augmented !== existing) {
+        if (!dryRun)
+            await fsAsync.writeFile(giAbs, augmented, 'utf8');
+        // Treat as "augmented" — not in skipped-existing (we modified it) and
+        // not in filesCreated (we didn't create a new file). For now we count
+        // it as filesCreated since the user sees a write. Tests assert
+        // idempotence on disk content, not on this return shape.
+        filesCreated.push('.gitignore');
+        console.log(`  ${PASS}  augment ${DIM('.gitignore (added Go ignores)')}`);
+    }
+    else {
+        filesSkippedExisting.push('.gitignore');
+        console.log(`  ${SKIP}  exists  ${DIM('.gitignore (Go entries already present)')}`);
+    }
+    return {
+        filesCreated,
+        dirsCreated,
+        filesSkippedExisting,
+        // Node-shape fields — Go scaffolder doesn't touch package.json/tsconfig.
+        packageJsonAction: 'skipped-exists',
+        tsconfigAction: 'skipped-no-ts',
+    };
+}
+//# sourceMappingURL=go.js.map

package/dist/src/cli/scaffold/types.d.ts

@@ -1,11 +1,11 @@
-/** Supported `--stack` values. v7.5+ will add 'go', 'rust', 'ruby'. */
-export type Stack = 'node' | 'python' | 'fastapi';
+/** Supported `--stack` values. v7.6 adds 'go'; v7.7+ will add 'rust'. */
+export type Stack = 'node' | 'python' | 'fastapi' | 'go';
 /**
  * Stacks we can DETECT but cannot scaffold yet. Detection still warns +
- * exits 3 so the operator gets a clear "v7.5" diagnostic instead of a
+ * exits 3 so the operator gets a clear "v7.7" diagnostic instead of a
  * silent fallback to Node, which would generate a wrong-language skeleton.
  */
-export type UnsupportedStack = 'go' | 'rust' | 'ruby';
+export type UnsupportedStack = 'rust' | 'ruby';
 export interface ParsedFiles {
     /** Raw paths extracted from the `## Files` section bullets. */
     paths: string[];

package/dist/src/cli/scaffold.d.ts

@@ -2,7 +2,7 @@ import { buildStarterPackageJson } from './scaffold/node.ts';
 import type { ParsedFiles, ScaffoldOptions, ScaffoldResult, Stack, UnsupportedStack } from './scaffold/types.ts';
 export { buildStarterPackageJson };
 export type { ScaffoldOptions, ScaffoldResult, ParsedFiles, Stack };
-/** Valid `--stack` argument values. v7.5+ adds 'go', 'rust', 'ruby'. */
+/** Valid `--stack` argument values. v7.6 adds 'go'; v7.7+ will add 'rust'. */
 export declare const SUPPORTED_STACKS: readonly Stack[];
 /** Stacks we DETECT-but-don't-support yet. Mapped to spec exit-3 messages. */
 export declare const UNSUPPORTED_STACK_FILES: Record<UnsupportedStack, string>;

package/dist/src/cli/scaffold.js

@@ -33,17 +33,17 @@ import * as fsAsync from 'node:fs/promises';
 import * as path from 'node:path';
 import { scaffoldNode, buildStarterPackageJson } from "./scaffold/node.js";
 import { scaffoldPython } from "./scaffold/python.js";
+import { scaffoldGo } from "./scaffold/go.js";
 const BOLD = (t) => `\x1b[1m${t}\x1b[0m`;
 const DIM = (t) => `\x1b[2m${t}\x1b[0m`;
 // Re-export types + the legacy buildStarterPackageJson so `src/index.ts` and
 // the existing tests/scaffold.test.ts (which imports from this module) keep
 // compiling without changes.
 export { buildStarterPackageJson };
-/** Valid `--stack` argument values. v7.5+ adds 'go', 'rust', 'ruby'. */
-export const SUPPORTED_STACKS = ['node', 'python', 'fastapi'];
+/** Valid `--stack` argument values. v7.6 adds 'go'; v7.7+ will add 'rust'. */
+export const SUPPORTED_STACKS = ['node', 'python', 'fastapi', 'go'];
 /** Stacks we DETECT-but-don't-support yet. Mapped to spec exit-3 messages. */
 export const UNSUPPORTED_STACK_FILES = {
-    go: 'go.mod',
     rust: 'Cargo.toml',
     ruby: 'Gemfile',
 };
@@ -215,8 +215,23 @@ export function detectStack(parsed, explicit) {
     const hasFastapiMention = parsed.packageHints.stackHint === 'fastapi';
     const hasPythonMarker = has('pyproject.toml') || has('requirements.txt');
     const hasNodeMarker = has('package.json');
-    // Polyglot guard (codex W3) — Node + Python without --stack.
-    if (hasNodeMarker && hasPythonMarker) {
+    // v7.6 — Go signal: `go.mod` OR a top-level / cmd-shaped `main.go`.
+    const hasGoMod = has('go.mod');
+    const hasMainGo = paths.some(p => p === 'main.go' || /^cmd\/[^/]+\/main\.go$/.test(p));
+    const hasGoMarker = hasGoMod || hasMainGo;
+    // v7.6 — Polyglot detection scans ALL supported stack signals at once.
+    // We collect each present stack and exit 3 if more than one supported
+    // stack is detected (e.g. Node + Go, Python + Go, Node + Python + Go).
+    // FastAPI is collapsed into Python for the polyglot count (they share
+    // pyproject.toml — not a real conflict).
+    const supportedSignals = [];
+    if (hasNodeMarker)
+        supportedSignals.push('node');
+    if (hasPythonMarker)
+        supportedSignals.push('python');
+    if (hasGoMarker)
+        supportedSignals.push('go');
+    if (supportedSignals.length > 1) {
         return {
             kind: 'polyglot',
             message: 'polyglot spec — pass --stack to disambiguate',
@@ -235,20 +250,23 @@ export function detectStack(parsed, explicit) {
     // Step 3: Python.
     if (hasPythonMarker)
         return { kind: 'resolved', stack: 'python' };
-    // Step 4: Node.
+    // Step 4: Go (v7.6).
+    if (hasGoMarker)
+        return { kind: 'resolved', stack: 'go' };
+    // Step 5: Node.
     if (hasNodeMarker)
         return { kind: 'resolved', stack: 'node' };
-    // Step 5: detected-but-unsupported (codex W2).
+    // Step 6: detected-but-unsupported (codex W2). Rust + Ruby still here.
     for (const [stack, file] of Object.entries(UNSUPPORTED_STACK_FILES)) {
         if (has(file)) {
             return {
                 kind: 'unsupported',
                 stack,
-                message: `${stack} detected but not supported until v7.5`,
+                message: `${stack} detected but not supported until v7.7`,
             };
         }
     }
-    // Step 6: fallback — Node ESM (preserves v7.2.0 default for ambiguous
+    // Step 7: fallback — Node ESM (preserves v7.2.0 default for ambiguous
     // specs that listed only paths with no root-marker file).
     return { kind: 'resolved', stack: 'node' };
 }
@@ -262,16 +280,17 @@ export function printStackList() {
     console.log('  node     Node 22 ESM (package.json + tsconfig.json)');
     console.log('  python   Python 3.11+ (pyproject.toml + hatchling + pytest)');
     console.log('  fastapi  Python + FastAPI (auto-includes fastapi + uvicorn[standard])');
+    console.log('  go       Go 1.22 (go.mod + main.go + main_test.go)');
     console.log('');
     console.log(BOLD('Auto-detected from `## Files`:'));
     console.log('  node     when `package.json` is listed');
     console.log('  python   when `pyproject.toml` or `requirements.txt` is listed');
     console.log('  fastapi  when `main.py` is listed AND a bullet mentions `fastapi`');
+    console.log('  go       when `go.mod` or `main.go` is listed');
     console.log('');
     console.log(BOLD('Recognized-but-unsupported (exit 3):'));
-    console.log('  go       v7.5  (would detect via go.mod)');
-    console.log('  rust     v7.5  (would detect via Cargo.toml)');
-    console.log('  ruby     v7.5+ (would detect via Gemfile)');
+    console.log('  rust     v7.7  (would detect via Cargo.toml)');
+    console.log('  ruby     v7.7+ (would detect via Gemfile)');
     console.log('');
 }
 export async function runScaffold(opts) {
@@ -305,34 +324,47 @@ export async function runScaffold(opts) {
     }
     const stack = detection.stack;
     console.log(`\n${BOLD('[scaffold]')} ${DIM(specAbs)} ${DIM(`(stack: ${stack})`)}\n`);
-    // codex W5 — when --stack <python|fastapi> is explicit and the spec
-    // ALSO lists Node files, warn + filter them out so the Python
-    // scaffolder doesn't try to touch them.
+    // codex W5 — when an explicit --stack is passed against a polyglot spec,
+    // strip the OTHER stack's marker files so the chosen scaffolder doesn't
+    // touch them as empty placeholders. v7.6 extends this to Go.
     let ignoredOtherStackFiles;
     let parsedForStack = parsed;
+    const NODE_FILES = new Set(['package.json', 'tsconfig.json']);
+    const PYTHON_FILES = new Set(['pyproject.toml', 'requirements.txt']);
+    const GO_FILES = new Set(['go.mod']);
     if (opts.stack && (stack === 'python' || stack === 'fastapi')) {
-        const NODE_FILES = new Set(['package.json', 'tsconfig.json']);
-        const ignored = parsed.paths.filter(p => NODE_FILES.has(p));
+        const toIgnore = new Set([...NODE_FILES, ...GO_FILES]);
+        const ignored = parsed.paths.filter(p => toIgnore.has(p));
         if (ignored.length > 0) {
             ignoredOtherStackFiles = ignored;
-            console.log(`  ${DIM(`! ignoring Node files (--stack ${stack}): ${ignored.join(', ')}`)}`);
+            console.log(`  ${DIM(`! ignoring non-Python files (--stack ${stack}): ${ignored.join(', ')}`)}`);
             parsedForStack = {
                 ...parsed,
-                paths: parsed.paths.filter(p => !NODE_FILES.has(p)),
+                paths: parsed.paths.filter(p => !toIgnore.has(p)),
             };
         }
     }
     else if (opts.stack === 'node') {
-        // Symmetric: when --stack node is forced and the spec also lists
-        // Python markers, drop them so we don't touch them as placeholders.
-        const PYTHON_FILES = new Set(['pyproject.toml', 'requirements.txt']);
-        const ignored = parsed.paths.filter(p => PYTHON_FILES.has(p));
+        const toIgnore = new Set([...PYTHON_FILES, ...GO_FILES]);
+        const ignored = parsed.paths.filter(p => toIgnore.has(p));
+        if (ignored.length > 0) {
+            ignoredOtherStackFiles = ignored;
+            console.log(`  ${DIM(`! ignoring non-Node files (--stack node): ${ignored.join(', ')}`)}`);
+            parsedForStack = {
+                ...parsed,
+                paths: parsed.paths.filter(p => !toIgnore.has(p)),
+            };
+        }
+    }
+    else if (opts.stack === 'go') {
+        const toIgnore = new Set([...NODE_FILES, ...PYTHON_FILES]);
+        const ignored = parsed.paths.filter(p => toIgnore.has(p));
         if (ignored.length > 0) {
             ignoredOtherStackFiles = ignored;
-            console.log(`  ${DIM(`! ignoring Python files (--stack node): ${ignored.join(', ')}`)}`);
+            console.log(`  ${DIM(`! ignoring non-Go files (--stack go): ${ignored.join(', ')}`)}`);
             parsedForStack = {
                 ...parsed,
-                paths: parsed.paths.filter(p => !PYTHON_FILES.has(p)),
+                paths: parsed.paths.filter(p => !toIgnore.has(p)),
             };
         }
     }
@@ -344,6 +376,9 @@ export async function runScaffold(opts) {
     else if (stack === 'fastapi') {
         result = await scaffoldPython(ctx, { isFastapi: true });
     }
+    else if (stack === 'go') {
+        result = await scaffoldGo(ctx);
+    }
     else {
         result = await scaffoldNode(ctx);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delegance/claude-autopilot",
-  "version": "7.4.3",
+  "version": "7.6.0",
   "type": "module",
   "publishConfig": {
     "tag": "next"