@dougharness/cli 1.0.1

package/node_modules/@dougharness/gates/.claude-plugin/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "doug-gates",
+  "displayName": "Doug Gates",
+  "version": "1.0.1",
+  "description": "Deterministic guardrails for Claude Code: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, a verification gate on Stop and on SubagentStop, a snapshot of the plan and session into the anchor before compaction and re-anchoring after it, and a run trace of subagents and tool calls. Configured by .doug/config.json.",
+  "author": {
+    "name": "Doug contributors"
+  },
+  "hooks": "./hooks/hooks.json"
+}

package/node_modules/@dougharness/gates/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Eric Schwartz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@dougharness/gates/hooks/hooks.json

@@ -0,0 +1,184 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/protect-paths.mjs\"",
+            "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/secret-scan.mjs\"",
+            "timeout": 5
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/guard-bash.mjs\"",
+            "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/secret-scan.mjs\"",
+            "timeout": 5
+          }
+        ]
+      },
+      {
+        "matcher": "WebFetch|WebSearch|Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/research-cap.mjs\"",
+            "timeout": 5
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/trace.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/format-on-edit.mjs\"",
+            "timeout": 30
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/edit-loop.mjs\"",
+            "timeout": 5
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/trace.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "InstructionsLoaded": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/trace.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "PermissionDenied": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/trace.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/stop-gate.mjs\"",
+            "timeout": 600
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "matcher": "compact|resume",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/reanchor.mjs\"",
+            "timeout": 5
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/session-start-baseline.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "PostCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/reanchor.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/trace.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/trace.mjs\"",
+            "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/stop-gate.mjs\"",
+            "timeout": 600
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/reanchor.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
+}

package/node_modules/@dougharness/gates/lib/agent-context.mjs

@@ -0,0 +1,111 @@
+// Worker context handoff (card worker-context-handoff, brief A): a subagent cannot be observed
+// compacting (PreCompact/PostCompact never fire inside one — research note
+// .doug/.state/research/worker-context-handoff.md), so this is graceful degradation, not compaction.
+// The measured signal is the worker's own transcript (subagents/agent-<agent_id>.jsonl): the last
+// assistant line's usage against its model's context window. Nothing here blocks; scripts/trace.mjs
+// uses it to notice a worker approaching its limit, and scripts/stop-gate.mjs uses it to refuse an
+// unearned partial claim.
+
+import { readFileSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+// The recorded transcript path for a hook input firing inside a subagent (agent_id present). Prefers
+// an explicit agent_transcript_path (as SubagentStop already carries), then a transcript_path that
+// already names the subagent's own file, then derives the documented layout
+// (<dirname of transcript_path>/<session_id>/subagents/agent-<agent_id>.jsonl). null without agent_id
+// or without any path to derive from — never a guess.
+export function agentTranscriptPath(input) {
+  if (!input || !input.agent_id) return null;
+  if (typeof input.agent_transcript_path === "string" && input.agent_transcript_path) return input.agent_transcript_path;
+  const tp = input.transcript_path;
+  if (typeof tp !== "string" || !tp) return null;
+  if (tp.endsWith(`agent-${input.agent_id}.jsonl`)) return tp;
+  return join(dirname(tp), String(input.session_id || ""), "subagents", `agent-${input.agent_id}.jsonl`);
+}
+
+// The context window for a model id: 1M for a Fable/Opus/Sonnet 5 model, 200k otherwise (an unknown
+// or missing model errs early, on the smaller window).
+export function windowFor(model) {
+  if (typeof model !== "string") return 200000;
+  return /fable-5|opus-5|sonnet-5/.test(model) ? 1000000 : 200000;
+}
+
+// The last assistant line with usage in a transcript file, against its model's window. null when the
+// file is missing, unreadable, or has no assistant line carrying usage — never a number in that case.
+// Parses line by line and skips bad lines, the way lib/trace.mjs usageFromTranscript does (that
+// function is unchanged; this one answers a different question — the LAST reading, not a sum).
+export function contextReading(file, { windows = windowFor } = {}) {
+  if (!file || !existsSync(file)) return null;
+  let text;
+  try {
+    text = readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+  let lastMessage = null;
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    let o;
+    try {
+      o = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (o && o.type === "assistant" && o.message && o.message.usage) lastMessage = o.message;
+  }
+  if (!lastMessage) return null;
+  const u = lastMessage.usage;
+  const tokens = (u.input_tokens || 0) + (u.cache_creation_input_tokens || 0) + (u.cache_read_input_tokens || 0);
+  const model = lastMessage.model || null;
+  const window = windows(model);
+  return { tokens, model, window, pct: Math.round((100 * tokens) / window) };
+}
+
+// Writes state.agents[agentId].context from a fresh reading, keeping the running maximum pct
+// (maxPct — what stop-gate.mjs checks a partial claim against) and preserving notifiedAt across
+// updates (cleared only by the caller, when it actually notifies). `reading.size` (review MAJOR/minor
+// 4) — the transcript file's byte length at the time of the reading — passes through unchanged when the
+// caller supplies one (scripts/trace.mjs does, to skip re-reading an unchanged file; a one-off
+// SubagentStop reading doesn't, and that's fine: size ends up undefined, JSON drops it). Returns the new
+// context entry.
+export function recordAgentContext(state, agentId, reading, now) {
+  state.agents = state.agents || {};
+  const prev = state.agents[agentId] || {};
+  const prevContext = prev.context || {};
+  const maxPct = typeof prevContext.maxPct === "number" ? Math.max(prevContext.maxPct, reading.pct) : reading.pct;
+  const entry = {
+    pct: reading.pct,
+    tokens: reading.tokens,
+    window: reading.window,
+    model: reading.model,
+    at: now.toISOString(),
+    maxPct,
+    notifiedAt: prevContext.notifiedAt,
+    size: reading.size,
+  };
+  state.agents[agentId] = { ...prev, context: entry };
+  return entry;
+}
+
+// True when a context entry has crossed contextWindow.threshold (default 80) and either has never
+// notified or has grown by contextWindow.repeatAfter (default 5) points since the last notice.
+export function shouldNotify(entry, cfg) {
+  if (!entry || typeof entry.pct !== "number") return false;
+  const cw = (cfg && cfg.contextWindow) || {};
+  const threshold = cw.threshold ?? 80;
+  const repeatAfter = cw.repeatAfter ?? 5;
+  if (entry.pct < threshold) return false;
+  if (typeof entry.notifiedAt === "number" && entry.pct < entry.notifiedAt + repeatAfter) return false;
+  return true;
+}
+
+// The one-line notice delivered to a worker via PostToolUse additionalContext. Quoted verbatim by
+// brief B's agents and workflow — keep this wording.
+export function noticeText(entry, cfg) {
+  const cw = (cfg && cfg.contextWindow) || {};
+  const threshold = cw.threshold ?? 80;
+  return (
+    `[doug] Worker context at ${entry.pct}% of ${entry.window} tokens (threshold ${threshold}). ` +
+    `Finish the file you are on and its named test, commit, then return partial=true with a handoff (completed, remaining, next, verify). Do not start another file.`
+  );
+}

package/node_modules/@dougharness/gates/lib/anchor.mjs

@@ -0,0 +1,110 @@
+// PreCompact snapshot (decision 0002 #4, card precompact-anchor): what the next context must know, written into
+// .doug/anchor.md between two marker lines so the rest of the anchor (the plan section, the user's own notes) is
+// kept. Deterministic: the plan file, the decision files, this session's edited files and recent commands, and
+// (card precompact-keeps-handoff) a git HEAD lookup shelled out to `git`. Nothing here estimates tokens; the
+// compaction payload's estimates are ignored on purpose.
+
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+
+export const SNAPSHOT_START = "<!-- doug:compaction-snapshot start -->";
+export const SNAPSHOT_END = "<!-- doug:compaction-snapshot end -->";
+
+export function readPlanSummary(dir) {
+  const file = join(dir, ".doug/plan.json");
+  if (!existsSync(file)) return null;
+  try {
+    const p = JSON.parse(readFileSync(file, "utf8"));
+    if (!p || typeof p !== "object" || !Array.isArray(p.tasks)) return null;
+    return { title: p.title || "(untitled)", status: p.status || "unknown", card: typeof p.card === "string" ? p.card : null, tasks: p.tasks.map((t) => ({ id: t.id, files: Array.isArray(t.files) ? t.files : [] })) };
+  } catch {
+    return null;
+  }
+}
+
+// Short HEAD sha and current branch, tolerant of a non-repo or a git failure (moved from stop-gate.mjs; used by
+// both the Stop gate's own handoff and the PreCompact snapshot).
+export function gitHead(dir) {
+  try {
+    const sha = spawnSync("git", ["rev-parse", "--short", "HEAD"], { cwd: dir, encoding: "utf8", timeout: 2000 });
+    const branch = spawnSync("git", ["branch", "--show-current"], { cwd: dir, encoding: "utf8", timeout: 2000 });
+    return {
+      sha: !sha.error && sha.status === 0 ? (sha.stdout || "").trim() || null : null,
+      branch: !branch.error && branch.status === 0 ? (branch.stdout || "").trim() || null : null,
+    };
+  } catch {
+    return { sha: null, branch: null };
+  }
+}
+
+export function readDecisions(dir) {
+  const d = join(dir, "docs/decisions");
+  if (!existsSync(d)) return [];
+  try {
+    return readdirSync(d).filter((f) => f.endsWith(".md")).sort();
+  } catch {
+    return [];
+  }
+}
+
+// The section text, without the markers. `handoff` is optional (card context-window-handoff): when present, the
+// section gains a "Handoff boundary" block recording why the snapshot was taken outside a real compaction — the
+// boundary name, the Stop gate's last result, the current HEAD, and the context pct that triggered it. Absent,
+// the output is unchanged from before that card. The handoff block sits right after the heading line, before the
+// plan/decisions/edited-files lines (card precompact-keeps-handoff, review MAJOR): those grow unbounded with a
+// session's edited-file count, and SessionStart's re-injection caps the whole anchor at 4000 characters, so a few
+// short handoff lines must be near the top to survive that cap on a long session.
+export function snapshotSection({ plan, decisions, state, now, handoff }) {
+  const lines = [`## Compaction snapshot (doug, ${now.toISOString()})`];
+  if (handoff) {
+    lines.push("");
+    lines.push("### Handoff boundary");
+    lines.push(`Boundary: ${handoff.boundary}`);
+    if (handoff.gate) {
+      const at = handoff.gate.at;
+      lines.push(`Gate: ${handoff.gate.ok ? "green" : "red"}${Number.isFinite(at) ? ` (at ${new Date(at).toISOString()})` : ""}`);
+    }
+    const head = handoff.head || {};
+    lines.push(`HEAD: ${head.sha || "unknown"}${head.branch ? ` (${head.branch})` : ""}`);
+    if (typeof handoff.contextPct === "number") lines.push(`Context: ${handoff.contextPct}%`);
+  }
+  lines.push("");
+  if (plan) {
+    lines.push(`Plan: ${plan.title} [${plan.status}]${plan.card ? ` (card ${plan.card})` : ""}`);
+    for (const t of plan.tasks) lines.push(`- ${t.id} owns ${t.files.length ? t.files.join(", ") : "(no files)"}`);
+  } else lines.push("Plan: none in .doug/plan.json");
+  lines.push("");
+  lines.push(decisions.length ? `Decisions (docs/decisions): ${decisions.join(", ")}` : "Decisions: none under docs/decisions");
+  const edited = (state && state.editedFiles) || [];
+  const commands = ((state && state.commands) || []).slice(-10);
+  lines.push("");
+  lines.push(edited.length ? `Edited this session: ${edited.join(", ")}` : "Edited this session: nothing yet");
+  lines.push(commands.length ? `Recent commands:\n${commands.map((c) => `- ${c}`).join("\n")}` : "Recent commands: none");
+  return lines.join("\n");
+}
+
+// Splits anchor text into the compaction-snapshot block (markers included) and the rest, in the order each
+// appeared. No snapshot section: `snapshot` is null and `rest` is the whole text unchanged. Used to put the
+// snapshot first when re-injecting, so it is never cut by content that precedes it.
+export function splitSnapshot(text) {
+  const t = text || "";
+  const start = t.indexOf(SNAPSHOT_START);
+  const end = t.indexOf(SNAPSHOT_END);
+  if (start < 0 || end < start) return { snapshot: null, rest: t };
+  const endIdx = end + SNAPSHOT_END.length;
+  const snapshot = t.slice(start, endIdx);
+  const rest = (t.slice(0, start) + t.slice(endIdx)).replace(/\n{3,}/g, "\n\n").trim();
+  return { snapshot, rest };
+}
+
+// The anchor with the snapshot section replaced or appended; the text outside the markers is kept byte for byte.
+export function mergeSnapshot(anchorText, section) {
+  const block = `${SNAPSHOT_START}\n${section}\n${SNAPSHOT_END}\n`;
+  const text = anchorText || "";
+  const start = text.indexOf(SNAPSHOT_START);
+  const end = text.indexOf(SNAPSHOT_END);
+  if (start >= 0 && end > start) return text.slice(0, start) + block + text.slice(end + SNAPSHOT_END.length).replace(/^\n/, "");
+  if (!text.trim()) return block;
+  return text.replace(/\n*$/, "\n\n") + block;
+}

package/node_modules/@dougharness/gates/lib/baseline.mjs

@@ -0,0 +1,160 @@
+// Shared helpers for the "dirty tree at session start" baseline (card stop-gate-waiting-on-subagents,
+// stop-gate-session-start): which paths are already dirty in the working tree, and a cheap content
+// identity for each so a path already dirty when the baseline was captured is never mistaken for
+// this session's own work later. Used by both the stop gate (its first-run fallback capture) and the
+// SessionStart script (its earlier capture, when the platform fires it).
+
+import { execFileSync } from "node:child_process";
+import { readFileSync, readdirSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { join, resolve, sep } from "node:path";
+import { matchAny } from "./glob.mjs";
+
+// The working tree's changed paths (tracked and untracked), relative to `dir`. Null when `dir` is not
+// a git repo or git is unavailable — callers treat that as "unknown" rather than "nothing changed".
+export function changedFiles(dir) {
+  try {
+    const out = execFileSync("git", ["status", "--porcelain", "--untracked-files=all"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 });
+    return out
+      .split("\n")
+      .map((l) => /^.. (.*)$/.exec(l))
+      .filter(Boolean)
+      .map((m) => m[1].replace(/^"|"$/g, ""))
+      .map((p) => (p.includes(" -> ") ? p.split(" -> ")[1] : p))
+      // Claude Code keeps subagent worktrees under .claude/worktrees/ inside the repo, untracked and unignored.
+      // Their contents (including node_modules) are not this session's changes.
+      .filter((p) => !p.startsWith(".claude/worktrees/"))
+      // The hooks' own state lives under .doug/.state/ (lib/state.mjs) and is untracked; a project that has not
+      // gitignored it must not have the state file itself show up as a change (lib/scope.mjs exempts it too).
+      .filter((p) => !p.startsWith(".doug/.state/"))
+      // .doug/anchor.md is a handoff/compaction snapshot the hooks themselves write (lib/anchor.mjs, reanchor.mjs
+      // on PreCompact, and stop-gate.mjs's context-window notice); like .doug/.state/, the harness's own write to
+      // it must never read as "this session changed a file" — otherwise a green Stop's own notice would make the
+      // very next Stop demand evidence for a session that changed nothing (lib/scope.mjs's ALWAYS_ALLOWED exempts
+      // it from plan scope for the same reason).
+      .filter((p) => p !== ".doug/anchor.md");
+  } catch {
+    return null; // not a git repo or git unavailable
+  }
+}
+
+// Cheap content identity for a dirty path: size + a hash of its bytes, or null when it cannot be read
+// (deleted, or never existed as a regular file). Used to tell a path that was already dirty when the
+// session's baseline was captured from one this session actually changed further.
+export function fileIdentity(absPath) {
+  try {
+    const buf = readFileSync(absPath);
+    return `${buf.length}:${createHash("sha1").update(buf).digest("hex")}`;
+  } catch {
+    return null;
+  }
+}
+
+// The repo's current HEAD sha in `dir`, or null when there is no git repo, no HEAD yet (a repo with no
+// commits), or git is unavailable. Recorded once per session alongside state.baseline (card
+// stop-scan-committed-changes), so a later Stop can scan `git diff --name-only <that sha>..HEAD` for changes
+// the session committed instead of leaving dirty in the working tree (committedSince below).
+export function headAt(dir) {
+  try {
+    const out = execFileSync("git", ["rev-parse", "--verify", "HEAD"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 });
+    const sha = out.trim();
+    return sha || null;
+  } catch {
+    return null; // no git repo, no HEAD yet, or git unavailable
+  }
+}
+
+// A git commit sha, abbreviated or full (Minor 1, card stop-scan-committed-changes): state.baselineHead is
+// agent-writable data (the whole session state file lives under .doug/.state/, which nothing prevents an
+// agent from editing directly), so committedSince below must never hand it to git unvalidated - a string
+// like "--output=/tmp/x" passed where git expects a revision could otherwise be read as an option instead,
+// letting a forged state file steer the git invocation itself.
+const GIT_SHA_RE = /^[0-9a-f]{7,64}$/;
+
+// The paths that differ between `baseHead` and HEAD (card stop-scan-committed-changes): a protected- or
+// proposal-path change the session commits before it stops leaves a clean tree, which changedFiles above
+// cannot see. Filtered the same way changedFiles filters its own housekeeping paths. Null — callers treat
+// this exactly like changedFiles' null, "unknown" rather than "nothing changed" — when `baseHead` does not
+// look like a plausible git sha (GIT_SHA_RE above; Minor 1 - never recorded, e.g. an old state file predating
+// this key, or a forged/malformed one), HEAD does not exist (a repo with no commits), or git exits non-zero
+// (a rewritten base git no longer knows).
+export function committedSince(dir, baseHead) {
+  if (typeof baseHead !== "string" || !GIT_SHA_RE.test(baseHead)) return null;
+  try {
+    // The trailing "--" (Minor 1) tells git that nothing after it is an option, belt-and-braces alongside the
+    // GIT_SHA_RE check above: even a validated-looking sha is passed as a positional revision, never anything
+    // git could interpret as a flag.
+    const out = execFileSync("git", ["diff", "--name-only", "--no-renames", baseHead, "HEAD", "--"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 });
+    return out
+      .split("\n")
+      .map((l) => l.trim())
+      .filter(Boolean)
+      .filter((p) => !p.startsWith(".claude/worktrees/"))
+      .filter((p) => !p.startsWith(".doug/.state/"))
+      .filter((p) => p !== ".doug/anchor.md");
+  } catch {
+    return null; // baseHead unknown to git, no HEAD, or git unavailable
+  }
+}
+
+// The path segments of a glob pattern before its first glob metacharacter (*, ?, {) — for
+// "docs/decisions/**" that is "docs/decisions/", for ".claude/rules/**" it is ".claude/rules/". Used by
+// walkProposalPathFiles below to know where on disk to start walking without interpreting the glob itself. A
+// pattern with no metacharacter before its first "/" (or none at all) yields "".
+function fixedPrefix(pattern) {
+  const idx = pattern.search(/[*?{]/);
+  const cut = idx === -1 ? pattern : pattern.slice(0, idx);
+  const lastSlash = cut.lastIndexOf("/");
+  return lastSlash === -1 ? "" : cut.slice(0, lastSlash + 1);
+}
+
+// Every file on disk under each of `patterns`' fixed prefixes that itself matches one of `patterns` (card
+// stop-scan-committed-changes): `git status` cannot see a path under a directory a project's own .gitignore
+// covers (e.g. a .gitignore that ignores .claude/ entirely, hiding a Bash-written .claude/rules/*.md from git
+// completely), so proposalPaths gets its own direct filesystem walk instead of relying on changedFiles.
+// Symlinks are skipped by design, never followed and never reported (Minor 2): this is a deliberate choice to
+// keep the walk cheap and confined to real files under `dir`, not an oversight, but it is a known hole - a
+// proposalPaths file reachable only through a symlinked subdirectory (or a symlinked file directly) is
+// invisible to this scan, the same way it is invisible to `git status` for an ignored one. A prefix that does
+// not exist on disk, or resolves outside `dir` (Minor 3 - e.g. a "../**" pattern, which would otherwise walk
+// the project's parent directory), is silently skipped. Deduped, relpaths using forward slashes. Only
+// proposalPaths uses this — protectedPaths does not need it, per the card's goal.
+export function walkProposalPathFiles(dir, patterns) {
+  const list = Array.isArray(patterns) ? patterns : [];
+  const prefixes = [...new Set(list.map(fixedPrefix).filter((p) => p !== ""))];
+  const root = resolve(dir);
+  const out = new Set();
+  const walk = (absDir, relDir) => {
+    let entries;
+    try {
+      entries = readdirSync(absDir, { withFileTypes: true });
+    } catch {
+      return; // prefix does not exist, or is not a directory
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) continue;
+      const relPath = relDir + entry.name;
+      if (entry.isDirectory()) walk(join(absDir, entry.name), relPath + "/");
+      else if (entry.isFile() && matchAny(list, relPath)) out.add(relPath);
+    }
+  };
+  for (const prefix of prefixes) {
+    const abs = resolve(dir, prefix);
+    // Minor 3: clamp to the project dir - a prefix must resolve to `dir` itself or somewhere under it.
+    if (abs !== root && !abs.startsWith(root + sep)) continue;
+    walk(abs, prefix);
+  }
+  return [...out];
+}
+
+export function captureBaseline(dir, paths) {
+  const baseline = {};
+  for (const p of paths) baseline[p] = fileIdentity(join(dir, p));
+  return baseline;
+}
+
+// Paths considered this session's own work: absent from the baseline (new since the session started),
+// or present but whose content identity has moved since the baseline was captured.
+export function sinceBaseline(dir, paths, baseline) {
+  return paths.filter((p) => !(p in baseline) || fileIdentity(join(dir, p)) !== baseline[p]);
+}