@hecer/yoke 0.9.0 → 1.0.0

package/dist/agents/telemetry.js

@@ -0,0 +1,30 @@
+const finite = (value) => typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+export function parseProviderTelemetry(agent, lines) {
+    let inputTokens;
+    let outputTokens;
+    let model;
+    for (const line of lines) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const message = event.message && typeof event.message === 'object' ? event.message : undefined;
+        const usage = (event.usage && typeof event.usage === 'object' ? event.usage : message?.usage);
+        const inValue = finite(usage?.input_tokens ?? usage?.inputTokens ?? usage?.prompt_tokens);
+        const outValue = finite(usage?.output_tokens ?? usage?.outputTokens ?? usage?.completion_tokens);
+        if (inValue !== undefined)
+            inputTokens = inValue;
+        if (outValue !== undefined)
+            outputTokens = outValue;
+        const eventModel = event.model ?? message?.model;
+        if (typeof eventModel === 'string' && eventModel)
+            model = eventModel;
+    }
+    if (inputTokens === undefined && outputTokens === undefined)
+        return { usageAvailable: false };
+    const tokens = { inputTokens: inputTokens ?? 0, outputTokens: outputTokens ?? 0, ...(model ? { model } : {}) };
+    return { usageAvailable: true, tokens };
+}

package/dist/agents/types.js

@@ -0,0 +1 @@
+export {};

package/dist/audit/changes.js

@@ -0,0 +1,6 @@
+const SENSITIVE = /(^|\/)(\.github\/workflows|auth|permissions?|secrets?|infra|terraform)(\/|\.|$)/i;
+export function scanSensitiveChanges(files) {
+    return [...new Set(files)].filter(file => SENSITIVE.test(file.replace(/\\/g, '/'))).sort().map(file => ({
+        ruleId: 'changes.sensitive-path', severity: 'medium', message: 'Security-sensitive path changed; review explicitly', file,
+    }));
+}

package/dist/audit/command.js

@@ -0,0 +1,64 @@
+import { execFileSync, execSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { dependencyAuditCommand, parseDependencyAudit } from './dependencies.js';
+import { scanSensitiveChanges } from './changes.js';
+import { scanSecrets } from './secrets.js';
+const lines = (value) => value.split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+export function applySuppressions(findings, suppressions = [], now = new Date()) {
+    return findings.filter(finding => !suppressions.some(s => s.reason.trim() && s.ruleId === finding.ruleId && (!s.file || s.file === finding.file) && (!s.expires || Date.parse(s.expires) >= now.getTime())));
+}
+export function runAudit(targetDir, opts = {}) {
+    try {
+        const files = opts.files?.() ?? lines(execFileSync('git', ['ls-files'], { cwd: targetDir }).toString());
+        const changed = opts.changed?.() ?? lines(execFileSync('git', ['diff', '--name-only', 'HEAD'], { cwd: targetDir }).toString());
+        const read = opts.read ?? ((file) => readFileSync(join(targetDir, file), 'utf8'));
+        let findings = [];
+        for (const file of files) {
+            try {
+                findings.push(...scanSecrets(file, read(file)));
+            }
+            catch { /* binary/deleted file */ }
+        }
+        findings.push(...scanSensitiveChanges(changed));
+        if (opts.command) {
+            try {
+                execSync(opts.command, { cwd: targetDir, stdio: 'pipe' });
+            }
+            catch {
+                findings.push({ ruleId: 'audit.custom-command', severity: 'high', message: `Audit command failed: ${opts.command}`, file: '.yoke/config.yaml' });
+            }
+        }
+        else {
+            const dependency = opts.dependency ?? ((repoFiles) => {
+                const command = dependencyAuditCommand(repoFiles);
+                if (!command)
+                    return [];
+                try {
+                    return parseDependencyAudit(execFileSync(command[0], command[1], { cwd: targetDir, stdio: ['ignore', 'pipe', 'pipe'] }).toString());
+                }
+                catch (error) {
+                    return parseDependencyAudit(String(error.stdout ?? '{}'));
+                }
+            });
+            findings.push(...dependency(files));
+        }
+        findings = applySuppressions(findings, opts.suppressions).sort((a, b) => a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId));
+        return { code: findings.some(f => f.severity === 'high' || f.severity === 'critical') ? 1 : 0, findings };
+    }
+    catch (error) {
+        return { code: 2, findings: [], error: error.message };
+    }
+}
+export function printAudit(result, json = false) {
+    if (json) {
+        console.log(JSON.stringify(result));
+        return;
+    }
+    for (const finding of result.findings)
+        console.log(`${finding.severity.toUpperCase()} ${finding.ruleId} ${finding.file}${finding.line ? `:${finding.line}` : ''} — ${finding.message}`);
+    if (result.error)
+        console.error(`Audit unavailable: ${result.error}`);
+    else
+        console.log(result.code === 0 ? '✓ audit passed' : `✗ audit found ${result.findings.length} issue(s)`);
+}

package/dist/audit/dependencies.js

@@ -0,0 +1,21 @@
+export function dependencyAuditCommand(files) {
+    if (files.includes('package-lock.json'))
+        return ['npm', ['audit', '--json']];
+    if (files.includes('pnpm-lock.yaml'))
+        return ['pnpm', ['audit', '--json']];
+    if (files.includes('yarn.lock'))
+        return ['yarn', ['npm', 'audit', '--json']];
+    return null;
+}
+export function parseDependencyAudit(output) {
+    let value;
+    try {
+        value = JSON.parse(output);
+    }
+    catch {
+        return [{ ruleId: 'dependencies.audit-error', severity: 'high', message: 'Dependency audit returned invalid JSON', file: 'package manifest' }];
+    }
+    const vulnerabilities = value?.metadata?.vulnerabilities;
+    const count = Number(vulnerabilities?.high ?? 0) + Number(vulnerabilities?.critical ?? 0);
+    return count > 0 ? [{ ruleId: 'dependencies.high', severity: 'high', message: `${count} high/critical dependency vulnerabilities`, file: 'package lock' }] : [];
+}

package/dist/audit/secrets.js

@@ -0,0 +1,16 @@
+const RULES = [
+    { ruleId: 'secret.github-token', severity: 'critical', pattern: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g, message: 'GitHub token detected' },
+    { ruleId: 'secret.aws-access-key', severity: 'critical', pattern: /\bAKIA[0-9A-Z]{16}\b/g, message: 'AWS access key detected' },
+    { ruleId: 'secret.private-key', severity: 'critical', pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g, message: 'Private key material detected' },
+];
+export function scanSecrets(file, content) {
+    const findings = [];
+    for (const rule of RULES) {
+        rule.pattern.lastIndex = 0;
+        for (const match of content.matchAll(rule.pattern)) {
+            const line = content.slice(0, match.index).split(/\r?\n/).length;
+            findings.push({ ruleId: rule.ruleId, severity: rule.severity, message: rule.message, file, line });
+        }
+    }
+    return findings.sort((a, b) => (a.line ?? 0) - (b.line ?? 0) || a.ruleId.localeCompare(b.ruleId));
+}

package/dist/audit/types.js

@@ -0,0 +1 @@
+export {};

package/dist/cli.js

@@ -13,6 +13,7 @@ import { runLoopCleanup } from './loop/cleanup.js';
 import { runFlowSmoke } from './smoke/command.js';
 import { maybeNotifyUpdate, currentYokeVersion } from './update/check.js';
 import { runUpgrade } from './update/upgrade.js';
+import { printAudit, runAudit } from './audit/command.js';
 export { runRetrofit } from './retrofit/command.js';
 export function runValidate(canonDir) {
     const issues = validateCanon(canonDir);
@@ -90,7 +91,7 @@ function main(argv) {
                 return 0;
             }
             if (sub === 'cleanup')
-                return runLoopCleanup(targetDir);
+                return runLoopCleanup(targetDir, { removeWorktrees: rest.includes('--remove-worktrees') });
             if (sub === 'run') {
                 const maxArg = rest.find(a => a.startsWith('--max='));
                 const rawMax = maxArg ? Number(maxArg.slice('--max='.length)) : 25;
@@ -116,6 +117,14 @@ function main(argv) {
                     reviewer = reviewerArg;
                 }
                 const review = rest.includes('--review');
+                const allowSelfReview = rest.includes('--allow-self-review');
+                const permissions = rest.includes('--unsafe') ? 'unsafe' : undefined;
+                const parallelArg = rest.find(a => a.startsWith('--parallel='));
+                const parallel = parallelArg ? Number(parallelArg.slice('--parallel='.length)) : 1;
+                if (!Number.isInteger(parallel) || parallel < 1) {
+                    console.error(`Invalid --parallel value: ${parallelArg}`);
+                    return 1;
+                }
                 const json = rest.includes('--json');
                 const toArg = rest.find(a => a.startsWith('--timeout='));
                 let timeoutMinutes;
@@ -132,9 +141,9 @@ function main(argv) {
                     console.error(`Invalid --on-ambiguity value: ${oaArg} (expected resolve|abort)`);
                     return 1;
                 }
-                return runLoopCommand(targetDir, { maxIterations: rawMax, agent, isolate, reviewer, review, timeoutMinutes, json, onAmbiguity: oaArg });
+                return runLoopCommand(targetDir, { maxIterations: rawMax, agent, isolate, parallel, reviewer, review, allowSelfReview, timeoutMinutes, json, onAmbiguity: oaArg, permissions });
             }
-            console.log('usage: yoke loop <on|off|status|cleanup|run [--max=N] [--runner=<claude|codex|gemini>] [--reviewer=<claude|codex|gemini>] [--review] [--isolate] [--timeout=<minutes>] [--on-ambiguity=<resolve|abort>] [--json]> [targetDir]');
+            console.log('usage: yoke loop <on|off|status|cleanup [--remove-worktrees]|run [--max=N] [--parallel=N] [--runner=<claude|codex|gemini>] [--reviewer=<claude|codex|gemini>] [--review] [--allow-self-review] [--isolate] [--unsafe] [--timeout=<minutes>] [--on-ambiguity=<resolve|abort>] [--json]> [targetDir]');
             return 1;
         }
         case 'new': {
@@ -213,6 +222,8 @@ function main(argv) {
             }
             const base = rest.find(a => a.startsWith('--base='))?.slice('--base='.length);
             const focus = rest.find(a => a.startsWith('--focus='))?.slice('--focus='.length);
+            const allowSelfReview = rest.includes('--allow-self-review');
+            const json = rest.includes('--json');
             const toArg = rest.find(a => a.startsWith('--timeout='));
             let timeoutMinutes;
             if (toArg) {
@@ -223,7 +234,14 @@ function main(argv) {
                 }
                 timeoutMinutes = v;
             }
-            return runReview(targetDir, { reviewer: reviewerArg, base, focus, timeoutMinutes });
+            return runReview(targetDir, { reviewer: reviewerArg, base, focus, allowSelfReview, json, timeoutMinutes });
+        }
+        case 'audit': {
+            const targetDir = rest.find(a => !a.startsWith('-')) ?? '.';
+            const json = rest.includes('--json');
+            const result = runAudit(targetDir);
+            printAudit(result, json);
+            return result.code;
         }
         case 'flow-smoke': {
             const targetDir = rest.find(a => !a.startsWith('-')) ?? '.';

package/dist/loop/claims.js

@@ -0,0 +1,57 @@
+import { closeSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+const pathFor = (dir, id) => join(dir, '.yoke', 'claims', `${id}.json`);
+export function acquireClaim(dir, storyId, owner, opts = {}) {
+    const path = pathFor(dir, storyId);
+    mkdirSync(join(dir, '.yoke', 'claims'), { recursive: true });
+    const now = opts.now ?? new Date();
+    try {
+        const old = JSON.parse(readFileSync(path, 'utf8'));
+        if (now.getTime() - Date.parse(old.claimedAt) <= (opts.staleMs ?? 30 * 60_000))
+            return null;
+        rmSync(path, { force: true });
+    }
+    catch { /* absent or malformed */ }
+    const claim = { storyId, owner, pid: opts.pid ?? process.pid, claimedAt: now.toISOString() };
+    try {
+        const fd = openSync(path, 'wx');
+        writeFileSync(fd, JSON.stringify(claim));
+        closeSync(fd);
+        return claim;
+    }
+    catch {
+        return null;
+    }
+}
+export function releaseClaim(dir, storyId, owner) {
+    const path = pathFor(dir, storyId);
+    try {
+        const claim = JSON.parse(readFileSync(path, 'utf8'));
+        if (claim.owner !== owner)
+            return false;
+        rmSync(path, { force: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function cleanupClaims(dir, owner) {
+    const claimsDir = join(dir, '.yoke', 'claims');
+    let removed = 0;
+    try {
+        for (const file of readdirSync(claimsDir)) {
+            const path = join(claimsDir, file);
+            try {
+                const claim = JSON.parse(readFileSync(path, 'utf8'));
+                if (!owner || claim.owner === owner) {
+                    rmSync(path, { force: true });
+                    removed++;
+                }
+            }
+            catch { /* scoped cleanup never guesses ownership */ }
+        }
+    }
+    catch { /* no claims */ }
+    return removed;
+}

package/dist/loop/cleanup.js

@@ -53,6 +53,10 @@ export function runLoopCleanup(targetDir, opts = {}) {
     if (existsSync(wtDir)) {
         for (const name of readdirSync(wtDir)) {
             const path = join(wtDir, name);
+            if (!opts.removeWorktrees) {
+                console.log(`Yoke worktree retained: ${path} (pass --remove-worktrees to remove it)`);
+                continue;
+            }
             try {
                 git(['worktree', 'remove', '--force', path], targetDir);
                 removed++;
@@ -62,10 +66,12 @@ export function runLoopCleanup(targetDir, opts = {}) {
                 failed++;
             }
         }
-        try {
-            git(['worktree', 'prune'], targetDir);
+        if (opts.removeWorktrees) {
+            try {
+                git(['worktree', 'prune'], targetDir);
+            }
+            catch { /* best-effort */ }
         }
-        catch { /* best-effort */ }
     }
     const lockFile = lockPath(targetDir);
     if (existsSync(lockFile)) {
@@ -78,6 +84,6 @@ export function runLoopCleanup(targetDir, opts = {}) {
             console.log('Removed stale loop lock.');
         }
     }
-    console.log(removed === 0 && failed === 0 ? 'Nothing to clean.' : `Removed ${removed} worktree(s)${failed > 0 ? `, ${failed} failed` : ''}.`);
+    console.log(removed === 0 && failed === 0 ? 'No destructive cleanup performed.' : `Removed ${removed} worktree(s)${failed > 0 ? `, ${failed} failed` : ''}.`);
     return failed === 0 ? 0 : 1;
 }

package/dist/loop/git.js

@@ -1,16 +1,22 @@
 import { execFileSync } from 'node:child_process';
+import { sanitizeCommitMessage } from './identity.js';
 export const realGitOps = {
     isClean(dir) {
         const out = execFileSync('git', ['status', '--porcelain'], { cwd: dir }).toString();
         return out.trim() === '';
     },
-    commitAll(dir, message) {
+    commitAll(dir, message, identity) {
         execFileSync('git', ['add', '-A'], { cwd: dir, stdio: 'pipe' });
         const status = execFileSync('git', ['status', '--porcelain'], { cwd: dir }).toString().trim();
         if (status === '') {
             throw new Error('nothing to commit after agent run');
         }
-        execFileSync('git', ['-c', 'commit.gpgsign=false', 'commit', '-m', message], { cwd: dir, stdio: 'pipe' });
+        const identityArgs = identity
+            ? ['-c', `user.name=${identity.authorName}`, '-c', `user.email=${identity.authorEmail}`]
+            : [];
+        const authorArgs = identity ? ['--author', `${identity.authorName} <${identity.authorEmail}>`] : [];
+        const cleanMessage = sanitizeCommitMessage(message, identity?.allowCoAuthors ?? false);
+        execFileSync('git', [...identityArgs, '-c', 'commit.gpgsign=false', 'commit', ...authorArgs, '-m', cleanMessage], { cwd: dir, stdio: 'pipe' });
     },
     addWorktree(repoDir, worktreePath) {
         execFileSync('git', ['worktree', 'add', '--detach', worktreePath, 'HEAD'], { cwd: repoDir, stdio: 'pipe' });

package/dist/loop/identity.js

@@ -0,0 +1,27 @@
+import { execFileSync } from 'node:child_process';
+const readGitConfig = (key, targetDir) => {
+    try {
+        return execFileSync('git', ['config', '--get', key], { cwd: targetDir, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+    }
+    catch {
+        return '';
+    }
+};
+export function resolveCommitIdentity(targetDir, config, gitConfig = readGitConfig) {
+    const authorName = config?.authorName?.trim() || gitConfig('user.name', targetDir).trim();
+    const authorEmail = config?.authorEmail?.trim() || gitConfig('user.email', targetDir).trim();
+    if (!authorName)
+        throw new Error('Commit author name is missing. Set commit.authorName in .yoke/config.yaml or git config user.name.');
+    if (!authorEmail)
+        throw new Error('Commit author email is missing. Set commit.authorEmail in .yoke/config.yaml or git config user.email.');
+    return { authorName, authorEmail, allowCoAuthors: config?.allowCoAuthors ?? false };
+}
+export function sanitizeCommitMessage(message, allowCoAuthors) {
+    if (allowCoAuthors)
+        return message;
+    return message
+        .split(/\r?\n/)
+        .filter(line => !/^Co-Authored-By:/i.test(line.trim()))
+        .join('\n')
+        .trim();
+}

package/dist/loop/loop.js

@@ -139,6 +139,15 @@ export function runLoop(opts) {
                         return { status: 'blocked', iterations, reason, finalProgress: progress(stories) };
                     }
                 }
+                if (opts.audit) {
+                    reporter.phase('audit');
+                    const auditVerdict = runGate(opts.audit, wt, story.id);
+                    if (!auditVerdict.passed) {
+                        const reason = blockReason(`story ${story.id} failed security audit: ${auditVerdict.summary}`, opts.targetDir, opts.git);
+                        reporter.blocked(reason);
+                        return { status: 'blocked', iterations, reason, finalProgress: progress(stories) };
+                    }
+                }
                 const summary = result.success
                     ? result.summary
                     : `${result.summary} (runner exited non-zero but verify is green)`;
@@ -162,7 +171,7 @@ export function runLoop(opts) {
                 });
                 const updated = stories.map(s => (s.id === story.id ? { ...s, passes: true } : s));
                 savePrd(wtPrd, updated);
-                opts.git.commitAll(wt, `yoke: complete ${story.id} ${story.title}`);
+                opts.git.commitAll(wt, `yoke: complete ${story.id} ${story.title}`, opts.commitIdentity);
                 opts.git.integrate(opts.targetDir, wt);
                 landed = progress(updated);
             }
@@ -217,6 +226,15 @@ export function runLoop(opts) {
                 return { status: 'blocked', iterations, reason, finalProgress: progress(stories) };
             }
         }
+        if (opts.audit) {
+            reporter.phase('audit');
+            const auditVerdict = runGate(opts.audit, opts.targetDir, story.id);
+            if (!auditVerdict.passed) {
+                const reason = blockReason(`story ${story.id} failed security audit: ${auditVerdict.summary}`, opts.targetDir, opts.git);
+                reporter.blocked(reason);
+                return { status: 'blocked', iterations, reason, finalProgress: progress(stories) };
+            }
+        }
         const summary = result.success
             ? result.summary
             : `${result.summary} (runner exited non-zero but verify is green)`;
@@ -247,7 +265,7 @@ export function runLoop(opts) {
         const updated = onDisk.map(s => (s.id === story.id ? { ...s, passes: true } : s));
         savePrd(opts.prdPath, updated);
         try {
-            opts.git.commitAll(opts.targetDir, `yoke: complete ${story.id} ${story.title}`);
+            opts.git.commitAll(opts.targetDir, `yoke: complete ${story.id} ${story.title}`, opts.commitIdentity);
         }
         catch (e) {
             savePrd(opts.prdPath, onDisk); // revert — never persist passes:true without a commit

package/dist/loop/merge-queue.js

@@ -0,0 +1,20 @@
+export class MergeQueue {
+    tail = Promise.resolve();
+    enqueue(job) {
+        const run = async () => {
+            try {
+                await job.rebase();
+                if (!await job.verify())
+                    return { storyId: job.storyId, integrated: false, reason: 'integrated-tree verification failed' };
+                await job.integrate();
+                return { storyId: job.storyId, integrated: true };
+            }
+            catch (error) {
+                return { storyId: job.storyId, integrated: false, reason: error.message };
+            }
+        };
+        const result = this.tail.then(run, run);
+        this.tail = result.then(() => undefined);
+        return result;
+    }
+}

package/dist/loop/parallel.js

@@ -0,0 +1,39 @@
+import { readyStories } from './scheduler.js';
+export async function runParallelLoop(stories, opts) {
+    const completed = [];
+    const failed = [];
+    const activeAreas = new Set();
+    const active = new Map();
+    let iterations = 0;
+    let agentIndex = 0;
+    const launch = (story) => {
+        iterations++;
+        if (story.area)
+            activeAreas.add(story.area);
+        const affinity = story.agent ?? (opts.agents?.length ? opts.agents[agentIndex++ % opts.agents.length] : undefined);
+        const promise = opts.worker(story, affinity).then(result => {
+            if (result.success) {
+                story.passes = true;
+                completed.push(story.id);
+            }
+            else
+                failed.push(story.id);
+        }).catch(() => { failed.push(story.id); }).finally(() => {
+            active.delete(story.id);
+            if (story.area)
+                activeAreas.delete(story.area);
+        });
+        active.set(story.id, promise);
+    };
+    while (iterations < opts.maxIterations && !opts.paused?.()) {
+        const slots = Math.max(0, opts.maxConcurrency - active.size);
+        const ready = readyStories(stories, { activeAreas }).filter(s => !active.has(s.id) && !failed.includes(s.id)).slice(0, slots);
+        for (const story of ready)
+            launch(story);
+        if (active.size === 0)
+            break;
+        await Promise.race(active.values());
+    }
+    await Promise.all(active.values());
+    return { completed, failed, iterations, paused: opts.paused?.() ?? false };
+}

package/dist/loop/prd.js

@@ -7,20 +7,66 @@ export const StorySchema = z.object({
     priority: z.number(),
     acceptance: z.array(z.string().min(1)),
     passes: z.boolean(),
+    needs: z.array(z.string().min(1)).optional(),
+    area: z.string().min(1).optional(),
+    agent: z.enum(['claude', 'codex', 'gemini']).optional(),
 });
 const PrdSchema = z.array(StorySchema);
 export function loadPrd(file) {
-    return PrdSchema.parse(parse(readFileSync(file, 'utf8')));
+    const stories = PrdSchema.parse(parse(readFileSync(file, 'utf8')));
+    const issues = validateDependencies(stories);
+    if (issues.length)
+        throw new Error(`Invalid PRD dependency graph:\n${issues.join('\n')}`);
+    return stories;
 }
 export function savePrd(file, stories) {
     writeFileSync(file, stringify(stories));
 }
 export function selectNextStory(stories) {
-    const open = stories.filter(s => !s.passes);
+    const passed = new Set(stories.filter(s => s.passes).map(s => s.id));
+    const open = stories.filter(s => !s.passes && (s.needs ?? []).every(id => passed.has(id)));
     if (open.length === 0)
         return null;
     return open.reduce((best, s) => (s.priority < best.priority ? s : best));
 }
+export function validateDependencies(stories) {
+    const issues = [];
+    const counts = new Map();
+    for (const story of stories)
+        counts.set(story.id, (counts.get(story.id) ?? 0) + 1);
+    for (const [id, count] of counts)
+        if (count > 1)
+            issues.push(`duplicate story id: ${id}`);
+    const ids = new Set(stories.map(s => s.id));
+    for (const story of stories) {
+        for (const need of story.needs ?? []) {
+            if (need === story.id)
+                issues.push(`story ${story.id} depends on itself`);
+            else if (!ids.has(need))
+                issues.push(`story ${story.id} has unknown dependency ${need}`);
+        }
+    }
+    const byId = new Map(stories.map(s => [s.id, s]));
+    const visiting = new Set();
+    const visited = new Set();
+    const walk = (id, path) => {
+        if (visiting.has(id)) {
+            issues.push(`dependency cycle: ${[...path, id].join(' -> ')}`);
+            return;
+        }
+        if (visited.has(id))
+            return;
+        visiting.add(id);
+        for (const need of byId.get(id)?.needs ?? [])
+            if (byId.has(need) && need !== id)
+                walk(need, [...path, id]);
+        visiting.delete(id);
+        visited.add(id);
+    };
+    for (const id of byId.keys())
+        walk(id, []);
+    return [...new Set(issues)];
+}
 export function allPass(stories) {
     return stories.length > 0 && stories.every(s => s.passes);
 }

package/dist/loop/run-command.js

@@ -9,6 +9,8 @@ import { commandVerifier, retryingVerifier } from './verify.js';
 import { readStatus, makeReporter, fmtDuration } from './reporter.js';
 import { acquireLock, releaseLock } from './lock.js';
 import { maybeAutoUpgrade } from '../update/upgrade.js';
+import { resolveCommitIdentity } from './identity.js';
+import { runAudit } from '../audit/command.js';
 export const DEFAULT_IDLE_MINUTES = 20;
 const STALE_MINUTES = 20; // a running status older than this likely means the loop died
 export function relativeTime(fromIso, now) {
@@ -66,6 +68,10 @@ export function resolveIdleMs(flagMinutes, configMinutes) {
     return minutes > 0 ? minutes * 60_000 : 0;
 }
 export function runLoopCommand(targetDir, opts) {
+    if ((opts.parallel ?? 1) > 1) {
+        console.error('Parallel CLI workers are not enabled yet. The dependency-aware dispatcher and merge queue are available as APIs; use --parallel=1 for the synchronous provider runner.');
+        return 2;
+    }
     const config = loadConfig(targetDir);
     if (!config?.loop.enabled) {
         console.error('Loop is disabled. Enable it with: yoke loop on');
@@ -96,7 +102,30 @@ export function runLoopCommand(targetDir, opts) {
     maybeAutoUpgrade(config.update?.auto);
     const available = opts.isAvailable ?? isAgentAvailable;
     const runnerAgent = opts.agent ?? config.agents[0] ?? 'claude';
+    const git = opts.git ?? realGitOps;
+    let commitIdentity = opts.commitIdentity;
+    if (!commitIdentity && !opts.git) {
+        try {
+            commitIdentity = resolveCommitIdentity(targetDir, config.commit);
+        }
+        catch (error) {
+            console.error(error.message);
+            return 2;
+        }
+    }
+    let audit = opts.audit;
+    if (!audit && config.audit?.enabled) {
+        audit = (dir) => {
+            const result = runAudit(dir, { command: config.audit?.command, suppressions: config.audit?.suppressions });
+            return { passed: result.code === 0, summary: result.error ?? (result.findings.map(f => `${f.ruleId} ${f.file}${f.line ? `:${f.line}` : ''}`).join(', ') || 'audit passed') };
+        };
+    }
+    if (commitIdentity) {
+        const announce = opts.json ? console.error : console.log;
+        announce(`Commits: ${commitIdentity.authorName} <${commitIdentity.authorEmail}> · co-authors: ${commitIdentity.allowCoAuthors ? 'allowed' : 'disabled'}`);
+    }
     const idleMs = resolveIdleMs(opts.timeoutMinutes, config.loop.timeoutMinutes);
+    const permissions = opts.permissions ?? config.runner?.permissions ?? 'safe';
     let runner = opts.runner;
     if (!runner) {
         if (!available(runnerAgent)) {
@@ -109,16 +138,30 @@ export function runLoopCommand(targetDir, opts) {
             tokenReport: opts.json === true,
             onAmbiguity: opts.onAmbiguity ?? config.loop.onAmbiguity,
             perfCommand: config.perf?.command,
+            permissions,
         });
+        const announce = opts.json ? console.error : console.log;
+        announce(`Runner: ${runnerAgent} · permissions: ${permissions} · cwd: ${targetDir}`);
     }
     let review = opts.reviewRunner;
     if (!review && (opts.review || opts.reviewer)) {
-        const reviewerAgent = opts.reviewer ?? runnerAgent;
-        if (!available(reviewerAgent)) {
-            console.error(`Reviewer agent CLI "${reviewerAgent}" was not found on PATH. Install it, or pick another with --reviewer=<claude|codex|gemini>.`);
+        const reviewerAgent = opts.reviewer ?? ['codex', 'gemini', 'claude'].find(agent => agent !== runnerAgent && available(agent));
+        if (!reviewerAgent) {
+            if (!opts.allowSelfReview) {
+                console.error('No independent reviewer CLI is available. Install or select a second agent, or pass --allow-self-review explicitly.');
+                return 2;
+            }
+        }
+        const resolvedReviewer = reviewerAgent ?? runnerAgent;
+        if (resolvedReviewer === runnerAgent && !opts.allowSelfReview) {
+            console.error(`Reviewer "${resolvedReviewer}" is also the implementer. Pick another agent or pass --allow-self-review explicitly.`);
+            return 2;
+        }
+        if (!available(resolvedReviewer)) {
+            console.error(`Reviewer agent CLI "${resolvedReviewer}" was not found on PATH. Install it, or pick another with --reviewer=<claude|codex|gemini>.`);
             return 2;
         }
-        review = makeReviewRunner(reviewerAgent, idleMs);
+        review = makeReviewRunner(resolvedReviewer, idleMs);
     }
     const lock = acquireLock(targetDir);
     if (!lock.acquired) {
@@ -133,11 +176,13 @@ export function runLoopCommand(targetDir, opts) {
             prdPath: path,
             targetDir,
             runner,
-            git: opts.git ?? realGitOps,
+            git,
+            commitIdentity,
             verify,
             perf,
+            audit,
             maxIterations: opts.maxIterations,
-            isolate: opts.isolate ?? false,
+            isolate: (opts.parallel ?? 1) > 1 ? true : (opts.isolate ?? false),
             review,
             reporter: opts.reporter ?? makeReporter(targetDir, { json: opts.json }),
         });