@imdeadpool/guardex 7.0.23 → 7.0.24

package/README.md

@@ -672,6 +672,11 @@ npm pack --dry-run
 <details>
 <summary><strong>v7.x</strong></summary>
 
+### v7.0.24
+- Bumped `@imdeadpool/guardex` from `7.0.23` to `7.0.24` so GitHub Releases and the npm publish retry can advance together after `v7.0.23` landed on GitHub but not on npm.
+- Release verification no longer loses its base ref on tag-triggered runs, so the publish workflow keeps the history it needs before packing and publish checks.
+- Keep the release scoped to version and release automation metadata only; the packaged Guardex CLI payload stays aligned with the already-verified `main` branch contents.
+
 ### v7.0.23
 - Bumped `@imdeadpool/guardex` from `7.0.22` to `7.0.23` so GitHub release and npm can advance together after `7.0.22` reached npm without a matching published GitHub release.
 - Active Agents stays easier to scan and more truthful: the package repo remains the canonical source, inspect/install paths stay loadable across VS Code churn, and session rows group under worktrees with clearer merged-cleanup truth.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imdeadpool/guardex",
-  "version": "7.0.23",
+  "version": "7.0.24",
   "description": "Guardian T-Rex for your multi-agent repo. Isolated worktrees, file locks, and PR-only merges stop parallel Codex & Claude agents from overwriting each other's work. Auto-wires Oh My Codex, Oh My Claude, OpenSpec, and Caveman.",
   "license": "MIT",
   "preferGlobal": true,

package/src/cli/main.js

@@ -2431,15 +2431,20 @@ function report(rawArgs) {
   const options = parseReportArgs(rawArgs);
   const subcommand = options.subcommand || 'help';
   if (subcommand === 'help' || subcommand === '--help' || subcommand === '-h') {
+    const sessionSeverityHelpDetails = sessionSeverityReport.renderSessionSeverityHelpDetails()
+      .split('\n')
+      .map((line) => `    ${line}`)
+      .join('\n');
     console.log(
       `${TOOL_NAME} report commands:\n` +
       `  ${TOOL_NAME} report scorecard [--target <path>] [--repo github.com/<owner>/<repo>] [--scorecard-json <file>] [--output-dir <path>] [--date YYYY-MM-DD] [--dry-run] [--json]\n` +
-      `  ${TOOL_NAME} report session-severity --task-size <narrow-patch|medium-change|large-change> --tokens <count> --exec-count <count> --write-stdin-count <count> --completion-before-tail <yes|no> [--expected-bound <count>] [--fragmentation <preset|0-25>] [--finish-path <preset|0-15>] [--post-proof <preset|0-15>] [--json]\n` +
+      `  ${sessionSeverityReport.renderSessionSeverityCommand(TOOL_NAME)}\n` +
+      `${sessionSeverityHelpDetails}\n` +
       `\n` +
       `Examples:\n` +
       `  ${TOOL_NAME} report scorecard --repo github.com/recodeecom/multiagent-safety\n` +
       `  ${TOOL_NAME} report scorecard --scorecard-json ./scorecard.json --date 2026-04-10\n` +
-      `  ${TOOL_NAME} report session-severity --task-size narrow-patch --tokens 3850000 --exec-count 18 --write-stdin-count 6 --completion-before-tail yes --fragmentation 14 --finish-path 6 --post-proof 4`,
+      `  ${sessionSeverityReport.renderSessionSeverityExample(TOOL_NAME)}`,
     );
     process.exitCode = 0;
     return;

package/src/report/session-severity.js

@@ -4,7 +4,8 @@ const TASK_SIZE_UPPER_BOUNDS = {
   'large-change': 8_000_000,
 };
 
-const TASK_SIZE_VALUES = new Set(Object.keys(TASK_SIZE_UPPER_BOUNDS));
+const TASK_SIZE_VALUES = Object.keys(TASK_SIZE_UPPER_BOUNDS);
+const TASK_SIZE_SET = new Set(TASK_SIZE_VALUES);
 const FRAGMENTATION_PRESET_SCORES = {
   clean: 0,
   'few-extra-checks': 5,
@@ -32,6 +33,50 @@ const DRIVER_LABELS = {
   finishPath: 'finish-path discipline',
   postProof: 'post-proof drift',
 };
+const LABEL_BANDS = [
+  { max: 15, label: 'Healthy' },
+  { max: 30, label: 'Mildly fragmented' },
+  { max: 50, label: 'Inefficient' },
+  { max: 75, label: 'Runaway' },
+  { max: 100, label: 'Catastrophic' },
+];
+const SESSION_SEVERITY_SUBCOMMAND = 'session-severity';
+const SESSION_SEVERITY_USAGE_ARGS = [
+  `--task-size <${TASK_SIZE_VALUES.join('|')}>`,
+  '--tokens <count>',
+  '--exec-count <count>',
+  '--write-stdin-count <count>',
+  '--completion-before-tail <yes|no>',
+  '[--expected-bound <count>]',
+  `[--fragmentation <${Object.keys(FRAGMENTATION_PRESET_SCORES).join('|')}|0-25>]`,
+  `[--finish-path <${Object.keys(FINISH_PATH_PRESET_SCORES).join('|')}|0-15>]`,
+  `[--post-proof <${Object.keys(POST_PROOF_PRESET_SCORES).join('|')}|0-15>]`,
+  '[--json]',
+].join(' ');
+const SESSION_SEVERITY_COMMAND_TAIL = `${SESSION_SEVERITY_SUBCOMMAND} ${SESSION_SEVERITY_USAGE_ARGS}`;
+const SESSION_SEVERITY_EXAMPLE_ARGS = [
+  '--task-size',
+  'narrow-patch',
+  '--tokens',
+  '3850000',
+  '--exec-count',
+  '18',
+  '--write-stdin-count',
+  '6',
+  '--completion-before-tail',
+  'yes',
+  '--fragmentation',
+  '14',
+  '--finish-path',
+  '6',
+  '--post-proof',
+  '4',
+];
+const SESSION_SEVERITY_EXAMPLE_TAIL = `${SESSION_SEVERITY_SUBCOMMAND} ${SESSION_SEVERITY_EXAMPLE_ARGS.join(' ')}`;
+
+function formatInteger(value) {
+  return Number(value).toLocaleString('en-US');
+}
 
 function parseRequiredPositiveInteger(name, rawValue, { allowZero = true } = {}) {
   const parsed = Number.parseInt(String(rawValue || ''), 10);
@@ -58,8 +103,8 @@ function clampScore(value, min, max) {
 
 function parseTaskSize(rawTaskSize) {
   const normalized = String(rawTaskSize || '').trim();
-  if (!TASK_SIZE_VALUES.has(normalized)) {
-    throw new Error(`--task-size must be one of: ${Array.from(TASK_SIZE_VALUES).join(', ')}`);
+  if (!TASK_SIZE_SET.has(normalized)) {
+    throw new Error(`--task-size must be one of: ${TASK_SIZE_VALUES.join(', ')}`);
   }
   return normalized;
 }
@@ -123,11 +168,7 @@ function scorePostProof(completionBeforeTail, override) {
 }
 
 function labelForTotal(total) {
-  if (total <= 15) return 'Healthy';
-  if (total <= 30) return 'Mildly fragmented';
-  if (total <= 50) return 'Inefficient';
-  if (total <= 75) return 'Runaway';
-  return 'Catastrophic';
+  return LABEL_BANDS.find((band) => total <= band.max)?.label || LABEL_BANDS[LABEL_BANDS.length - 1].label;
 }
 
 function buildSessionSeverityReport(options) {
@@ -205,9 +246,37 @@ function renderSessionSeverityReport(report) {
   ].join('\n');
 }
 
+function renderSessionSeverityHelpDetails() {
+  const taskSizeDefaults = TASK_SIZE_VALUES
+    .map((taskSize) => `${taskSize}=${formatInteger(TASK_SIZE_UPPER_BOUNDS[taskSize])}`)
+    .join(', ');
+  const labelBands = LABEL_BANDS
+    .map((band, index) => {
+      const min = index === 0 ? 0 : LABEL_BANDS[index - 1].max + 1;
+      return `${band.label}=${min}-${band.max}`;
+    })
+    .join(', ');
+  return [`Task-size defaults: ${taskSizeDefaults}`, `Label bands: ${labelBands}`].join('\n');
+}
+
+function renderSessionSeverityCommand(toolName) {
+  return `${toolName} report ${SESSION_SEVERITY_COMMAND_TAIL}`;
+}
+
+function renderSessionSeverityExample(toolName) {
+  return `${toolName} report ${SESSION_SEVERITY_EXAMPLE_TAIL}`;
+}
+
 module.exports = {
+  LABEL_BANDS,
+  SESSION_SEVERITY_COMMAND_TAIL,
+  SESSION_SEVERITY_EXAMPLE_ARGS,
+  SESSION_SEVERITY_EXAMPLE_TAIL,
   TASK_SIZE_UPPER_BOUNDS,
   buildSessionSeverityReport,
   renderSessionSeverityReport,
+  renderSessionSeverityHelpDetails,
+  renderSessionSeverityCommand,
+  renderSessionSeverityExample,
   labelForTotal,
 };

package/templates/scripts/agent-branch-finish.sh

@@ -455,6 +455,44 @@ read_pr_state() {
   return 0
 }
 
+read_merged_pr_for_head() {
+  local head_sha="${1:-}"
+  local state_line=""
+  local parsed_state=""
+  local parsed_merged_at=""
+  local parsed_url=""
+
+  if [[ -z "$head_sha" ]]; then
+    return 1
+  fi
+
+  state_line="$("$GH_BIN" pr list \
+    --state merged \
+    --head "$SOURCE_BRANCH" \
+    --base "$BASE_BRANCH" \
+    --json state,mergedAt,url,headRefOid \
+    --jq "map(select(.headRefOid == \"$head_sha\")) | sort_by(.mergedAt // \"\") | reverse | (.[0] // {}) | [(.state // \"\"), (.mergedAt // \"\"), (.url // \"\")] | join(\"\u001f\")" \
+    2>/dev/null || true)"
+  if [[ -z "$state_line" ]]; then
+    return 1
+  fi
+
+  IFS=$'\x1f' read -r parsed_state parsed_merged_at parsed_url <<< "$state_line"
+  if [[ -z "$parsed_state" && -z "$parsed_merged_at" && -z "$parsed_url" ]]; then
+    return 1
+  fi
+  if [[ "$parsed_state" != "MERGED" && -z "$parsed_merged_at" ]]; then
+    return 1
+  fi
+
+  PR_STATE="$parsed_state"
+  PR_MERGED_AT="$parsed_merged_at"
+  if [[ -n "$parsed_url" ]]; then
+    pr_url="$parsed_url"
+  fi
+  return 0
+}
+
 wait_for_pr_merge() {
   local deadline
   deadline=$(( $(date +%s) + WAIT_TIMEOUT_SECONDS ))
@@ -509,11 +547,22 @@ wait_for_pr_merge() {
 }
 
 run_pr_flow() {
+  local source_head_sha=""
+
   if ! command -v "$GH_BIN" >/dev/null 2>&1; then
     echo "[agent-branch-finish] PR fallback requested but GitHub CLI not found: ${GH_BIN}" >&2
     return 1
   fi
 
+  source_head_sha="$(git -C "$repo_root" rev-parse "$SOURCE_BRANCH" 2>/dev/null || true)"
+  if read_merged_pr_for_head "$source_head_sha"; then
+    echo "[agent-branch-finish] Source branch head already landed in a merged PR; skipping new PR creation and continuing cleanup." >&2
+    if [[ -n "$pr_url" ]]; then
+      echo "[agent-branch-finish] Merged PR: ${pr_url}" >&2
+    fi
+    return 0
+  fi
+
   git -C "$source_worktree" push -u origin "$SOURCE_BRANCH"
 
   pr_title="$(git -C "$repo_root" log -1 --pretty=%s "$SOURCE_BRANCH" 2>/dev/null || true)"

package/templates/scripts/agent-branch-start.sh

@@ -155,6 +155,15 @@ env_flag_truthy() {
   esac
 }
 
+maybe_fail_after_auto_transfer_stash() {
+  if env_flag_truthy "${GUARDEX_TEST_FAIL_AFTER_AUTO_TRANSFER_STASH:-}"; then
+    echo "[agent-branch-start] Simulated failure after capturing auto-transfer stash." >&2
+    return 1
+  fi
+
+  return 0
+}
+
 default_worktree_root_rel() {
   local raw_agent="$1"
   local override="${GUARDEX_AGENT_TYPE:-}"
@@ -580,6 +589,27 @@ fi
 auto_transfer_stash_ref=""
 auto_transfer_message=""
 auto_transfer_source_branch=""
+auto_transfer_completed=0
+
+restore_auto_transfer_stash_on_failure() {
+  local exit_code="${1:-0}"
+  if [[ "$exit_code" -eq 0 ]] || [[ -z "$auto_transfer_stash_ref" ]] || [[ "$auto_transfer_completed" -eq 1 ]]; then
+    return 0
+  fi
+
+  local transfer_label="${auto_transfer_source_branch:-$BASE_BRANCH}"
+  if git -C "$repo_root" stash apply "$auto_transfer_stash_ref" >/dev/null 2>&1; then
+    git -C "$repo_root" stash drop "$auto_transfer_stash_ref" >/dev/null 2>&1 || true
+    auto_transfer_stash_ref=""
+    echo "[agent-branch-start] Restored moved changes back to '${transfer_label}' after startup failure." >&2
+  else
+    echo "[agent-branch-start] Startup failed and auto-restore also failed." >&2
+    echo "[agent-branch-start] Changes are preserved in ${auto_transfer_stash_ref} on ${transfer_label}." >&2
+  fi
+}
+
+trap 'restore_auto_transfer_stash_on_failure "$?"' EXIT
+
 current_branch="$(git -C "$repo_root" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
 protected_branches_raw="$(resolve_protected_branches "$repo_root")"
 if [[ -n "$current_branch" && "$current_branch" != "HEAD" ]] && is_protected_branch_name "$current_branch" "$protected_branches_raw"; then
@@ -593,6 +623,9 @@ if [[ -n "$current_branch" && "$current_branch" != "HEAD" ]] && is_protected_bra
       if [[ -n "$auto_transfer_stash_ref" ]]; then
         auto_transfer_source_branch="$current_branch"
         echo "[agent-branch-start] Detected local changes on protected branch '${current_branch}'. Moving them to '${branch_name}'..."
+        if ! maybe_fail_after_auto_transfer_stash; then
+          exit 1
+        fi
       fi
     fi
   fi
@@ -610,7 +643,9 @@ git -C "$worktree_path" branch --unset-upstream "$branch_name" >/dev/null 2>&1 |
 
 if [[ -n "$auto_transfer_stash_ref" ]]; then
   if git -C "$worktree_path" stash apply "$auto_transfer_stash_ref" >/dev/null 2>&1; then
+    auto_transfer_completed=1
     git -C "$repo_root" stash drop "$auto_transfer_stash_ref" >/dev/null 2>&1 || true
+    auto_transfer_stash_ref=""
     transfer_label="${auto_transfer_source_branch:-$BASE_BRANCH}"
     echo "[agent-branch-start] Moved local changes from '${transfer_label}' into '${branch_name}'."
   else