@imdeadpool/guardex 7.0.26 → 7.0.27

package/README.md

@@ -111,6 +111,16 @@ gx setup
 
 That's it. Install and update via `@imdeadpool/guardex`. Setup installs the minimal repo footprint: managed hook shims, repo-local state, AGENTS wiring, OpenSpec/caveman/OMX scaffolding, and a small set of repo-local helper assets. Aliases: `gx` (preferred), `gitguardex` (full), `guardex` (legacy compatibility).
 
+### Install surfaces at a glance
+
+| Goal | Command | Installs |
+| --- | --- | --- |
+| Global Guardex CLI | `npm i -g @imdeadpool/guardex` | `gx`, `gitguardex`, `guardex`, and the CLI runtime |
+| User-level Codex/Claude companions | `gx install-agent-skills` | `~/.codex/skills/gitguardex/SKILL.md`, `~/.codex/skills/guardex-merge-skills-to-dev/SKILL.md`, and `~/.claude/commands/gitguardex.md` |
+| Generic repo skill catalog | `npx skills add recodee/` or `npx skills add recodee/gitguardex` | the repo-root `skills/` catalog for agents that support the generic installer |
+
+These paths are complementary, not chained together. `npm i -g @imdeadpool/guardex` does not auto-run `npx skills add ...`.
+
 ---
 
 ## How `AGENTS.md` and `CLAUDE.md` are handled
@@ -140,7 +150,14 @@ That's it. Install and update via `@imdeadpool/guardex`. Setup installs the mini
 </div>
 
 > [!NOTE]
-> In this repo, `CLAUDE.md` is a symlink to `AGENTS.md`, so Claude reads the same contract. Optional Codex/Claude companion files still install at the user level with `gx install-agent-skills`, while the generic repo skill catalog is available through `npx skills add recodeee/` or directly via `npx skills add recodeee/gitguardex`.
+> In this repo, `CLAUDE.md` is a symlink to `AGENTS.md`, so Claude reads the same contract as Codex.
+>
+> Keep the install paths separate:
+> - `npm i -g @imdeadpool/guardex` installs the Guardex CLI.
+> - `gx install-agent-skills` installs the user-level Codex/Claude companion files.
+> - `npx skills add recodee/` or `npx skills add recodee/gitguardex` installs the generic repo skill catalog.
+>
+> The global npm install does not auto-run the generic `npx skills add ...` flow.
 
 ### Decision flow
 
@@ -461,17 +478,19 @@ Repo: <https://github.com/Yeachan-Heo/oh-my-claudecode>
 
 ### GitGuardex skills - install the repo skill catalog through `npx skills`
 
-For agents that already support the generic `skills` installer flow, GitGuardex now exposes its repo skill catalog directly. You can start from the broader `recodeee` source or jump straight into this repo's catalog.
+For agents that already support the generic `skills` installer flow, GitGuardex exposes its repo skill catalog directly. Use it as a separate install path after the CLI install. You can start from the broader `recodee` source or jump straight into this repo's catalog.
 
 ```sh
-npx skills add recodeee/
+npx skills add recodee/
 ```
 
 ```sh
-npx skills add recodeee/gitguardex
+npx skills add recodee/gitguardex
 ```
 
-This repo currently exposes `gitguardex` and `guardex-merge-skills-to-dev` through that flow. If the picker does not show a separate `guardex` skill, that is expected: `guardex` remains the legacy CLI alias, while the repo skill itself is named `gitguardex`. Use `gx install-agent-skills` when you want the Codex/Claude user-home startup files instead of the generic `skills` catalog.
+This repo currently exposes `gitguardex` and `guardex-merge-skills-to-dev` through that flow. If the picker does not show a separate `guardex` skill, that is expected: `guardex` remains the legacy CLI alias, while the repo skill itself is named `gitguardex`.
+
+Need the Codex/Claude user-home startup files instead? Run `gx install-agent-skills`. Need the generic repo catalog? Run `npx skills add ...`. They solve different setup surfaces.
 
 Repo: <https://github.com/recodeee/gitguardex>
 [![GitHub stars](https://img.shields.io/github/stars/recodeee/gitguardex?style=social)](https://github.com/recodeee/gitguardex)
@@ -626,7 +645,7 @@ vscode/guardex-active-agents/README.md
 
 Legacy compatibility note: older repos may still contain repo-local workflow scripts under `scripts/`. Direct `gx branch ...`, `gx locks ...`, `gx finish`, `gx cleanup`, `gx merge`, and `gx migrate` do not require them. `gx migrate` removes those leftover workflow shims by default. The CLI still honors repo-local `scripts/review-bot-watch.sh` and `scripts/codex-agent.sh` when they are already present so older repos can keep working during migration.
 
-Optional Codex/Claude user-level companions still install with `gx install-agent-skills`; the generic repo skill catalog is available with `npx skills add recodeee/` or directly via `npx skills add recodeee/gitguardex`. Neither path copies those user-home files into each repo.
+Optional Codex/Claude user-level companions still install with `gx install-agent-skills`; the generic repo skill catalog is available with `npx skills add recodee/` or directly via `npx skills add recodee/gitguardex`. Neither path copies those user-home files into each repo, and the global Guardex npm install does not trigger the `npx skills add ...` path for you.
 
 ---
 
@@ -689,9 +708,15 @@ npm pack --dry-run
 <details>
 <summary><strong>v7.x</strong></summary>
 
+### v7.0.27
+- Bumped `@imdeadpool/guardex` from `7.0.26` to `7.0.27` so npm can publish a fresh version after `7.0.26` was already taken on the registry.
+- The shipped `agent-branch-start.sh` copies now keep the startup auto-transfer path alive under `set -o pipefail`, so Guardex can still restore moved changes back to the protected checkout when branch startup hits a later failure.
+- The shipped `agent-branch-finish.sh` copies now keep PR-only finish runs from opening temporary integration repos, so maintainers can finish directly through the existing PR lane without extra temp-repo churn.
+- Keep the release scoped to version metadata for the already-merged `main` payload; no additional runtime behavior changes are introduced in this release lane.
+
 ### v7.0.26
 - Bumped `@imdeadpool/guardex` from `7.0.25` to `7.0.26` so npm can publish a fresh version after `v7.0.25` reached GitHub Releases while the registry stayed on `7.0.24`.
-- README now documents both `npx skills add recodeee/` and `npx skills add recodeee/gitguardex`, and explains why the picker shows `gitguardex` instead of a separate `guardex` skill.
+- README now documents both `npx skills add recodee/` and `npx skills add recodee/gitguardex`, clarifies that the global Guardex npm install does not auto-run the generic skills installer, and explains why the picker shows `gitguardex` instead of a separate `guardex` skill.
 - Keep the release scoped to version metadata plus the already-merged README installer guidance on `main`; no additional CLI/runtime behavior changed in this lane.
 
 ### v7.0.25

package/SECURITY.md

@@ -8,7 +8,7 @@ Only the latest published GitGuardex CLI build is supported for security fixes.
 
 Please report security issues privately by opening a GitHub security advisory:
 
-- https://github.com/recodeecom/multiagent-safety/security/advisories/new
+- https://github.com/recodeee/gitguardex/security/advisories/new
 
 If advisories are unavailable, open a private report via GitHub issue contact details and avoid posting exploit details publicly.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imdeadpool/guardex",
-  "version": "7.0.26",
+  "version": "7.0.27",
   "description": "Guardian T-Rex for your multi-agent repo. Isolated worktrees, file locks, and PR-only merges stop parallel Codex & Claude agents from overwriting each other's work. Auto-wires Oh My Codex, Oh My Claude, OpenSpec, and Caveman.",
   "license": "MIT",
   "preferGlobal": true,
@@ -68,10 +68,10 @@
     "access": "public"
   },
   "devDependencies": {
-    "fast-check": "^3.23.2"
+    "fast-check": "3.23.2"
   },
   "dependencies": {
-    "jsonc-parser": "^3.3.1",
-    "semver": "^7.7.4"
+    "jsonc-parser": "3.3.1",
+    "semver": "7.7.4"
   }
 }

package/templates/scripts/agent-branch-finish.sh

@@ -277,6 +277,10 @@ created_source_probe=0
 source_probe_path=""
 integration_worktree=""
 integration_branch=""
+merge_completed=0
+merge_status="pr"
+direct_push_error=""
+pr_url=""
 
 cleanup() {
   if [[ -n "$integration_worktree" && -d "$integration_worktree" ]]; then
@@ -358,22 +362,6 @@ if [[ "$should_require_sync" -eq 1 ]] && git -C "$repo_root" show-ref --verify -
   fi
 fi
 
-integration_stamp="$(date +%Y%m%d-%H%M%S)"
-integration_worktree_base="${temp_worktree_root}/__integrate-${BASE_BRANCH//\//__}-${integration_stamp}"
-integration_branch_base="__agent_integrate_${BASE_BRANCH//\//_}_$(date +%Y%m%d_%H%M%S)"
-integration_worktree="$integration_worktree_base"
-integration_branch="$integration_branch_base"
-integration_suffix=1
-while [[ -e "$integration_worktree" ]] || git -C "$repo_root" show-ref --verify --quiet "refs/heads/${integration_branch}"; do
-  integration_worktree="${integration_worktree_base}-${integration_suffix}"
-  integration_branch="${integration_branch_base}_${integration_suffix}"
-  integration_suffix=$((integration_suffix + 1))
-done
-mkdir -p "$(dirname "$integration_worktree")"
-
-git -C "$repo_root" worktree add "$integration_worktree" "$start_ref" >/dev/null
-git -C "$integration_worktree" checkout -b "$integration_branch" >/dev/null
-
 if git -C "$repo_root" show-ref --verify --quiet "refs/remotes/origin/${BASE_BRANCH}"; then
   git -C "$source_worktree" fetch origin "$BASE_BRANCH" --quiet
 
@@ -395,16 +383,37 @@ if git -C "$repo_root" show-ref --verify --quiet "refs/remotes/origin/${BASE_BRA
   git -C "$source_worktree" merge --abort >/dev/null 2>&1 || true
 fi
 
-if ! git -C "$integration_worktree" merge --no-ff --no-edit "$SOURCE_BRANCH"; then
-  echo "[agent-branch-finish] Merge conflict detected while merging '${SOURCE_BRANCH}' into '${BASE_BRANCH}'." >&2
-  git -C "$integration_worktree" merge --abort >/dev/null 2>&1 || true
-  exit 1
+should_create_integration_helper=1
+if [[ "$MERGE_MODE" == "pr" && "$PUSH_ENABLED" -eq 1 ]]; then
+  should_create_integration_helper=0
 fi
 
-merge_completed=1
-merge_status="direct"
-direct_push_error=""
-pr_url=""
+if [[ "$should_create_integration_helper" -eq 1 ]]; then
+  integration_stamp="$(date +%Y%m%d-%H%M%S)"
+  integration_worktree_base="${temp_worktree_root}/__integrate-${BASE_BRANCH//\//__}-${integration_stamp}"
+  integration_branch_base="__agent_integrate_${BASE_BRANCH//\//_}_$(date +%Y%m%d_%H%M%S)"
+  integration_worktree="$integration_worktree_base"
+  integration_branch="$integration_branch_base"
+  integration_suffix=1
+  while [[ -e "$integration_worktree" ]] || git -C "$repo_root" show-ref --verify --quiet "refs/heads/${integration_branch}"; do
+    integration_worktree="${integration_worktree_base}-${integration_suffix}"
+    integration_branch="${integration_branch_base}_${integration_suffix}"
+    integration_suffix=$((integration_suffix + 1))
+  done
+  mkdir -p "$(dirname "$integration_worktree")"
+
+  git -C "$repo_root" worktree add "$integration_worktree" "$start_ref" >/dev/null
+  git -C "$integration_worktree" checkout -b "$integration_branch" >/dev/null
+
+  if ! git -C "$integration_worktree" merge --no-ff --no-edit "$SOURCE_BRANCH"; then
+    echo "[agent-branch-finish] Merge conflict detected while merging '${SOURCE_BRANCH}' into '${BASE_BRANCH}'." >&2
+    git -C "$integration_worktree" merge --abort >/dev/null 2>&1 || true
+    exit 1
+  fi
+
+  merge_completed=1
+  merge_status="direct"
+fi
 
 is_local_branch_delete_error() {
   local output="$1"

package/templates/scripts/agent-branch-start.sh

@@ -370,6 +370,19 @@ has_local_changes() {
   return 1
 }
 
+resolve_stash_ref_by_message() {
+  local root="$1"
+  local message="$2"
+  local stash_list
+  stash_list="$(git -C "$root" stash list 2>/dev/null || true)"
+  if [[ -z "$stash_list" ]]; then
+    printf ''
+    return 0
+  fi
+
+  awk -v msg="$message" '$0 ~ msg { ref=$1; sub(/:$/, "", ref); print ref; exit }' <<<"$stash_list"
+}
+
 resolve_protected_branches() {
   local root="$1"
   local raw
@@ -616,10 +629,7 @@ if [[ -n "$current_branch" && "$current_branch" != "HEAD" ]] && is_protected_bra
   if has_local_changes "$repo_root"; then
     auto_transfer_message="guardex-auto-transfer-${timestamp}-${agent_slug}-${task_slug}"
     if git -C "$repo_root" stash push --include-untracked --message "$auto_transfer_message" >/dev/null 2>&1; then
-      auto_transfer_stash_ref="$(
-        git -C "$repo_root" stash list \
-          | awk -v msg="$auto_transfer_message" '$0 ~ msg { ref=$1; sub(/:$/, "", ref); print ref; exit }'
-      )"
+      auto_transfer_stash_ref="$(resolve_stash_ref_by_message "$repo_root" "$auto_transfer_message")"
       if [[ -n "$auto_transfer_stash_ref" ]]; then
         auto_transfer_source_branch="$current_branch"
         echo "[agent-branch-start] Detected local changes on protected branch '${current_branch}'. Moving them to '${branch_name}'..."

package/templates/vscode/guardex-active-agents/extension.js

@@ -3,11 +3,13 @@ const path = require('node:path');
 const cp = require('node:child_process');
 const vscode = require('vscode');
 const {
+  clearWorktreeActivityCache,
   formatElapsedFrom,
   readActiveSessions,
   readRepoChanges,
   readSessionInspectData,
   sanitizeBranchForFile,
+  sessionFilePathForBranch,
 } = require('./session-schema.js');
 
 const SESSION_DECORATION_SCHEME = 'gitguardex-agent';
@@ -65,6 +67,7 @@ const SESSION_ACTIVITY_ICON_IDS = {
   stalled: 'clock',
   dead: 'error',
 };
+const DISMISSABLE_SESSION_ACTIVITY_KINDS = new Set(['stalled', 'dead']);
 const SESSION_PROVIDER_BRANDS = {
   openai: {
     id: 'openai',
@@ -693,6 +696,14 @@ function changeRiskBadges(change) {
   ].filter(Boolean));
 }
 
+function changeNeedsWarningIcon(change) {
+  return Boolean(
+    change?.protectedBranch
+    || change?.hasForeignLock
+    || (!change?.hasForeignLock && change?.lockOwnerBranch),
+  );
+}
+
 function buildSessionCardDescription(session) {
   const provider = resolveSessionProvider(session);
   const statusAgentLabel = `${sessionStatusLabel(session)}: ${session.agentName || 'agent'}`;
@@ -1289,7 +1300,7 @@ class SessionItem extends vscode.TreeItem {
       : buildSessionCardDescription(session);
     this.tooltip = buildSessionTooltip(session, this.description);
     this.iconPath = themeIcon(resolveSessionActivityIconId(session.activityKind));
-    this.contextValue = 'gitguardex.session';
+    this.contextValue = sessionContextValue(session);
     this.command = {
       command: 'gitguardex.activeAgents.openWorktree',
       title: 'Open Agent Worktree',
@@ -1298,6 +1309,35 @@ class SessionItem extends vscode.TreeItem {
   }
 }
 
+function sessionContextValue(session) {
+  const activityKind = typeof session?.activityKind === 'string' ? session.activityKind.trim() : '';
+  return activityKind
+    ? `gitguardex.session.${activityKind}`
+    : 'gitguardex.session';
+}
+
+function canDismissSession(session) {
+  return DISMISSABLE_SESSION_ACTIVITY_KINDS.has(session?.activityKind);
+}
+
+function buildDismissSessionDetail(session, statePath) {
+  const repoRoot = typeof session?.repoRoot === 'string' ? session.repoRoot.trim() : '';
+  const relativeStatePath = repoRoot
+    ? path.relative(repoRoot, statePath) || path.basename(statePath)
+    : path.basename(statePath);
+  const detailParts = [
+    `Remove ${relativeStatePath} and hide this session from Active Agents.`,
+  ];
+
+  if (session?.activityKind === 'stalled') {
+    detailParts.push('This dismisses the stale sidebar row only; use Stop if you want to interrupt a live agent.');
+  } else {
+    detailParts.push('This clears the stale session record from the sidebar.');
+  }
+
+  return detailParts.join(' ');
+}
+
 class FolderItem extends vscode.TreeItem {
   constructor(label, relativePath, items, options = {}) {
     super(
@@ -1845,6 +1885,51 @@ async function stopSession(session, refresh) {
   }
 }
 
+async function dismissSession(session, refresh) {
+  if (!canDismissSession(session)) {
+    showSessionMessage('Only stalled or dead sessions can be dismissed.');
+    return;
+  }
+
+  const repoRoot = typeof session?.repoRoot === 'string' ? session.repoRoot.trim() : '';
+  if (!repoRoot) {
+    showSessionMessage('Cannot dismiss session: missing repo root.');
+    return;
+  }
+  if (!session?.branch) {
+    showSessionMessage('Cannot dismiss session: missing branch name.');
+    return;
+  }
+
+  const statePath = sessionFilePathForBranch(repoRoot, session.branch);
+  if (!fs.existsSync(statePath)) {
+    clearWorktreeActivityCache(session.worktreePath);
+    refresh();
+    showSessionMessage(`Session record already gone for ${sessionDisplayLabel(session)}.`);
+    return;
+  }
+
+  const confirmed = await vscode.window.showWarningMessage(
+    `Dismiss ${sessionDisplayLabel(session)}?`,
+    {
+      modal: true,
+      detail: buildDismissSessionDetail(session, statePath),
+    },
+    'Dismiss',
+  );
+  if (confirmed !== 'Dismiss') {
+    return;
+  }
+
+  try {
+    fs.unlinkSync(statePath);
+    clearWorktreeActivityCache(session.worktreePath);
+    refresh();
+  } catch (error) {
+    showSessionMessage(`Failed to dismiss session ${sessionDisplayLabel(session)}: ${error.message}`);
+  }
+}
+
 function readGitDirPath(targetPath) {
   const normalizedTargetPath = typeof targetPath === 'string' ? targetPath.trim() : '';
   if (!normalizedTargetPath) {
@@ -2719,7 +2804,7 @@ function buildUnassignedChangeNodes(changes) {
   return sortUnassignedChanges(changes).map((change) => new ChangeItem(change, {
     label: compactRelativePath(change.relativePath),
     description: buildUnassignedChangeDescription(change),
-    iconId: changeRiskBadges(change).length > 0 ? 'warning' : undefined,
+    iconId: changeNeedsWarningIcon(change) ? 'warning' : undefined,
   }));
 }
 
@@ -3358,6 +3443,7 @@ function activate(context) {
     vscode.commands.registerCommand('gitguardex.activeAgents.finishSession', finishSession),
     vscode.commands.registerCommand('gitguardex.activeAgents.syncSession', syncSession),
     vscode.commands.registerCommand('gitguardex.activeAgents.stopSession', (session) => stopSession(session, refresh)),
+    vscode.commands.registerCommand('gitguardex.activeAgents.dismissSession', (session) => dismissSession(session, refresh)),
     vscode.workspace.onDidChangeWorkspaceFolders(handleWorkspaceFoldersChanged),
     activeSessionsWatcher,
     lockWatcher,

package/templates/vscode/guardex-active-agents/package.json

@@ -3,7 +3,7 @@
   "displayName": "GitGuardex Active Agents",
   "description": "Shows live Guardex sandbox sessions and repo changes in a dedicated VS Code Active Agents sidebar.",
   "publisher": "recodeee",
-  "version": "0.0.17",
+  "version": "0.0.18",
   "license": "MIT",
   "icon": "icon.png",
   "engines": {
@@ -65,6 +65,11 @@
         "title": "Stop",
         "icon": "$(debug-stop)"
       },
+      {
+        "command": "gitguardex.activeAgents.dismissSession",
+        "title": "Dismiss",
+        "icon": "$(trash)"
+      },
       {
         "command": "gitguardex.activeAgents.showSessionTerminal",
         "title": "Show Terminal",
@@ -125,32 +130,37 @@
       "view/item/context": [
         {
           "command": "gitguardex.activeAgents.openWorktree",
-          "when": "view == gitguardex.activeAgents && viewItem == gitguardex.session",
+          "when": "view == gitguardex.activeAgents && viewItem =~ /^gitguardex\\.session(\\.|$)/",
           "group": "inline"
         },
         {
           "command": "gitguardex.activeAgents.inspect",
-          "when": "view == gitguardex.activeAgents && viewItem == gitguardex.session",
+          "when": "view == gitguardex.activeAgents && viewItem =~ /^gitguardex\\.session(\\.|$)/",
           "group": "inline"
         },
         {
           "command": "gitguardex.activeAgents.showSessionTerminal",
-          "when": "view == gitguardex.activeAgents && viewItem == gitguardex.session",
+          "when": "view == gitguardex.activeAgents && viewItem =~ /^gitguardex\\.session(\\.|$)/",
           "group": "inline"
         },
         {
           "command": "gitguardex.activeAgents.finishSession",
-          "when": "view == gitguardex.activeAgents && viewItem == gitguardex.session",
+          "when": "view == gitguardex.activeAgents && viewItem =~ /^gitguardex\\.session(\\.|$)/",
           "group": "inline"
         },
         {
           "command": "gitguardex.activeAgents.syncSession",
-          "when": "view == gitguardex.activeAgents && viewItem == gitguardex.session",
+          "when": "view == gitguardex.activeAgents && viewItem =~ /^gitguardex\\.session(\\.|$)/",
           "group": "inline"
         },
         {
           "command": "gitguardex.activeAgents.stopSession",
-          "when": "view == gitguardex.activeAgents && viewItem == gitguardex.session",
+          "when": "view == gitguardex.activeAgents && viewItem =~ /^gitguardex\\.session(\\.|$)/",
+          "group": "inline"
+        },
+        {
+          "command": "gitguardex.activeAgents.dismissSession",
+          "when": "view == gitguardex.activeAgents && viewItem =~ /^gitguardex\\.session\\.(stalled|dead)$/",
           "group": "inline"
         }
       ]