@kylecheng3146/agent-ops 0.1.13 → 0.1.15

package/dist/runtime/src/review/attestation.js

@@ -0,0 +1,65 @@
+import { join } from "node:path";
+import { AgentOpsError } from "../fs/paths.js";
+import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+const FINGERPRINT_PATTERN = /^[a-f0-9]{64}$/u;
+const TASK_ID_PATTERN = /^[A-Za-z0-9._-]{1,128}$/u;
+export const REVIEW_ATTESTATION_DIRECTORY = ".agent-ops/reviews";
+function attestationPath(root, fingerprint) {
+    return join(root, ...REVIEW_ATTESTATION_DIRECTORY.split("/"), `${fingerprint}.json`);
+}
+function parseAttestation(value) {
+    if (typeof value !== "object" || value === null) {
+        return null;
+    }
+    const record = value;
+    if (record.schemaVersion !== 1 ||
+        record.status !== "PASS" ||
+        (record.taskId !== undefined &&
+            (typeof record.taskId !== "string" ||
+                !TASK_ID_PATTERN.test(record.taskId))) ||
+        typeof record.harness !== "string" ||
+        !TASK_ID_PATTERN.test(record.harness) ||
+        typeof record.sourceFingerprint !== "string" ||
+        !FINGERPRINT_PATTERN.test(record.sourceFingerprint) ||
+        typeof record.createdAt !== "string" ||
+        !Number.isFinite(Date.parse(record.createdAt))) {
+        return null;
+    }
+    return {
+        schemaVersion: 1,
+        ...(record.taskId === undefined ? {} : { taskId: record.taskId }),
+        harness: record.harness,
+        status: "PASS",
+        sourceFingerprint: record.sourceFingerprint,
+        createdAt: record.createdAt
+    };
+}
+export async function saveReviewAttestation(root, attestation) {
+    const validated = parseAttestation(attestation);
+    if (validated === null) {
+        throw new AgentOpsError("REVIEW_ATTESTATION_INVALID", "Review attestation is invalid.");
+    }
+    const relativePath = `${REVIEW_ATTESTATION_DIRECTORY}/${validated.sourceFingerprint}.json`;
+    await writePrivateFile(attestationPath(root, validated.sourceFingerprint), `${JSON.stringify(validated, null, 2)}\n`, root);
+    return relativePath;
+}
+/**
+ * Returns the attestation recorded for this exact source state, or null. A
+ * malformed file reads as absent: a gate must fail closed on garbage, never
+ * treat it as a passing review.
+ */
+export async function findReviewAttestation(root, sourceFingerprint) {
+    if (!FINGERPRINT_PATTERN.test(sourceFingerprint)) {
+        return null;
+    }
+    const source = await readPrivateFile(attestationPath(root, sourceFingerprint), root);
+    if (source === null) {
+        return null;
+    }
+    try {
+        return parseAttestation(JSON.parse(source));
+    }
+    catch {
+        return null;
+    }
+}

package/dist/runtime/src/review/execute.js

@@ -140,6 +140,9 @@ export function createReviewExecutor(options) {
                 if (spawned.stdoutTruncated || spawned.stderrTruncated) {
                     return { status: "NOT_RUN", reason: "output-too-large", harness: target };
                 }
+                if (spawned.failureClass === "nonzero-exit") {
+                    return { status: "NOT_RUN", reason: "login-required", harness: target };
+                }
                 const payload = extractReviewObject(target, spawned.stdout);
                 const parsed = payload === undefined
                     ? undefined

package/docs/en/guides/configuration.md

@@ -47,9 +47,10 @@ Enable it during `agent-ops init`, or by hand:
 ```
 
 `targets` is an **ordered fallback chain**. Every review locks to the
-staged/unstaged/untracked surface (or a clean `--base <ref>...HEAD` range),
-requires fresh PASS evidence for required checks, and prints a complete native
-schema report without persisting it.
+staged/unstaged/untracked surface (or a clean `--base <ref>...HEAD` range).
+A bare review uses the built-in `change-quality` criterion; `--task` uses the
+task criteria and requires fresh PASS evidence for required checks. The full
+report is printed, and PASS persists only a source-fingerprint attestation.
 
 Every attempt starts from a fresh temporary cwd with a narrow environment. The
 following target identities may be configured; only Claude currently meets the
@@ -102,20 +103,25 @@ interactive OAuth, so there is no `--fix`. Run `<target> login` yourself.
 ### Project-local loop profile
 
 `--profile loop` is an opt-in project-scope profile. Select `codex`, `claude`,
-or both (for example, `--harness codex,claude`); it requires a
-POSIX-compatible `bash` and does not support Windows launchers yet. Start with
-a dry run:
+or both (for example, `--harness codex,claude`). Claude Code supports native
+Windows through a generated PowerShell launcher; Codex's loop launcher still
+requires POSIX-compatible `bash`. Start with a dry run:
 
 ```bash
 agent-ops init --dry-run --scope project --harness codex,claude --profile loop --json
 agent-ops init --scope project --harness codex,claude --profile loop --yes
 ```
 
-For each selected supported harness, agent-ops owns exactly one small launcher:
-`.codex/hooks/agent-ops-loop.sh` or `.claude/hooks/agent-ops-loop.sh`. Both
-launchers delegate to the same installed Node runtime, so they do not copy a
-project-specific loop script. Codex also gets `.codex/config.toml` only when it
-is absent. First installation seeds, without replacing existing content,
+On native Windows, select `--harness claude` unless Codex is running in a
+POSIX environment; the Codex loop still invokes `bash`.
+
+For each selected supported harness, agent-ops owns the minimal native
+launchers: `.codex/hooks/agent-ops-loop.sh` for Codex, and
+`.claude/hooks/agent-ops-loop.sh` plus `.claude/hooks/agent-ops-loop.ps1` for
+Claude Code. Both Claude launchers delegate to the same installed Node
+runtime, so they do not copy a project-specific loop script. On Windows,
+Claude's generated settings select the PowerShell launcher. Codex also gets
+`.codex/config.toml` only when it is absent. First installation seeds, without replacing existing content,
 `loop-goal.md`, `loop-state.md`, and `loop-telemetry.jsonl` under the selected
 harness directory. A hash-commented `.gitignore` block ignores those local
 files.
@@ -194,7 +200,6 @@ Changing this feature changes native registration. Run:
 
 ```bash
 agent-ops update
-agent-ops trust grant
 ```
 
 Without `update`, doctor can report `UPDATE_REQUIRED` for registration drift.
@@ -202,14 +207,14 @@ Separately, after a toolkit upgrade or effective profile or capability change
 alters an intact path-independent managed rules artifact,
 `artifact-staleness` reports `DEGRADED` with `UPDATE_REQUIRED`. `agent-ops
 update` regenerates the artifact and clears that result; a missing or
-hash-mismatched artifact remains an `artifacts` `FAIL`. Without the new trust
-grant, trust-gated hooks remain stale.
+hash-mismatched artifact remains an `artifacts` `FAIL`. Confirmed project
+updates automatically replace the stale trust binding when verifiers exist.
 
 Doctor never writes, and some findings have no fix: a surface outside the
 installation root, or a capability a harness only partially supports by
 descriptor declaration (opencode's `lifecycle-summary`, for example), report
 `UNKNOWN` or `DEGRADED` permanently and exit 0. CI that wants automatic
-repair calls `agent-ops update` / `agent-ops trust grant` directly rather
+repair calls `agent-ops update` or the manual `agent-ops trust grant` directly rather
 than parsing doctor's output.
 
 Stop is report-only: it continues the

package/docs/en/spec/README.md

@@ -7,7 +7,8 @@ integration is a generated local plugin; it does not manage `opencode.json`.
 
 Configuration is versioned independently from the manifest. Config v1 migrates
 to config v2 with Stop verification disabled; changing the capability requires
-`agent-ops update` followed by `agent-ops trust grant`. Stop verification is
+a confirmed project `agent-ops update`, which also refreshes trust when
+verifiers exist. Stop verification is
 explicit, trusted, report-only, and never completes a task. Dry-run plans keep
 foreign settings opaque, and the routing migration is one-way once applied.
 

package/docs/en/spec/harness-adapters.md

@@ -85,7 +85,8 @@ policy into project-specific scripts or alter an ordinary permission request.
 
 - Trigger: A project selects `loop` with Codex, Claude Code, or both.
 - Action: Generate only the selected `.codex/hooks/agent-ops-loop.sh` and/or
-  `.claude/hooks/agent-ops-loop.sh` launchers, register the documented loop
+  Claude's `.claude/hooks/agent-ops-loop.sh` plus
+  `.claude/hooks/agent-ops-loop.ps1` launchers, register the documented loop
   lifecycle events except `Stop`, and preserve foreign hook groups. Block only
   high-confidence literal credentials at `UserPromptSubmit` or Bash
   `PreToolUse`, and dangerous Bash commands at `PreToolUse`, using the documented native denial shape. Emit no

package/docs/zh-TW/guides/configuration.md

@@ -42,8 +42,9 @@ Claude 與 Codex lifecycle support 為 `supported`，OpenCode 從 app initializa
 ```
 
 `targets` 是**有序的後備鏈**。每次 review 都鎖定 staged／unstaged／untracked
-變更（或乾淨的 `--base <ref>...HEAD`），並要求必要驗證的最新 PASS evidence；
-完整原生 schema report 會顯示給人看，但不會持久化。
+變更（或乾淨的 `--base <ref>...HEAD`）。裸跑使用內建 `change-quality` 準則；
+`--task` 使用 task criteria，並要求必要驗證的最新 PASS evidence。完整 report
+會顯示給人看，PASS 後只持久化 source-fingerprint attestation。
 
 每次嘗試都從新的暫存 cwd 與最小環境啟動。目前只有 Claude 具備完整的
 context-isolation 合約，能自動執行：
@@ -90,18 +91,24 @@ agent-ops doctor --check-auth # 每個目標一次真實 print 呼叫
 ### Project-local loop profile
 
 `--profile loop` 是明確 opt-in 的 project-scope profile。請選擇 `codex`、
-`claude` 或兩者（例如 `--harness codex,claude`）；它需要 POSIX-compatible
-`bash`，目前尚未支援 Windows launcher。建議先 dry run：
+`claude` 或兩者（例如 `--harness codex,claude`）。Claude Code 已支援原生
+Windows，會使用產生的 PowerShell launcher；Codex 的 loop launcher 仍需要
+POSIX-compatible `bash`。建議先 dry run：
 
 ```bash
 agent-ops init --dry-run --scope project --harness codex,claude --profile loop --json
 agent-ops init --scope project --harness codex,claude --profile loop --yes
 ```
 
-對每個選定且支援的 harness，agent-ops 只擁有一個小型 launcher：
-`.codex/hooks/agent-ops-loop.sh` 或 `.claude/hooks/agent-ops-loop.sh`。兩個
-launcher 都委派給同一個已安裝的 Node runtime，因此不會複製 project-specific
-loop script。Codex 只會在 `.codex/config.toml` 不存在時建立它。首次安裝會在不
+在原生 Windows 上，除非 Codex 是在 POSIX environment 執行，請選擇
+`--harness claude`；Codex loop 仍會呼叫 `bash`。
+
+對每個選定且支援的 harness，agent-ops 擁有最小的 native launcher：Codex 是
+`.codex/hooks/agent-ops-loop.sh`；Claude Code 是
+`.claude/hooks/agent-ops-loop.sh` 與 `.claude/hooks/agent-ops-loop.ps1`。兩個
+Claude launcher 都委派給同一個已安裝的 Node runtime，因此不會複製
+project-specific loop script。Windows 產生的 settings 會選用 PowerShell
+launcher。Codex 只會在 `.codex/config.toml` 不存在時建立它。首次安裝會在不
 覆寫既有內容的前提下，於選定 harness directory 建立 `loop-goal.md`、
 `loop-state.md` 與 `loop-telemetry.jsonl`；並以 hash-commented `.gitignore`
 block 忽略這些 local file。
@@ -175,7 +182,6 @@ config v2 feature，必須明確啟用且至少提供一個已確認的 command
 
 ```bash
 agent-ops update
-agent-ops trust grant
 ```
 
 未執行 `update` 時，doctor 可因 registration drift 回報 `UPDATE_REQUIRED`。另
@@ -183,12 +189,12 @@ agent-ops trust grant
 path-independent managed rules artifact 改變時，`artifact-staleness` 會回報帶有
 `UPDATE_REQUIRED` 的 `DEGRADED`。`agent-ops update` 會重新產生 artifact 並清除
 這個結果；artifact 缺失或 hash 不符時，`artifacts` check 仍為 `FAIL`。未重新
-grant trust 時，trust-gated hook 仍會是 stale。
+project update 經確認後，若有 verifier 會自動更新 stale trust binding。
 
 doctor 從不寫入檔案，部分結果本來就無法修復：安裝根目錄以外的 surface，
 或 harness 依 descriptor 宣告只部分支援的 capability（例如 opencode 的
 `lifecycle-summary`），會永久回報 `UNKNOWN` 或 `DEGRADED` 且 exit 0。若 CI
-需要自動修復，請直接呼叫 `agent-ops update` / `agent-ops trust grant`，
+需要自動修復，請直接呼叫 `agent-ops update`；也可手動呼叫 `agent-ops trust grant`，
 不要解析 doctor 的輸出。
 
 Stop 是 report-only：`PASS`、`FAIL`

package/docs/zh-TW/spec/README.md

@@ -6,8 +6,8 @@ Harness adapter 規則涵蓋 Codex、Claude Code 與 opencode。opencode 整合
 產生的 local plugin，不管理 `opencode.json`。
 
 Configuration 與 manifest 分開版本化。Config v1 會遷移為預設 disabled Stop
-verification 的 config v2；變更 capability 後必須先執行 `agent-ops update`，
-再執行 `agent-ops trust grant`。Stop verification 必須明確啟用、具備 trust、
+verification 的 config v2；變更 capability 後必須執行經確認的 project
+`agent-ops update`，有 verifier 時會一併更新 trust。Stop verification 必須明確啟用、具備 trust、
 為 report-only，且永遠不會完成 task。Dry-run plan 會隱藏 foreign settings
 內容；routing migration 一旦套用即為單向。
 

package/docs/zh-TW/spec/harness-adapters.md

@@ -72,8 +72,8 @@ Claude Code launcher 後使用同一個 shared runtime。它 MUST NOT 將 policy
 project-specific script，也不得改變一般 permission request。
 
 - Trigger: Project 以 Codex、Claude Code 或兩者選擇 `loop`。
-- Action: 只產生選定的 `.codex/hooks/agent-ops-loop.sh` 與／或
-  `.claude/hooks/agent-ops-loop.sh` launcher，註冊文件化的 loop lifecycle event
+- Action: 只產生選定的 `.codex/hooks/agent-ops-loop.sh` 與／或 Claude 的
+  `.claude/hooks/agent-ops-loop.sh`、`.claude/hooks/agent-ops-loop.ps1` launcher，註冊文件化的 loop lifecycle event
   （不含 `Stop`），並保留 foreign hook group。只在 `UserPromptSubmit` 或 Bash
   `PreToolUse` 的 high-confidence literal credential，以及 `PreToolUse` 的危險 Bash command 時，使用
   文件化的 native denial shape 進行 blocking。對 `PermissionRequest`（包括

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Evidence-driven development loops for Codex, Claude Code, and opencode",
   "type": "module",
   "license": "MIT",

package/templates/common/CLAUDE.block.md

@@ -1,4 +1,6 @@
 ## Loop Engineering
 
-Load `.agent-ops/CLAUDE.md` as the agent-ops managed baseline.
+@.agent-ops/CLAUDE.md
+
+The file above is the agent-ops managed baseline.
 Project-specific instructions in this file remain authoritative.