@kylecheng3146/agent-ops 0.1.19 → 0.1.21

package/README.md

@@ -1,7 +1,7 @@
 # Loop Engineering Toolkit
 
 Loop Engineering Toolkit is an evidence-driven development-loop toolkit for
-Codex, Claude Code, and opencode. It is designed to turn acceptance criteria, explicit
+agy, Codex, Claude Code, and opencode. It is designed to turn acceptance criteria, explicit
 verification, safe lifecycle hooks, and independent review into a repeatable
 engineering workflow.
 
@@ -34,9 +34,9 @@ automation. The wizard never writes files until you review and confirm its
 installation plan.
 
 The interactive multi-select screens start with no harness or profile selected.
-Choose at least one of `codex`, `claude`, and `opencode`, and at least one of
+Choose at least one of `agy`, `codex`, `claude`, and `opencode`, and at least one of
 the `core`, `advisory`, `guardrails`, and `loop` profiles before confirming. For
-scripted use, `--harness all` selects all three harnesses; comma-separated
+scripted use, `--harness all` selects all four harnesses; comma-separated
 selections such as `codex,opencode` are also supported. The legacy `both` value
 remains an alias for `codex,claude`.
 
@@ -66,7 +66,11 @@ agent-ops uninstall --dry-run --json
 
 ### Project-local loop
 
-`loop` is an explicit, project-only profile for Codex, Claude Code, or both.
+`loop` is an explicit, project-only profile for agy, Codex, and Claude Code.
+agy installs its native `PreInvocation`, `PreToolUse(run_command)`, and optional
+`Stop` subset directly in `.agents/hooks.json`, plus project routing in
+`GEMINI.md` to `.agent-ops/GEMINI.md`; doctor reports its loop as
+degraded because prompt, permission, compact, and subagent events are unavailable.
 Claude Code supports native Windows through a generated PowerShell launcher;
 Codex's loop launcher still requires POSIX-compatible `bash`. Preview it
 first, then install only after reviewing the plan. `loop` also implies the
@@ -77,6 +81,24 @@ agent-ops init --dry-run --scope project --harness codex,claude --profile loop -
 agent-ops init --scope project --harness codex,claude --profile loop --yes
 ```
 
+For a project agy loop, the wizard recommends the hard completion gate. In
+automation, opt in explicitly:
+
+```bash
+agent-ops init --scope project --harness agy --profile loop --completion-gate --yes
+```
+
+The gate lets pure Q&A, analysis, and read-only diagnostics stop normally. It
+activates only after that conversation creates a Git-visible net change, then
+requires an attached completed task with two to five criteria, current PASS
+evidence, and a PASS review for the current source fingerprint. It never runs
+tests or review from `Stop`. Error, max-step, and non-idle stops continue. A
+user can approve one fingerprint-bound escape with
+`agent-ops allow-stop --session <conversationId>`. Use
+`agent-ops agy-run -- <agy arguments>` for a process-exit recheck in headless or
+CI use. Codex, Claude Code, and OpenCode retain their existing non-blocking Stop
+behavior in this release.
+
 On native Windows, select `--harness claude` unless Codex is running in a
 POSIX environment; the Codex loop still invokes `bash`.
 
@@ -247,10 +269,10 @@ After changing Stop configuration, run `agent-ops update`; its approved plan
 updates native registrations and the exact trust binding together. Stop is
 report-only: `PASS`, `FAIL`, and `UNKNOWN` continue
 the harness, emit bounded command evidence, and never complete a task.
-Config v1 migrates to config v2 with Stop disabled; migration invalidates the
-old trust binding, and pre-v1 binaries cannot read the migrated config.
+Older configs migrate to config v3 with both Stop verification and the agy
+completion gate disabled; migration invalidates the old trust binding.
 
-The generated `AGENTS.md` and `CLAUDE.md` routing blocks are supplemental: they
+The generated `AGENTS.md`, `CLAUDE.md`, and agy `GEMINI.md` routing blocks are supplemental: they
 load the managed baseline while leaving project-specific instructions in those
 files authoritative. Existing installations with the previous canonical
 wording are migrated by `agent-ops update`; changed managed blocks still fail
@@ -286,13 +308,17 @@ to a deterministic worktree (or `--base`) scope. `--task` reviews keep their
 task criteria and require current verification evidence. The detailed report
 is displayed; a minimal source-fingerprint attestation is persisted after PASS.
 
-Each attempt uses a fresh temporary cwd, a small allowlisted environment, and a
-target-native read-only mode. Claude additionally uses its complete safe mode;
-Codex ignores user config and persistence, while Agy runs in sandboxed plan
-mode against a disposable repository clone. Codex and Agy preserve their
+Each attempt uses a fresh temporary session and disposable repository clone, a
+small allowlisted environment, and a target-native read-only mode. Claude
+additionally uses its complete safe mode; Codex ignores user config and
+persistence, while Agy runs in sandboxed plan mode. Codex and Agy preserve their
 existing login environment, so their context isolation is intentionally weaker
 than Claude's. `opencode` is not a review target.
 
+The chain prefers a reviewer CLI different from the hosting CLI. If none is
+usable, a fresh same-target session is allowed but is rendered as
+`DEGRADED: isolated self-review`; a development session is never resumed.
+
 The first valid `PASS` or `FAIL` is final. Attempts that produce no verdict —
 including login failures and unparseable output — advance to the next target
 and remain visible in the result's `attempts`. `--yes` is still required for
@@ -313,7 +339,7 @@ See [Configuration](docs/en/guides/configuration.md) for the full contract.
 - Treat command output and current filesystem state as evidence.
 - Keep advisory automation separate from blocking guardrails.
 - Preserve user configuration through managed, reversible updates.
-- Support Codex, Claude Code, and opencode without project-specific assumptions.
+- Support agy, Codex, Claude Code, and opencode without project-specific assumptions.
 - Collect no network telemetry.
 
 ## Project status

package/dist/packages/cli/src/agy-headless.js

@@ -0,0 +1,18 @@
+/** Headless wrapper: native Stop is bounded by agy, process exit is not. */
+export async function runAgyHeadless(options) {
+    await options.gate.initialize(options.sessionId);
+    const exitCode = await options.run(options.args, {
+        ...(options.env ?? process.env),
+        AGENT_OPS_SESSION_ID: options.sessionId
+    });
+    if (exitCode !== 0)
+        return exitCode;
+    const result = await options.gate.handle({
+        event: "stop",
+        projectRoot: options.root,
+        sessionId: options.sessionId,
+        terminationReason: "model_stop",
+        fullyIdle: true
+    });
+    return result?.action === "block" ? 2 : 0;
+}

package/dist/packages/cli/src/args.js

@@ -8,7 +8,8 @@ export const COMMAND_NAMES = [
     "uninstall",
     "task",
     "verify",
-    "review"
+    "review",
+    "allow-stop"
 ];
 const COMMAND_SET = new Set(COMMAND_NAMES);
 const SCOPES = new Set(["project", "user"]);
@@ -73,6 +74,7 @@ export function parseArgs(argv) {
     const criteria = [];
     const evidence = [];
     let checkAuth = false;
+    let completionGate;
     let dryRun = false;
     let json = false;
     let yes = false;
@@ -203,6 +205,12 @@ export function parseArgs(argv) {
                 }
                 checkAuth = true;
                 break;
+            case "--completion-gate":
+                if (completionGate !== undefined) {
+                    duplicate(token);
+                }
+                completionGate = true;
+                break;
             case "--dry-run":
                 if (dryRun) {
                     duplicate(token);
@@ -291,6 +299,7 @@ export function parseArgs(argv) {
             criteria.length > 0 ||
             evidence.length > 0 ||
             reviewTargets.length > 0 ||
+            completionGate !== undefined ||
             sessionId !== undefined ||
             base !== undefined ||
             checkAuth ||
@@ -317,6 +326,7 @@ export function parseArgs(argv) {
     if (command !== "task" &&
         command !== "verify" &&
         command !== "review" &&
+        command !== "allow-stop" &&
         (hasTaskTargetOptions || hasTaskMutationOptions)) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Task target options may be used only with task or verify.");
     }
@@ -340,6 +350,9 @@ export function parseArgs(argv) {
     if (reviewTargets.length > 0 && command !== "init") {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--review-target may be used only with init.");
     }
+    if (completionGate !== undefined && command !== "init") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--completion-gate may be used only with init.");
+    }
     if (command === "task") {
         if (harness !== undefined ||
             profiles.length > 0 ||
@@ -349,8 +362,7 @@ export function parseArgs(argv) {
         }
         const taskOptionInvalid = (action === "create" &&
             (taskId !== undefined ||
-                evidence.length > 0 ||
-                sessionId !== undefined)) ||
+                evidence.length > 0)) ||
             (action === "status" &&
                 (title !== undefined ||
                     criteria.length > 0 ||
@@ -403,6 +415,19 @@ export function parseArgs(argv) {
     if (command === "review" && harness !== undefined && harness.length !== 1) {
         invalidValue("--harness", harness.join(","));
     }
+    if (command === "allow-stop" &&
+        (sessionId === undefined ||
+            scope !== undefined ||
+            harness !== undefined ||
+            taskId !== undefined ||
+            profiles.length > 0 ||
+            title !== undefined ||
+            criteria.length > 0 ||
+            evidence.length > 0 ||
+            dryRun ||
+            yes)) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "allow-stop requires only --session (and optional --json).");
+    }
     return {
         command,
         ...(action === undefined ? {} : { action }),
@@ -415,6 +440,7 @@ export function parseArgs(argv) {
         ...(targetVersion === undefined ? {} : { targetVersion }),
         ...(title === undefined ? {} : { title }),
         ...(reviewTargets.length === 0 ? {} : { reviewTargets }),
+        ...(completionGate === undefined ? {} : { completionGate }),
         ...(criteria.length === 0 ? {} : { criteria }),
         ...(evidence.length === 0 ? {} : { evidence }),
         ...(sessionId === undefined ? {} : { sessionId }),

package/dist/packages/cli/src/bin.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { readFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { commonHarnessAdapters, harnessHookPath, HARNESS_IDS } from "../../../runtime/src/install/harness.js";
-import { hookRegistrationDrift, repositoryTrustStatus, smokeAvailabilityStatus } from "../../../runtime/src/install/probes.js";
+import { agyRuntimeStatus, agyVersionSupported, hookRegistrationDrift, repositoryTrustStatus, smokeAvailabilityStatus } from "../../../runtime/src/install/probes.js";
 import { parseInstallManifest } from "../../../runtime/src/fs/manifest.js";
 import { NpmRegistryClient } from "../../../runtime/src/registry/npm.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
@@ -33,8 +34,11 @@ import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
 import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
 import { runVerifyCommand } from "./commands/verify.js";
+import { runAllowStopCommand } from "./commands/allow-stop.js";
+import { CompletionGateService } from "../../../runtime/src/hooks/completion-gate.js";
 import { formatUpdatePlan, runUpdateCommand } from "./commands/update.js";
 import { errorEnvelope } from "./output.js";
+import { runAgyHeadless } from "./agy-headless.js";
 const HOOK_RUNTIME_PATH = fileURLToPath(new URL("./hook-entry.js", import.meta.url));
 async function readOptionalText(path) {
     try {
@@ -92,13 +96,13 @@ function gitRunner(root) {
         }
     };
 }
-async function confirmInit(plan, trust) {
+async function confirmInit(plan, trust, warnings = []) {
     writeBanner({
         isTTY: process.stdout.isTTY === true,
         columns: process.stdout.columns,
         write: (value) => process.stdout.write(value)
     });
-    return await confirmPlan(formatInstallPlan(plan, trust));
+    return await confirmPlan(formatInstallPlan(plan, trust, warnings));
 }
 async function confirmPlan(text) {
     process.stdout.write(text);
@@ -115,7 +119,47 @@ async function plannedTrustBinding(root, projectConfig) {
         : await repositoryTrustBinding(root, config, CLI_VERSION);
 }
 const argv = process.argv.slice(2);
-if (argv[0] === "hook") {
+function runAgy(args, options = {}) {
+    return execFileSync("agy", [...args], {
+        ...options,
+        encoding: "utf8",
+        ...(process.platform === "win32" ? { shell: true } : {})
+    });
+}
+if (argv[0] === "agy-run") {
+    try {
+        const root = process.cwd();
+        const config = (await loadEffectiveConfig(root, "project")).config;
+        if (!config.features.completionGate.enabled) {
+            throw new Error("agy-run requires features.completionGate.enabled.");
+        }
+        const taskService = new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root));
+        const gate = new CompletionGateService({
+            root,
+            config,
+            gitRunner: gitRunner(root),
+            taskService,
+            evidenceStore: new FileEvidenceStore(root, root)
+        });
+        const agyArgs = argv[1] === "--" ? argv.slice(2) : argv.slice(1);
+        process.exitCode = await runAgyHeadless({
+            root,
+            sessionId: `agy-headless-${randomUUID()}`,
+            args: agyArgs,
+            gate,
+            run: async (args, env) => await new Promise((resolve) => {
+                const child = spawn("agy", [...args], { cwd: root, env, stdio: "inherit" });
+                child.once("error", () => resolve(1));
+                child.once("exit", (code) => resolve(code ?? 1));
+            })
+        });
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : "agy-run failed."}\n`);
+        process.exitCode = 2;
+    }
+}
+else if (argv[0] === "hook") {
     process.exitCode = await runHookProcess(argv.slice(1), {
         stdin: process.stdin,
         writeStdout: (value) => process.stdout.write(value),
@@ -140,7 +184,8 @@ else {
             "uninstall",
             "task",
             "verify",
-            "review"
+            "review",
+            "allow-stop"
         ].map((command) => [command, async (args) => {
                 const root = args.scope === "user"
                     ? process.env.AGENT_OPS_HOME ?? homedir()
@@ -157,20 +202,53 @@ else {
                         isTTY,
                         toolkitVersion: CLI_VERSION,
                         hookRuntimePath: HOOK_RUNTIME_PATH,
+                        agyWarning: () => {
+                            try {
+                                const output = runAgy(["--version"], { timeout: 5_000 });
+                                return agyVersionSupported(output)
+                                    ? undefined
+                                    : "agy is installed, but version 1.1.12 or newer is required; run `agent-ops doctor` after updating.";
+                            }
+                            catch {
+                                return "agy is not installed or could not be started; install agy 1.1.12 or newer, then run `agent-ops doctor`.";
+                            }
+                        },
                         ...(args.hookTargets === undefined
                             ? {}
                             : { hookTargets: args.hookTargets }),
                         trustStore: store,
                         calculateTrustBinding: async (config) => await plannedTrustBinding(root, config),
-                        confirm: async (plan, trust) => await confirmInit(plan, trust)
+                        confirm: async (plan, trust, warnings) => await confirmInit(plan, trust, warnings)
                     });
                 }
                 if (args.command === "doctor") {
+                    const doctorManifest = await installedManifest(root);
                     const config = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
                     return await runDoctorCommand({
                         root,
                         toolkitVersion: CLI_VERSION,
                         probes: {
+                            ...(doctorManifest?.harness.includes("agy") === true
+                                ? {
+                                    agyRuntime: () => {
+                                        try {
+                                            return agyRuntimeStatus(runAgy(["--version"]), runAgy([
+                                                "-p", "/hooks", "--output-format", "json",
+                                                ...(doctorManifest.scope === "project"
+                                                    ? ["--new-project"]
+                                                    : [])
+                                            ], { cwd: root }), doctorManifest.hooks?.find(({ harness }) => harness === "agy")?.events ?? []);
+                                        }
+                                        catch {
+                                            return {
+                                                status: "FAIL",
+                                                message: "agy is missing or could not report its loaded hooks.",
+                                                remediation: "Install agy 1.1.12 or newer and run `agent-ops doctor` again."
+                                            };
+                                        }
+                                    }
+                                }
+                                : {}),
                             hookRegistration: async () => {
                                 const drifted = hookRegistrationDrift({
                                     harness: await installedHarness(root),
@@ -246,26 +324,49 @@ else {
                 }
                 if (args.command === "update") {
                     const store = trustStore();
+                    const manifest = await installedManifest(root);
+                    const addAgy = isTTY &&
+                        !args.yes &&
+                        args.harness === undefined &&
+                        manifest !== null &&
+                        !manifest.harness.includes("agy") &&
+                        await selectYesNo("Add newly supported harness: agy?", { input: process.stdin, output: process.stdout }, false);
+                    const updateArgs = addAgy
+                        ? { ...args, harness: [...(manifest?.harness ?? []), "agy"] }
+                        : args;
                     return await runUpdateCommand({
-                        args,
+                        args: updateArgs,
                         root,
                         adapters: commonHarnessAdapters(),
                         registry: new NpmRegistryClient(),
                         isTTY,
                         toolkitVersion: CLI_VERSION,
                         hookRuntimePath: HOOK_RUNTIME_PATH,
-                        ...(args.hookTargets === undefined
+                        ...(updateArgs.hookTargets === undefined
                             ? {}
-                            : { hookTargets: args.hookTargets }),
+                            : { hookTargets: updateArgs.hookTargets }),
                         trustStore: store,
                         calculateTrustBinding: async (config) => await plannedTrustBinding(root, config),
                         confirm: async (plan, trust) => await confirmPlan(formatUpdatePlan(plan, trust)),
-                        ...(args.targetVersion === undefined
+                        ...(updateArgs.targetVersion === undefined
                             ? {}
-                            : { targetVersion: args.targetVersion })
+                            : { targetVersion: updateArgs.targetVersion })
                     });
                 }
                 const taskService = new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root));
+                if (args.command === "allow-stop") {
+                    const config = (await loadEffectiveConfig(root, "project")).config;
+                    return await runAllowStopCommand({
+                        args,
+                        gate: new CompletionGateService({
+                            root,
+                            config,
+                            gitRunner: gitRunner(root),
+                            taskService,
+                            evidenceStore: new FileEvidenceStore(root, root)
+                        })
+                    });
+                }
                 if (args.command === "task") {
                     const sessionId = process.env.AGENT_OPS_SESSION_ID;
                     const policyConfigHash = args.action === "create"

package/dist/packages/cli/src/cli.js

@@ -27,14 +27,17 @@ Commands:
              Manage independent task acceptance state
   verify     Run configured verification
   review     Run an independent review
+  allow-stop Grant one fingerprint-bound agy Stop permit (requires --session)
+  agy-run    Run headless agy with a process-exit completion recheck
 
 Options:
   --scope <project|user>
-  --harness <all|both|claude|codex|opencode|comma-separated>  Init/update
+  --harness <all|both|agy|claude|codex|opencode|comma-separated>  Init/update/uninstall
   --hook-target <harness=surface-id>  Repeatable advanced init/update option
   --profile <core|advisory|guardrails|loop>  Repeatable
   --review-target <codex|agy|claude>  Repeatable init option; external review
                                       targets in fallback-chain order
+  --completion-gate                  Init only: enable the agy project-loop gate
   --check-auth                        Doctor only: probe each review target's
                                       authentication with one real call
   --task <id>

package/dist/packages/cli/src/commands/allow-stop.js

@@ -0,0 +1,11 @@
+import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
+import { okEnvelope } from "../output.js";
+export async function runAllowStopCommand(options) {
+    if (options.args.command !== "allow-stop" || options.args.sessionId === undefined) {
+        throw new AgentOpsError("COMPLETION_GATE_SESSION_REQUIRED", "allow-stop requires --session.");
+    }
+    await options.gate.grantPermit(options.args.sessionId);
+    return okEnvelope("COMPLETION_GATE_PERMIT_GRANTED", {
+        message: "One Stop is permitted for this conversation and current source fingerprint."
+    });
+}

package/dist/packages/cli/src/commands/hook.js

@@ -49,11 +49,22 @@ export async function runHookCommand(options) {
             capabilities,
             trusted: options.trusted,
             advisory: options.advisory ?? runLifecycleAdvisory,
-            ...(stopVerification === undefined ? {} : { stopVerification })
+            ...(stopVerification === undefined ? {} : { stopVerification }),
+            ...(options.completionGate === undefined
+                ? {}
+                : { completionGate: options.completionGate })
         });
         return descriptor.runtime.formatOutput(options.event, result);
     }
     catch {
+        if (options.harness === "agy" && options.completionGate !== undefined) {
+            return harnessDescriptor("agy").runtime.formatOutput(options.event, {
+                action: "block",
+                status: "UNKNOWN",
+                code: "COMPLETION_GATE_UNAVAILABLE",
+                remedy: "Run agent-ops doctor; a user-approved one-time permit may be used after diagnosing the failure."
+            });
+        }
         return { exitCode: 0, stdout: "", stderr: "" };
     }
 }

package/dist/packages/cli/src/commands/init.js

@@ -5,7 +5,7 @@ import { okEnvelope } from "../output.js";
 import { formatOperationPlan } from "../plan-output.js";
 import { toPublicInstallPlan } from "../public-plan.js";
 import { formatTrustChange, planTrustGrant } from "./trust.js";
-export function formatInstallPlan(plan, trust) {
+export function formatInstallPlan(plan, trust, warnings = []) {
     const hooks = plan.manifest.hooks ?? [];
     const detectedVerification = plan.detectedVerification;
     return formatOperationPlan({
@@ -14,6 +14,12 @@ export function formatInstallPlan(plan, trust) {
             `Scope: ${plan.scope}`,
             `Harness: ${plan.harness}`,
             `Profiles: ${plan.profiles.join(", ")}`,
+            ...(plan.scope === "user" && plan.harness.includes("agy")
+                ? ["Notice: .gemini/GEMINI.md is a shared Gemini rule surface."]
+                : []),
+            ...(warnings.length === 0
+                ? []
+                : ["Warnings:", ...warnings.map((warning) => `  - ${warning}`)]),
             ...(trust === undefined ? [] : formatTrustChange(trust)),
             ...(hooks.length === 0
                 ? ["Hooks: none selected"]
@@ -42,11 +48,19 @@ function appliedMessage(plan) {
         ...hooks.map((hook) => `- ${hook.harness}: ${hook.path} (${hook.events.join(", ")})`)
     ].join("\n");
 }
-function initError(code, message, plan, trust, applied = false) {
+function initError(code, message, plan, trust, warnings = [], applied = false) {
+    const displayMessage = warnings.length === 0
+        ? message
+        : `${message}\nWarnings:\n${warnings.map((warning) => `- ${warning}`).join("\n")}`;
     return {
         code,
         status: "error",
-        data: { applied, plan: toPublicInstallPlan(plan, trust), message },
+        data: {
+            applied,
+            plan: toPublicInstallPlan(plan, trust),
+            message: displayMessage,
+            ...(warnings.length === 0 ? {} : { warnings })
+        },
         errors: [{ code, message }]
     };
 }
@@ -88,24 +102,39 @@ export async function runInitCommand(options) {
             : { hookTargets: options.hookTargets ?? args.hookTargets }),
         ...(args.reviewTargets === undefined
             ? {}
-            : { reviewTargets: args.reviewTargets })
+            : { reviewTargets: args.reviewTargets }),
+        ...(args.completionGate === undefined
+            ? {}
+            : { completionGateEnabled: args.completionGate })
     });
     const trust = await trustChange(options, plan);
+    const warnings = plan.harness.includes("agy") && options.agyWarning !== undefined
+        ? (() => {
+            try {
+                const warning = options.agyWarning();
+                return warning === undefined ? [] : [warning];
+            }
+            catch {
+                return ["agy could not be probed; run `agent-ops doctor` to verify it."];
+            }
+        })()
+        : [];
     if (args.dryRun) {
         return okEnvelope("INIT_PLAN_READY", {
             applied: false,
             plan: toPublicInstallPlan(plan, trust),
             message: "Installation plan calculated; no files were written.",
-            text: formatInstallPlan(plan, trust)
+            ...(warnings.length === 0 ? {} : { warnings }),
+            text: formatInstallPlan(plan, trust, warnings)
         });
     }
     if (!args.yes && !options.isTTY) {
-        return initError("INIT_CONFIRMATION_REQUIRED", "Non-interactive init requires --yes after all choices are explicit.", plan, trust);
+        return initError("INIT_CONFIRMATION_REQUIRED", "Non-interactive init requires --yes after all choices are explicit.", plan, trust, warnings);
     }
     if (!args.yes &&
         options.isTTY &&
-        !(await options.confirm(plan, trust))) {
-        return initError("INIT_CANCELLED", "Installation was cancelled; no files were written.", plan, trust);
+        !(await options.confirm(plan, trust, warnings))) {
+        return initError("INIT_CANCELLED", "Installation was cancelled; no files were written.", plan, trust, warnings);
     }
     await applyInstallPlan(options.root, plan);
     if (trust.action === "grant") {
@@ -116,12 +145,16 @@ export async function runInitCommand(options) {
             await options.trustStore.grant(trust.binding);
         }
         catch {
-            return initError("INIT_TRUST_FAILED", "Installation was applied, but repository trust was not granted. Run `agent-ops trust grant --yes`.", plan, trust, true);
+            return initError("INIT_TRUST_FAILED", "Installation was applied, but repository trust was not granted. Run `agent-ops trust grant --yes`.", plan, trust, warnings, true);
         }
     }
+    const message = appliedMessage(plan);
     return okEnvelope("INIT_APPLIED", {
         applied: true,
         plan: toPublicInstallPlan(plan, trust),
-        message: appliedMessage(plan)
+        message: warnings.length === 0
+            ? message
+            : `${message}\nWarnings:\n${warnings.map((warning) => `- ${warning}`).join("\n")}`,
+        ...(warnings.length === 0 ? {} : { warnings })
     });
 }

package/dist/packages/cli/src/commands/review.js

@@ -217,6 +217,9 @@ function sourceChangedResult(result) {
         ...(result.independence === undefined
             ? {}
             : { independence: result.independence }),
+        ...(result.sessionIsolation === undefined
+            ? {}
+            : { sessionIsolation: result.sessionIsolation }),
         ...(result.attempts === undefined ? {} : { attempts: result.attempts }),
         ...(result.verification === undefined
             ? {}

package/dist/packages/cli/src/commands/task.js

@@ -95,9 +95,12 @@ export async function runTaskCommand(options) {
                     : { policyConfigHash: options.policyConfigHash }),
                 ...(options.args.parentTaskId === undefined
                     ? {}
-                    : { parentTaskId: options.args.parentTaskId })
+                    : { parentTaskId: options.args.parentTaskId }),
+                ...(sessionId === undefined ? {} : { sessionId })
             });
-            return taskEnvelope(action, "TASK_CREATED", `Created task ${record.task.id}.`, record);
+            return taskEnvelope(action, "TASK_CREATED", sessionId === undefined
+                ? `Created task ${record.task.id}.`
+                : `Created and attached task ${record.task.id}.`, record);
         }
         if (action === "status") {
             if (options.args.taskId === undefined && sessionId === undefined) {