@kylecheng3146/agent-ops 0.2.8 → 0.3.1

package/dist/packages/cli/src/parallel-deps.js

@@ -0,0 +1,89 @@
+import { execFile, execFileSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { CompletionGateService } from "../../../runtime/src/hooks/completion-gate.js";
+import { localStatePaths } from "../../../runtime/src/security/permissions.js";
+import { FileTrustStore } from "../../../runtime/src/security/trust.js";
+import { TaskService } from "../../../runtime/src/task/service.js";
+import { FileTaskStore } from "../../../runtime/src/task/store.js";
+import { FileEvidenceStore } from "../../../runtime/src/verify/evidence.js";
+import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
+import { loadEffectiveConfig, repositoryTrust, repositoryTrustBinding } from "./context.js";
+import { CLI_VERSION } from "./version.js";
+// Shared by the CLI and the hook entry point: Claude Code runs hooks through
+// hook-entry.js, never bin.js, and its worktree guard needs these too.
+export function gitRunner(root) {
+    return {
+        run: async (gitArgs) => {
+            try {
+                return {
+                    exitCode: 0,
+                    stdout: execFileSync("git", [...gitArgs], {
+                        cwd: root,
+                        encoding: "buffer",
+                        stdio: ["ignore", "pipe", "ignore"]
+                    })
+                };
+            }
+            catch (error) {
+                const failure = error;
+                return {
+                    exitCode: failure.status ?? 1,
+                    stdout: failure.stdout ?? new Uint8Array()
+                };
+            }
+        }
+    };
+}
+export function trustStore() {
+    const state = localStatePaths(process.env.AGENT_OPS_HOME ?? homedir());
+    return new FileTrustStore(state.trustStore, state.anchorDirectory);
+}
+export function worktreeDependencies() {
+    const gateFor = async (root, config) => new CompletionGateService({
+        root,
+        config,
+        gitRunner: gitRunner(root),
+        taskService: new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root)),
+        evidenceStore: new FileEvidenceStore(root, root)
+    });
+    return {
+        git: async (cwd, gitArgs) => await new Promise((resolve) => {
+            execFile("git", [...gitArgs], { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }, (error, stdout, stderr) => resolve({
+                exitCode: error === null ? 0 : typeof error.code === "number" ? error.code : 1,
+                stdout,
+                stderr
+            }));
+        }),
+        loadConfig: async (root) => (await loadEffectiveConfig(root, "project")).config,
+        trust: {
+            status: async (root, config) => await repositoryTrust(root, config, CLI_VERSION),
+            grant: async (root, config) => await trustStore().grant(await repositoryTrustBinding(root, config, CLI_VERSION)),
+            revoke: async (root, config) => {
+                await trustStore().revoke(await repositoryTrustBinding(root, config, CLI_VERSION));
+            }
+        },
+        gate: gateFor,
+        tasks: (root, base) => new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root), base === undefined ? {} : { completion: {
+                root,
+                gitRunner: gitRunner(root),
+                base,
+                loadConfig: async () => (await loadEffectiveConfig(root, "project")).config
+            } }),
+        processRunner: new NodeVerificationProcessRunner(),
+        runSetup: async (cwd, step) => await new Promise((resolve) => {
+            execFile(step.command, [...step.args], {
+                cwd,
+                encoding: "utf8",
+                timeout: step.timeoutMs,
+                maxBuffer: 16 * 1024 * 1024,
+                ...(process.platform === "win32" ? { shell: true } : {})
+            }, (error, stdout, stderr) => resolve({
+                exitCode: error === null
+                    ? 0
+                    : typeof error.code === "number" && error.killed !== true ? error.code : null,
+                output: `${stdout}${stderr}`
+            }));
+        })
+    };
+}

package/dist/runtime/src/adapters/agy/output.js

@@ -12,7 +12,8 @@ export function agyHookOutput(event, result) {
         ? `agent-ops: ${result.code}`
         : `agent-ops: ${result.code}: ${result.remedy}`;
     const value = event === "PreToolUse"
-        ? result.code === "COMPLETION_GATE_PERMIT_CONFIRMATION"
+        ? result.code === "COMPLETION_GATE_PERMIT_CONFIRMATION" ||
+            result.code === "WORKTREE_REMOVE_CONFIRMATION"
             ? { decision: "force_ask", reason }
             : result.action === "block"
                 ? { decision: "deny", reason }

package/dist/runtime/src/adapters/claude/config.js

@@ -11,6 +11,7 @@ const CLAUDE_LOOP_EVENTS = [
     "SubagentStop"
 ];
 const CLAUDE_HOOK_MARKER = "--managed-by=agent-ops";
+export const CLAUDE_PRE_TOOL_MATCHER = "Bash|Edit|MultiEdit|NotebookEdit|Write";
 const CLAUDE_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.sh";
 const CLAUDE_WINDOWS_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.ps1";
 export function claudeSettingsTarget(scope) {
@@ -41,12 +42,15 @@ function commandHook(event, runtimePath, completionGate = false) {
             CLAUDE_HOOK_MARKER,
             ...(completionGate ? ["--completion-gate"] : [])
         ],
-        timeout: 30
+        // PreToolUse may create the session's worktree, setup steps included.
+        timeout: event === "PreToolUse" ? 600 : 30
     };
 }
 function matcherGroup(event, runtimePath, completionGate = false) {
     return {
-        ...(event === "PreToolUse" ? { matcher: "Bash" } : {}),
+        // File tools as well as Bash: in worktree auto mode the guard must see a
+        // direct edit of the shared checkout, which never passes through a shell.
+        ...(event === "PreToolUse" ? { matcher: CLAUDE_PRE_TOOL_MATCHER } : {}),
         hooks: [commandHook(event, runtimePath, completionGate)]
     };
 }

package/dist/runtime/src/adapters/claude/input.js

@@ -1,5 +1,13 @@
+import { resolve } from "node:path";
 import { normalizeHookEvent } from "../../hooks/normalize.js";
 import { normalizeShellHookEvent } from "../../hooks/shell.js";
+/** Claude's tools that write a file without a shell. */
+export const CLAUDE_FILE_TOOLS = new Set([
+    "Edit",
+    "MultiEdit",
+    "NotebookEdit",
+    "Write"
+]);
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -39,6 +47,22 @@ export function normalizeClaudeHookInput(input) {
             fullyIdle: input.stop_hook_active !== true
         };
     }
+    if (input.hook_event_name === "PreToolUse" &&
+        typeof input.tool_name === "string" &&
+        CLAUDE_FILE_TOOLS.has(input.tool_name) &&
+        isRecord(input.tool_input) &&
+        typeof projectRoot === "string" &&
+        projectRoot.length > 0) {
+        const target = input.tool_input.file_path ?? input.tool_input.notebook_path;
+        if (typeof target === "string" && target.length > 0 && !target.includes("\0")) {
+            return {
+                event: "file-write",
+                projectRoot,
+                paths: [resolve(projectRoot, target)],
+                ...(sessionId === undefined ? {} : { sessionId })
+            };
+        }
+    }
     if (input.hook_event_name === "PreToolUse" &&
         input.tool_name === "Bash" &&
         isRecord(input.tool_input) &&

package/dist/runtime/src/adapters/claude/output.js

@@ -19,7 +19,8 @@ export function claudeHookOutput(event, result) {
         });
     }
     if (event === "PreToolUse" &&
-        result.code === "COMPLETION_GATE_PERMIT_CONFIRMATION") {
+        (result.code === "COMPLETION_GATE_PERMIT_CONFIRMATION" ||
+            result.code === "WORKTREE_REMOVE_CONFIRMATION")) {
         // Asked, never allowed: a one-time Stop permit is the user's to grant, and
         // an agent that could answer this for itself would hold the key to its own
         // gate.

package/dist/runtime/src/config/merge.js

@@ -110,9 +110,15 @@ export function mergeConfigLayers(inputLayers) {
     const reviewRoles = new Map();
     let schemaVersion;
     let features;
+    let worktree;
     for (const layer of layers) {
         schemaVersion = effective(layer.config.schemaVersion, layer);
         features = effective(layer.config.features, layer);
+        // Whole-block override: a workflow choice, not a guardrail, so a project
+        // may turn a user-level `auto` off.
+        if (layer.config.worktree !== undefined) {
+            worktree = effective(layer.config.worktree, layer);
+        }
         for (const profile of layer.config.profiles) {
             profiles.set(profile, effective(profile, layer));
         }
@@ -158,7 +164,8 @@ export function mergeConfigLayers(inputLayers) {
         verificationCommands: [...commands.values()],
         pathMappings: [...mappings.values()],
         securityExceptions: [...exceptions.values()],
-        reviewRoles: [...reviewRoles.values()]
+        reviewRoles: [...reviewRoles.values()],
+        ...(worktree === undefined ? {} : { worktree })
     };
     const config = {
         schemaVersion: schemaVersion.value,
@@ -175,7 +182,8 @@ export function mergeConfigLayers(inputLayers) {
             ? {}
             : {
                 reviewRoles: provenance.reviewRoles.map(({ value }) => value)
-            })
+            }),
+        ...(worktree === undefined ? {} : { worktree: worktree.value })
     };
     const validation = validateConfig(config);
     if (!validation.ok) {

package/dist/runtime/src/hooks/codex-loop.js

@@ -407,7 +407,7 @@ function parseSessionMarker(source) {
  * ponytail: last writer wins. Two concurrent sessions in one checkout already
  * violate the one-writer rule; pass `--session` explicitly if you need that.
  */
-async function writeSessionMarker(options) {
+export async function writeSessionMarker(options) {
     const path = loopPath(options.root, options.harness, "loop-state.md");
     await withPrivateFileLock(path, options.root, async () => {
         const source = await readPrivateFile(path, options.root);
@@ -491,6 +491,8 @@ async function restoreState(options) {
 function clamp(value, limit) {
     return value.length <= limit ? value : `${value.slice(0, limit - 14)}\n[truncated]`;
 }
+/** Printed only when it is a plain token: it lands verbatim in agent context. */
+const PRINTABLE_SESSION = /^[A-Za-z0-9._:-]{1,128}$/u;
 function sessionContext(options) {
     // Task state is assembled first and clamped on its own budget, so a long
     // goal can no longer crowd out the one thing recovery exists to carry.
@@ -516,8 +518,15 @@ function sessionContext(options) {
         return [];
     })();
     const telemetry = `Telemetry: ${options.telemetryEntries} recent redacted event(s).`;
+    // The id every `--session` flag wants. Hooks hear it; the agent otherwise
+    // never does, and a shared checkout's recorded marker belongs to whichever
+    // session started last.
+    const session = options.sessionId !== undefined && PRINTABLE_SESSION.test(options.sessionId)
+        ? [`Session: ${options.sessionId}`]
+        : [];
     const fixed = [
         "agent-ops project loop is active.",
+        ...session,
         "",
         ...restored,
         telemetry
@@ -648,6 +657,7 @@ export async function runProjectLoop(options) {
                 telemetryCount(root, options.harness)
             ]);
             return sessionOutput(options.harness, sessionContext({
+                ...(sessionId === undefined ? {} : { sessionId }),
                 goal: safeGoalContext(goal),
                 telemetryEntries,
                 mode: restoreMode(options.input),

package/dist/runtime/src/hooks/completion-gate.js

@@ -1,20 +1,37 @@
-import { join } from "node:path";
+import { lstat, readdir } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
 import { checkTaskCompletionEvidence, findIncompleteSubtask } from "../task/completion.js";
 import { collectBaseChangePaths, collectChangeSurface } from "../verify/change-surface.js";
 import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
+import { readWorktreeRecord } from "../parallel/service.js";
 const FINGERPRINT = /^[a-f0-9]{64}$/u;
 const SESSION = /^[^\0\r\n]{1,256}$/u;
+function gateDirectory(root) {
+    return join(root, ".agent-ops", "tasks", "completion-gate");
+}
 function shellQuote(value) {
     return `'${value.replaceAll("'", "'\"'\"'")}'`;
 }
+async function isDirectory(path) {
+    try {
+        return (await lstat(path)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
 function gateResult(action, status, code, remedy) {
     return { action, status, code, ...(remedy === undefined ? {} : { remedy }) };
 }
 function statePath(root, sessionId) {
-    return join(root, ".agent-ops", "tasks", "completion-gate", `${sha256(sessionId)}.json`);
+    return join(gateDirectory(root), `${sha256(sessionId)}.json`);
+}
+function validRoot(value) {
+    return typeof value === "string" && value.length > 0 && value.length <= 4096 &&
+        !value.includes("\0") && isAbsolute(value);
 }
 function parseState(source, sessionId) {
     if (source === null)
@@ -30,8 +47,9 @@ function parseState(source, sessionId) {
         throw new AgentOpsError("COMPLETION_GATE_STATE_INVALID", "Completion-gate state is invalid.");
     }
     const record = value;
-    if (Object.keys(record).sort().join(",") !==
-        "baselineFingerprint,permitFingerprint,schemaVersion,sessionId" ||
+    const keys = Object.keys(record).filter((key) => key !== "root").sort().join(",");
+    if (keys !== "baselineFingerprint,permitFingerprint,schemaVersion,sessionId" ||
+        ("root" in record && !validRoot(record.root)) ||
         record.schemaVersion !== 1 ||
         record.sessionId !== sessionId ||
         typeof record.baselineFingerprint !== "string" ||
@@ -55,6 +73,32 @@ export class FileCompletionGateStore {
         const path = statePath(this.#root, sessionId);
         return await withPrivateFileLock(path, this.#root, async () => parseState(await readPrivateFile(path, this.#root), sessionId));
     }
+    /** Every recorded session. An unreadable record is skipped, not repaired. */
+    async all() {
+        let names;
+        try {
+            names = await readdir(gateDirectory(this.#root));
+        }
+        catch {
+            return [];
+        }
+        const states = [];
+        for (const name of names.filter((entry) => /^[a-f0-9]{64}\.json$/u.test(entry))) {
+            try {
+                const source = await readPrivateFile(join(gateDirectory(this.#root), name), this.#root);
+                const record = source === null ? null : JSON.parse(source);
+                if (typeof record?.sessionId === "string") {
+                    const state = await this.read(record.sessionId);
+                    if (state !== null)
+                        states.push(state);
+                }
+            }
+            catch {
+                continue;
+            }
+        }
+        return states;
+    }
     async mutate(sessionId, action) {
         if (!SESSION.test(sessionId)) {
             throw new AgentOpsError("COMPLETION_GATE_SESSION_INVALID", "Completion gate requires a valid session identity.");
@@ -68,6 +112,11 @@ export class FileCompletionGateStore {
         });
     }
 }
+/** What the gate measures: the whole Git-visible change surface of `root`. */
+export async function currentGateFingerprint(root, gitRunner) {
+    const surface = await collectChangeSurface(gitRunner);
+    return await calculateSourceFingerprint(root, { mode: "worktree", changedFiles: surface.paths }, gitRunner);
+}
 export class CompletionGateService {
     #options;
     #store;
@@ -76,8 +125,63 @@ export class CompletionGateService {
         this.#store = options.stateStore ?? new FileCompletionGateStore(options.root);
     }
     async #fingerprint() {
-        const surface = await collectChangeSurface(this.#options.gitRunner);
-        return await calculateSourceFingerprint(this.#options.root, { mode: "worktree", changedFiles: surface.paths }, this.#options.gitRunner);
+        return await currentGateFingerprint(this.#options.root, this.#options.gitRunner);
+    }
+    /**
+     * Starts (or restarts) a session's record at a known baseline: the current
+     * source by default, or an explicit one a caller wants every Stop measured
+     * against.
+     */
+    async seed(sessionId, baselineFingerprint) {
+        const baseline = baselineFingerprint ?? await this.#fingerprint();
+        await this.#store.mutate(sessionId, () => ({
+            schemaVersion: 1,
+            sessionId,
+            baselineFingerprint: baseline,
+            permitFingerprint: null
+        }));
+    }
+    /** Points this checkout's record for a session at another worktree, or clears it. */
+    async redirect(sessionId, root) {
+        if (root === null && (await this.#store.read(sessionId))?.root === undefined) {
+            return;
+        }
+        const fingerprint = await this.#fingerprint();
+        await this.#store.mutate(sessionId, (current) => {
+            const { root: _previous, ...base } = current ?? {
+                schemaVersion: 1,
+                sessionId,
+                baselineFingerprint: fingerprint,
+                permitFingerprint: null
+            };
+            return root === null ? base : { ...base, root };
+        });
+    }
+    /**
+     * Moves every session whose baseline is `from` to `to`: a merge that moved
+     * HEAD under a session which changed nothing must not read as its change.
+     */
+    async rebase(from, to) {
+        let moved = 0;
+        for (const state of await this.#store.all()) {
+            if (state.baselineFingerprint !== from)
+                continue;
+            await this.#store.mutate(state.sessionId, (current) => current === null || current.baselineFingerprint !== from
+                ? current ?? state
+                : { ...current, baselineFingerprint: to });
+            moved += 1;
+        }
+        return moved;
+    }
+    async sessions() {
+        return await this.#store.all();
+    }
+    /**
+     * Whether the session's attached task would let it stop right now: complete,
+     * with current evidence and review. Null means it would.
+     */
+    async validate(sessionId) {
+        return await this.#validateTask(sessionId);
     }
     /**
      * The fingerprint the task's evidence should carry. Committed work leaves an
@@ -120,6 +224,12 @@ export class CompletionGateService {
             permitFingerprint: null
         });
         const changed = state.baselineFingerprint !== fingerprint;
+        if (!changed &&
+            this.#options.config.worktree?.mode === "auto" &&
+            state.root === undefined &&
+            await readWorktreeRecord(this.#options.root) === null) {
+            return gateResult("continue", "UNKNOWN", "COMPLETION_GATE_WORKTREE_MODE", `worktree.mode is auto. Session: ${sessionId}. Before your first edit run agent-ops task create from this checkout, which creates this session's worktree and puts the task there (or agent-ops worktree add <name> --session ${shellQuote(sessionId)}), and work only inside the printed path. Verify and review there, then finish with agent-ops worktree finish from this checkout, which completes the tasks; do not run task complete in the worktree.`);
+        }
         return gateResult("continue", changed ? "UNKNOWN" : "PASS", changed ? "COMPLETION_GATE_CHANGED" : "COMPLETION_GATE_READY", changed
             ? `Git-visible changes require an attached completed task, current PASS evidence, and a PASS review. Session: ${sessionId}. Create with --session ${sessionId}; one-time permit: agent-ops allow-stop --session ${sessionId}.`
             : undefined);
@@ -165,7 +275,19 @@ export class CompletionGateService {
         }
         return null;
     }
+    /** `agent-ops worktree remove --force`: discards work that exists nowhere else. */
+    #isForcedRemove(event) {
+        const commands = event.event === "command" ? [event] :
+            event.event === "command-batch" ? event.commands : [];
+        return commands.some(({ command, args }) => {
+            const words = [command, ...args];
+            return words.includes("worktree") && words.includes("remove") && words.includes("--force");
+        });
+    }
     async handle(event) {
+        if (this.#isForcedRemove(event)) {
+            return gateResult("block", "UNKNOWN", "WORKTREE_REMOVE_CONFIRMATION", "Allow this only if the user wants the worktree's uncommitted or unmerged work discarded.");
+        }
         if (this.#isPermitCommand(event)) {
             return gateResult("block", "UNKNOWN", "COMPLETION_GATE_PERMIT_CONFIRMATION", "Allow this command only to grant one Stop for the current source fingerprint.");
         }
@@ -192,7 +314,19 @@ export class CompletionGateService {
         if (state === null) {
             return gateResult("block", "UNKNOWN", "COMPLETION_GATE_NOT_INITIALIZED", "The session baseline is unavailable; continue once so PreInvocation can initialize it.");
         }
-        if (state.baselineFingerprint !== fingerprint && state.permitFingerprint !== fingerprint) {
+        const changed = state.baselineFingerprint !== fingerprint && state.permitFingerprint !== fingerprint;
+        if (state.root !== undefined && state.root !== this.#options.root) {
+            // This checkout only has to stay untouched; the work, its task and its
+            // evidence live in the worktree, and that gate decides.
+            if (changed) {
+                return gateResult("block", "FAIL", "COMPLETION_GATE_MAIN_CHANGED", `This session works in ${state.root}, but this checkout changed too. Move those edits into the worktree, or ask the user for a one-time permit.`);
+            }
+            if (!await isDirectory(state.root) || this.#options.forRoot === undefined) {
+                return gateResult("block", "UNKNOWN", "COMPLETION_GATE_WORKTREE_MISSING", `The worktree ${state.root} is unavailable. Run agent-ops worktree list, then resume or remove it.`);
+            }
+            return await (await this.#options.forRoot(state.root)).handle(event);
+        }
+        if (changed) {
             const failure = await this.#validateTask(sessionId);
             if (failure !== null)
                 return failure;

package/dist/runtime/src/hooks/dispatch.js

@@ -52,6 +52,11 @@ export async function dispatchHookEvent(event, options) {
     if (event.event === "unsupported") {
         return continueWith("UNKNOWN", "HOOK_EVENT_UNSUPPORTED");
     }
+    if (event.event === "file-write") {
+        return options.worktreeGuard === undefined
+            ? continueWith("PASS", "HOOK_NOOP")
+            : await options.worktreeGuard(event);
+    }
     if (event.event === "session-start" &&
         options.capabilities.includes("lifecycle-summary") &&
         options.advisory !== undefined) {

package/dist/runtime/src/install/doctor.js

@@ -495,7 +495,10 @@ export async function doctorInstallation(options) {
         await checkProbe("smoke-availability", options.probes?.smokeAvailability),
         await checkReviewTargets(config.config, options.probes?.reviewTarget, options.checkReviewTargetAuth === true, options.checkAuthTargets),
         await checkHostSandbox(options.probes?.hostRestriction),
-        checkVerificationCommands(config.config)
+        checkVerificationCommands(config.config),
+        ...(options.probes?.worktrees === undefined
+            ? []
+            : [await checkProbe("worktrees", options.probes.worktrees)])
     ];
     return {
         checks,

package/dist/runtime/src/install/harness.js

@@ -311,7 +311,7 @@ export function managedRules(descriptor, context) {
         lines.push("For every change:", "", "1. Define two to five mechanically verifiable acceptance criteria.", "2. Inspect the smallest relevant scope and preserve unrelated changes.", "3. Apply the smallest safe change.", "4. Run evidence-producing verification for every criterion.", "5. Obtain complete independent review before claiming completion, via", "   `agent-ops review --task <task-id> --yes` (or the CLI's equivalent invocation).", "   Never call a", "   review-target CLI (agy, codex, claude) directly — direct calls skip", "   the enforced read-only sandbox flags and can hang or fail on command", "   permission prompts.", "   Start this command through the trusted outer host runner as its first", "   and only invocation. On Codex, the outer tool request must use", "   `sandbox_permissions: \"require_escalated\"` so network and loopback", "   are available; in that same request, unset", "   `CODEX_SANDBOX_NETWORK_DISABLED` and set `AGENT_OPS_HOST` when three", "   targets are configured. The Codex shell form is", "   `env -u CODEX_SANDBOX_NETWORK_DISABLED AGENT_OPS_HOST=<current-host> agent-ops review --task <task-id> --yes`.", "   Do not run it once in the restricted sandbox and retry; changing the", "   variable inside that sandbox is not elevation.", "   Review runs exactly two fresh sessions: with three configured targets,", "   set `AGENT_OPS_HOST` to the current CLI id so it is excluded; with two", "   targets both run in configured order; with one target it runs twice.", "   The first session is necessary; a PASS then requires an adversarial", "   re-check carrying the first report. A first FAIL or NOT_RUN stops.", "", "Treat `.agent-ops/config.json` as verifier authority. Discovery output is", "only a proposal until a user confirms it. Repository commands require an", "exact matching trust record. Confirmed project init/update grants it", "automatically when verification commands are configured.", "");
     }
     if (context.capabilities.includes("task")) {
-        lines.push("Split a change that exceeds five acceptance criteria into subtasks:", "`agent-ops task create --parent <task-id>` records one, and", "`agent-ops task status --parent <task-id>` lists them. Each subtask", "carries its own criteria, verification, and independent review;", "completing one never completes its parent.", "", "Delegate a subtask whose scope spans unknown files, broad scans, or an", "independent workstream instead of doing it inline. Name the bounded", "scope, the artifact to return, and the acceptance criteria it serves.", subagentInstruction(descriptor), "Read every returned artifact back yourself: integration, verification,", "and review stay with the coordinator.", "", "One writer at a time. `agent-ops verify` and `agent-ops review`", "fingerprint the working tree and report UNKNOWN when anything else", "writes it during the run, so delegate edits to one subagent at a time,", "or give each writer its own Git worktree and merge before verifying.", "Read-only delegation has no such limit and may run in parallel.", "");
+        lines.push("Split a change that exceeds five acceptance criteria into subtasks:", "`agent-ops task create --parent <task-id>` records one, and", "`agent-ops task status --parent <task-id>` lists them. Each subtask", "carries its own criteria, verification, and independent review;", "completing one never completes its parent.", "", "Delegate a subtask whose scope spans unknown files, broad scans, or an", "independent workstream instead of doing it inline. Name the bounded", "scope, the artifact to return, and the acceptance criteria it serves.", subagentInstruction(descriptor), "Read every returned artifact back yourself: integration, verification,", "and review stay with the coordinator.", "", "One writer at a time. `agent-ops verify` and `agent-ops review`", "fingerprint the working tree and report UNKNOWN when anything else", "writes it during the run, so delegate edits to one subagent at a time,", "or give each writer its own Git worktree and merge before verifying.", "Read-only delegation has no such limit and may run in parallel.", "", "Parallel conversations in one repository each need their own worktree.", "When `.agent-ops/config.json` sets `worktree.mode` to `auto`, run", "`agent-ops task create` from the main checkout before your first edit:", "it creates this session's worktree and puts the task there (`agent-ops", "worktree add <name> --session <session-id>` does the same without a", "task). Work only inside the printed path", "(Claude Code: EnterWorktree with that path; otherwise use it as every", "command's working directory). Commit, then run verify and review for", "each task with the printed `--base`; do not run `task complete` in the", "worktree. Leave it (Claude Code: ExitWorktree with action keep) and run", "`agent-ops worktree finish <name>` from the main checkout: it completes", "every task in the worktree, subtasks first, then merges. A finish that", "reports an incomplete task names it; verify or review that task again", "in the worktree and finish again. A finish that reports a conflict is", "resolved once, as a new task whose criteria cover both intents; if its", "verification or review fails, reset as instructed and report.", "");
     }
     if (context.capabilities.includes("lifecycle-summary")) {
         lines.push("Advisory lifecycle summaries and local logs are informational. Advisory", "failures must remain fail-open and cannot become verification evidence.", "");

package/dist/runtime/src/install/plan.js

@@ -102,7 +102,10 @@ function buildConfig(profiles, existing, reviewTargets = [], detectedCommands =
         },
         pathMappings: existing?.pathMappings ?? [],
         securityExceptions: existing?.securityExceptions ?? [],
-        ...(reviewRoles === undefined ? {} : { reviewRoles: [...reviewRoles] })
+        ...(reviewRoles === undefined ? {} : { reviewRoles: [...reviewRoles] }),
+        ...(existing?.worktree === undefined
+            ? {}
+            : { worktree: structuredClone(existing.worktree) })
     };
 }
 async function planConfig(root, profiles, existingManifest, suppliedConfig, reviewTargets = [], completionGateEnabled = false) {