@kylecheng3146/agent-ops 0.3.6 → 0.4.0

package/dist/packages/cli/src/args.js

@@ -17,7 +17,7 @@ const SCOPES = new Set(["project", "user"]);
 const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
 // opencode is absent: it has no read-only flag, so it cannot review.
 const REVIEW_TARGETS = new Set(["agy", "claude", "codex"]);
-export const WORKTREE_ACTIONS = ["add", "finish", "list", "resume", "remove"];
+export const WORKTREE_ACTIONS = ["add", "commit", "finish", "list", "resume", "remove"];
 export class CliArgumentError extends Error {
     code;
     option;
@@ -87,6 +87,8 @@ export function parseArgs(argv) {
     let worktreeName;
     let force = false;
     let worktreeFrom;
+    let worktreeMessage;
+    let output;
     let worktreeTargetBranch;
     let worktree;
     for (let index = 0; index < argv.length; index += 1) {
@@ -276,6 +278,23 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "-m":
+            case "--message": {
+                if (worktreeMessage !== undefined) {
+                    duplicate(token);
+                }
+                worktreeMessage = readOptionValue(argv, index, token);
+                index += 1;
+                break;
+            }
+            case "--output": {
+                if (output !== undefined) {
+                    duplicate(token);
+                }
+                output = readOptionValue(argv, index, token);
+                index += 1;
+                break;
+            }
             case "--target-branch": {
                 if (worktreeTargetBranch !== undefined) {
                     duplicate(token);
@@ -339,7 +358,11 @@ export function parseArgs(argv) {
                     action = token;
                     break;
                 }
-                if (command === "worktree" && action !== undefined && action !== "list" && worktreeName === undefined) {
+                if (command === "worktree" &&
+                    action !== undefined &&
+                    action !== "list" &&
+                    action !== "commit" &&
+                    worktreeName === undefined) {
                     worktreeName = token;
                     break;
                 }
@@ -400,6 +423,8 @@ export function parseArgs(argv) {
             rerun ||
             worktree !== undefined ||
             worktreeFrom !== undefined ||
+            worktreeMessage !== undefined ||
+            output !== undefined ||
             worktreeTargetBranch !== undefined ||
             force) {
             throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Only --json may be combined with global help or version.");
@@ -415,9 +440,15 @@ export function parseArgs(argv) {
     if (command === "worktree" && action === undefined) {
         throw new CliArgumentError("CLI_ACTION_REQUIRED", `The worktree command requires one of: ${WORKTREE_ACTIONS.join(", ")}.`);
     }
-    if (command === "worktree" && action !== "list" && worktreeName === undefined) {
+    if (command === "worktree" && action !== "list" && action !== "commit" && worktreeName === undefined) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", `worktree ${action} requires a worktree name.`);
     }
+    if (command === "worktree" && action === "commit" && (worktreeMessage === undefined || worktreeMessage.trim() === "")) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "worktree commit requires --message (-m).", "--message");
+    }
+    if (worktreeMessage !== undefined && !(command === "worktree" && action === "commit")) {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--message may be used only with worktree commit.", "--message");
+    }
     if (command === "task" && action === undefined) {
         throw new CliArgumentError("CLI_ACTION_REQUIRED", "The task command requires one of: create, status, attach, complete, archive, export.");
     }
@@ -556,7 +587,13 @@ export function parseArgs(argv) {
             dryRun ||
             yes ||
             rerun)) {
-        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "worktree accepts only a name, --session, --from, --target-branch and --json.");
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "worktree accepts only a name, --session, --from, --target-branch, --message and --json.");
+    }
+    if (output !== undefined && command !== "review" && command !== "doctor") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--output may be used only with review or doctor.", "--output");
+    }
+    if (output !== undefined && (output.trim() === "" || output.includes("\0"))) {
+        throw new CliArgumentError("CLI_INVALID_VALUE", "Invalid value for --output.", "--output");
     }
     if (force && !(command === "worktree" && action === "remove")) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--force may be used only with worktree remove.");
@@ -572,7 +609,12 @@ export function parseArgs(argv) {
         !/^[A-Za-z0-9._/-]{1,128}$/u.test(worktreeTargetBranch)) {
         throw new CliArgumentError("CLI_INVALID_VALUE", `Invalid value for --target-branch: ${worktreeTargetBranch}`, "--target-branch");
     }
-    if (command === "worktree" && action !== "add" && action !== "resume" && sessionId !== undefined) {
+    // commit acts as a session (it refuses another's worktree), so it may be told which.
+    if (command === "worktree" &&
+        action !== "add" &&
+        action !== "resume" &&
+        action !== "commit" &&
+        sessionId !== undefined) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", `worktree ${action} takes the session from the worktree; omit --session.`);
     }
     return {
@@ -595,6 +637,8 @@ export function parseArgs(argv) {
         ...(sessionId === undefined ? {} : { sessionId }),
         ...(base === undefined ? {} : { base }),
         ...(worktreeFrom === undefined ? {} : { worktreeFrom }),
+        ...(worktreeMessage === undefined ? {} : { worktreeMessage }),
+        ...(output === undefined ? {} : { output }),
         ...(worktreeTargetBranch === undefined ? {} : { worktreeTargetBranch }),
         ...(checkAuth ? { checkAuth } : {}),
         ...(checkAuthTargets.length === 0 ? {} : { checkAuthTargets }),

package/dist/packages/cli/src/bin.js

@@ -6,9 +6,10 @@ import { join } from "node:path";
 import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { commonHarnessAdapters, harnessHookPath, HARNESS_IDS } from "../../../runtime/src/install/harness.js";
-import { agyRuntimeStatus, agyVersionSupported, hookRegistrationDrift, repositoryTrustStatus, smokeAvailabilityStatus } from "../../../runtime/src/install/probes.js";
+import { agyRuntimeStatus, agyVersionSupported, hookRegistrationDrift, repositoryTrustProbe, smokeAvailabilityStatus } from "../../../runtime/src/install/probes.js";
 import { parseInstallManifest } from "../../../runtime/src/fs/manifest.js";
-import { readRecordedSessionId } from "../../../runtime/src/hooks/codex-loop.js";
+import { readRecordedSessionId, resolveCommandSessionId, sessionIdFromEnvironment } from "../../../runtime/src/hooks/codex-loop.js";
+import { codexHomeDirectory } from "../../../runtime/src/install/preauth.js";
 import { NpmRegistryClient } from "../../../runtime/src/registry/npm.js";
 import { TaskService } from "../../../runtime/src/task/service.js";
 import { FileTaskStore } from "../../../runtime/src/task/store.js";
@@ -31,7 +32,7 @@ import { formatUninstallPlan, runUninstallCommand } from "./commands/uninstall.j
 import { runTaskCommand } from "./commands/task.js";
 import { runReviewCommand } from "./commands/review.js";
 import { createReviewExecutor, ReviewInterruptedError } from "../../../runtime/src/review/execute.js";
-import { probeReviewTarget } from "../../../runtime/src/review/probe.js";
+import { probeReviewTargetDetailed } from "../../../runtime/src/review/probe.js";
 import { resolveReviewScope } from "../../../runtime/src/review/scope.js";
 import { resolveReviewRole } from "../../../runtime/src/review/roles.js";
 import { runTrustCommand } from "./commands/trust.js";
@@ -234,6 +235,7 @@ else {
                         isTTY,
                         toolkitVersion: CLI_VERSION,
                         hookRuntimePath: HOOK_RUNTIME_PATH,
+                        codexHome: codexHomeDirectory(),
                         agyWarning: () => {
                             try {
                                 const output = runAgy(["--version"], { timeout: 5_000 });
@@ -304,34 +306,7 @@ else {
                                     };
                             },
                             repositoryTrust: async () => {
-                                const trust = await repositoryTrust(root, config, CLI_VERSION);
-                                const status = repositoryTrustStatus(trust);
-                                if (trust === "STALE") {
-                                    return {
-                                        status,
-                                        message: "Repository trust binding is stale.",
-                                        code: "TRUST_REQUIRED",
-                                        remediation: "Run `agent-ops trust grant`."
-                                    };
-                                }
-                                if (trust === "UNTRUSTED") {
-                                    const verificationConfigured = config.verification.commands.length > 0;
-                                    return {
-                                        status,
-                                        message: verificationConfigured
-                                            ? "Repository is not trusted; Stop verification will not run."
-                                            : "Repository is not trusted.",
-                                        ...(verificationConfigured
-                                            ? {
-                                                code: "TRUST_REQUIRED",
-                                                remediation: "Run `agent-ops trust grant`."
-                                            }
-                                            : {
-                                                remediation: "No action needed; trust is only required once verification.commands is set."
-                                            })
-                                    };
-                                }
-                                return { status };
+                                return repositoryTrustProbe(await repositoryTrust(root, config, CLI_VERSION), config.verification.commands.length > 0);
                             },
                             smokeAvailability: () => {
                                 const status = smokeAvailabilityStatus(config);
@@ -343,7 +318,7 @@ else {
                                     }
                                     : { status };
                             },
-                            reviewTarget: async (target, deep) => await probeReviewTarget(target, { cwd: root, deep }),
+                            reviewTarget: async (target, deep) => await probeReviewTargetDetailed(target, { cwd: root, deep }),
                             worktrees: async () => await worktreeDoctorProbe(root),
                             worktreeBranchLock: async () => await worktreeBranchLockProbe(root),
                             rootGhostFiles: async () => await rootGhostFilesProbe(root)
@@ -362,6 +337,7 @@ else {
                         args,
                         root,
                         isTTY,
+                        codexHome: codexHomeDirectory(),
                         trustStore: store,
                         calculateTrustBinding: async () => await plannedTrustBinding(root),
                         confirm: async (plan, trust) => await confirmPlan(formatUninstallPlan(plan, trust))
@@ -387,6 +363,7 @@ else {
                         isTTY,
                         toolkitVersion: CLI_VERSION,
                         hookRuntimePath: HOOK_RUNTIME_PATH,
+                        codexHome: codexHomeDirectory(),
                         ...(updateArgs.hookTargets === undefined
                             ? {}
                             : { hookTargets: updateArgs.hookTargets }),
@@ -422,8 +399,13 @@ else {
                     // Explicit `--session` wins, then an injected identity, then the
                     // id a SessionStart hook recorded for this checkout: a command
                     // run inside a session is never told which session it is in.
-                    const sessionId = process.env.AGENT_OPS_SESSION_ID ??
-                        await readRecordedSessionId(root);
+                    // Only create, attach and status act as a session; a contested
+                    // record refuses those rather than guess, and leaves the rest.
+                    const actsAsSession = args.action === "create" ||
+                        args.action === "attach" || args.action === "status";
+                    const sessionId = args.sessionId ?? (actsAsSession
+                        ? await resolveCommandSessionId(root)
+                        : sessionIdFromEnvironment() ?? await readRecordedSessionId(root));
                     const createConfig = args.action === "create"
                         ? (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config
                         : undefined;
@@ -507,7 +489,7 @@ else {
                                 ...(reviewRole?.timeoutMs === undefined
                                     ? {}
                                     : { timeoutMs: reviewRole.timeoutMs }),
-                                preflightTarget: async (target, budget) => await probeReviewTarget(target, {
+                                preflightTarget: async (target, budget) => await probeReviewTargetDetailed(target, {
                                     cwd: root,
                                     deep: true,
                                     // The probe answers within the chain's remaining budget

package/dist/packages/cli/src/cli.js

@@ -1,3 +1,5 @@
+import { writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
 import { CliArgumentError, parseArgs } from "./args.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { errorEnvelope, okEnvelope, writeEnvelope } from "./output.js";
@@ -106,6 +108,9 @@ Options:
   --scope <project|user>
   --harness <all|both|agy|claude|codex|opencode|comma-separated>
   --check-auth   Probe each review target's authentication with one real call
+  --output <file>
+                 Write the JSON envelope to <file> (mode 0600) and print one
+                 summary line, so no shell redirect is needed
   --json
 `,
     update: `Usage: agent-ops update [options]
@@ -172,6 +177,8 @@ fresh adversarial reviewer from the configured pair.
 Options:
   --task <id>          Required task whose original criteria are reviewed
   --base <git-ref>     Review a clean committed range
+  --output <file>      Write the JSON envelope to <file> (mode 0600) and print
+                       one summary line, so no shell redirect is needed
   --json
   --yes                Required authorization for both reviewer sessions
 `,
@@ -186,6 +193,7 @@ Options:
   --json
 `,
     worktree: `Usage: agent-ops worktree <add|finish|resume|remove> <name> [options]
+       agent-ops worktree commit --message <text> [--json]
        agent-ops worktree list [--json]
 
 Give one writing session its own Git worktree, so parallel sessions stop
@@ -205,6 +213,9 @@ voiding each other's verification and review. Run it from the main checkout.
                branch to the worktree's (after a clean rebase and
                re-verification if the branch moved), record the task in
                git notes, and remove the worktree. One finish runs at a time.
+  commit       Stage every change in the current worktree and commit it with
+               --message. Refuses the main checkout and a worktree another
+               session owns, and needs no Git in the shell.
   list         Every agent-ops worktree: session, commits ahead, uncommitted
                changes, task status and last activity.
   resume <name>
@@ -221,6 +232,7 @@ Options:
                    add: branch finish merges back into (defaults to the current
                    branch; required when the main checkout is detached)
   --force          remove: discard uncommitted or unmerged work
+  --message <text> commit: the commit message (also -m)
   --json
 `
 };
@@ -275,11 +287,24 @@ export async function runCli(argv, io, services) {
             return writeAndReturn(io, errorEnvelope("CLI_COMMAND_UNAVAILABLE", `Command is not implemented yet: ${args.command}`), args.json, 1);
         }
         const result = await execute(args);
-        return writeAndReturn(io, result, args.json, result.status === "ok"
+        const exitCode = result.status === "ok"
             ? 0
             : result.code === "REVIEW_NOT_RUN"
                 ? 2
-                : 1);
+                : 1;
+        if (args.output !== undefined) {
+            // The envelope goes to the file whole; stdout carries one line, so an
+            // agent needs neither a shell redirect nor the whole report in context.
+            try {
+                await writeFile(resolve(args.output), `${JSON.stringify(result.data === undefined ? { ...result, data: null } : result)}\n`, { mode: 0o600 });
+            }
+            catch {
+                throw new AgentOpsError("CLI_OUTPUT_WRITE_FAILED", `Could not write ${args.output}.`);
+            }
+            io.writeStdout(`agent-ops: ${result.code} (${result.status}); envelope written to ${args.output}\n`);
+            return exitCode;
+        }
+        return writeAndReturn(io, result, args.json, exitCode);
     }
     catch (error) {
         if (error instanceof CliArgumentError) {

package/dist/packages/cli/src/commands/hook.js

@@ -50,7 +50,10 @@ export async function runHookCommand(options) {
                 : { completionGate: options.completionGate }),
             ...(options.worktreeGuard === undefined
                 ? {}
-                : { worktreeGuard: options.worktreeGuard })
+                : { worktreeGuard: options.worktreeGuard }),
+            ...(options.worktreeEnter === undefined
+                ? {}
+                : { worktreeEnter: options.worktreeEnter })
         });
         return descriptor.runtime.formatOutput(options.event, result);
     }

package/dist/packages/cli/src/commands/init.js

@@ -119,6 +119,7 @@ export async function runInitCommand(options) {
         ...(args.completionGate === undefined
             ? {}
             : { completionGateEnabled: args.completionGate }),
+        ...(options.codexHome === undefined ? {} : { codexHome: options.codexHome }),
         ...(worktreeConfig === undefined
             ? {}
             : { worktree: worktreeConfig })

package/dist/packages/cli/src/commands/parallel.js

@@ -1,7 +1,8 @@
 import { okEnvelope } from "../output.js";
+import { resolveCommandSessionId, sessionIdFromEnvironment } from "../../../../runtime/src/hooks/codex-loop.js";
 import { addWorktree } from "../../../../runtime/src/parallel/service.js";
 import { finishWorktree } from "../../../../runtime/src/parallel/finish.js";
-import { idleWorktrees, listWorktrees, removeWorktree, resumeWorktree } from "../../../../runtime/src/parallel/manage.js";
+import { commitWorktree, idleWorktrees, listWorktrees, removeWorktree, resumeWorktree } from "../../../../runtime/src/parallel/manage.js";
 function listText(statuses, now) {
     if (statuses.length === 0)
         return "No agent-ops worktrees.";
@@ -49,11 +50,23 @@ export async function runWorktreeCommand(options) {
         const worktrees = await listWorktrees(options.deps, options.cwd);
         return okEnvelope("WORKTREE_LIST", { worktrees, text: listText(worktrees, Date.now()) });
     }
+    if (args.action === "commit") {
+        const committed = await commitWorktree(options.deps, {
+            cwd: options.cwd,
+            sessionId: args.sessionId ?? await resolveCommandSessionId(options.cwd),
+            message: args.worktreeMessage ?? ""
+        });
+        return okEnvelope("WORKTREE_COMMITTED", {
+            ...committed,
+            text: `Committed ${committed.commit} in ${committed.record.path}.\n` +
+                `Verify and review with --base ${committed.record.base} (or the commit before your first change), then finish from ${committed.record.mainRoot}.`
+        });
+    }
     if (args.action === "resume") {
         const record = await resumeWorktree(options.deps, {
             cwd: options.cwd,
             name: args.worktreeName,
-            sessionId: args.sessionId ?? process.env.AGENT_OPS_SESSION_ID
+            sessionId: args.sessionId ?? sessionIdFromEnvironment()
         });
         return okEnvelope("WORKTREE_RESUMED", {
             record,
@@ -78,7 +91,7 @@ export async function runWorktreeCommand(options) {
         const finished = await finishWorktree(options.deps, { cwd: options.cwd, name: args.worktreeName });
         return okEnvelope("WORKTREE_FINISHED", { ...finished, text: finishText(finished) });
     }
-    const sessionId = args.sessionId ?? process.env.AGENT_OPS_SESSION_ID;
+    const sessionId = args.sessionId ?? sessionIdFromEnvironment();
     const result = await addWorktree(options.deps, {
         cwd: options.cwd,
         name: args.worktreeName,

package/dist/packages/cli/src/commands/uninstall.js

@@ -56,7 +56,8 @@ async function trustChange(options, plan) {
         : await planTrustRevoke(binding, options.trustStore);
 }
 export async function runUninstallCommand(options) {
-    const plan = await createUninstallPlan(options.root, options.args.harness);
+    const planOptions = options.codexHome === undefined ? {} : { codexHome: options.codexHome };
+    const plan = await createUninstallPlan(options.root, options.args.harness, planOptions);
     if (!plan.installed) {
         return okEnvelope("UNINSTALL_NOT_INSTALLED", {
             applied: false,
@@ -80,7 +81,7 @@ export async function runUninstallCommand(options) {
         !(await options.confirm(plan, trust))) {
         return uninstallError("UNINSTALL_CANCELLED", "Uninstall was cancelled; no files were changed.", plan, trust);
     }
-    await applyUninstallPlan(options.root, plan);
+    await applyUninstallPlan(options.root, plan, planOptions);
     if (trust.action === "revoke") {
         try {
             if (options.trustStore === undefined ||

package/dist/packages/cli/src/commands/update.js

@@ -112,6 +112,7 @@ export async function runUpdateCommand(options) {
         ...((options.hookTargets ?? options.args.hookTargets) === undefined
             ? {}
             : { hookTargets: options.hookTargets ?? options.args.hookTargets }),
+        ...(options.codexHome === undefined ? {} : { codexHome: options.codexHome }),
         ...(worktree === undefined ? {} : { worktree })
     });
     const trust = await trustChange(options, plan);

package/dist/packages/cli/src/context.js

@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, join, sep } from "node:path";
 import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
 import { sha256 } from "../../../runtime/src/fs/hash.js";
 import { loadConfigFile } from "../../../runtime/src/config/load.js";
@@ -23,6 +24,30 @@ export const DEFAULT_CONFIG = {
     pathMappings: [],
     securityExceptions: []
 };
+/**
+ * Where a checkout's project config lives. Inside an agent-ops worktree it is
+ * the main checkout's: a branch must not change the config that decides its
+ * own gate, verifiers and trust before that change is merged, and a copy of a
+ * gitignored file can be missing or stale. Anything git cannot confirm is a
+ * worktree of this repository falls back to the checkout itself.
+ */
+export function projectConfigRoot(root) {
+    try {
+        const common = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        if (basename(common) !== ".git") {
+            return root;
+        }
+        const main = realpathSync(dirname(common));
+        const here = realpathSync(root);
+        return here.startsWith(`${join(main, ".worktrees")}${sep}`) &&
+            existsSync(join(main, ".agent-ops", "config.json"))
+            ? main
+            : root;
+    }
+    catch {
+        return root;
+    }
+}
 function defaultConfigLayer() {
     return {
         source: "default",
@@ -49,7 +74,7 @@ async function loadOptionalConfig(path) {
 export async function loadEffectiveConfig(root, scope, projectOverride) {
     const home = process.env.AGENT_OPS_HOME ?? homedir();
     const userPath = join(home, ".agent-ops", "config.json");
-    const projectPath = join(root, ".agent-ops", "config.json");
+    const projectPath = join(scope === "user" ? root : projectConfigRoot(root), ".agent-ops", "config.json");
     const layers = [defaultConfigLayer()];
     if (scope === "user") {
         const user = await loadOptionalConfig(userPath);
@@ -92,7 +117,7 @@ export async function loadEffectiveConfig(root, scope, projectOverride) {
 export async function loadProjectHookConfig(root) {
     const home = process.env.AGENT_OPS_HOME ?? homedir();
     const userPath = join(home, ".agent-ops", "config.json");
-    const projectPath = join(root, ".agent-ops", "config.json");
+    const projectPath = join(projectConfigRoot(root), ".agent-ops", "config.json");
     const layers = [defaultConfigLayer()];
     let project;
     try {

package/dist/packages/cli/src/hook-process.js

@@ -9,6 +9,7 @@ import { resolveContainedPath } from "../../../runtime/src/fs/paths.js";
 import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { claudeStopRecursionMarker } from "../../../runtime/src/adapters/claude/input.js";
 import { HARNESS_IDS, harnessDescriptor } from "../../../runtime/src/install/harness.js";
+import { evaluateWorktreeEnter } from "../../../runtime/src/parallel/enter.js";
 import { evaluateWorktreeWrite, resolveMainRoot } from "../../../runtime/src/parallel/guard.js";
 import { ensureSessionWorktree, recordSessionOrigin } from "../../../runtime/src/parallel/service.js";
 import { CompletionGateService } from "../../../runtime/src/hooks/completion-gate.js";
@@ -214,11 +215,12 @@ function shouldBuildStopVerification(harness, event, config, rawInput) {
  * The gate of one checkout. A session redirected into a worktree is judged by
  * that worktree's gate, built the same way from the worktree's own config.
  */
-function completionGateFor(root, config, gitRunner) {
+function completionGateFor(root, config, gitRunner, harness) {
     return new CompletionGateService({
         root,
         config,
         gitRunner,
+        ...(harness === undefined ? {} : { harness }),
         taskService: new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root)),
         evidenceStore: new FileEvidenceStore(root, root),
         forRoot: async (worktree) => {
@@ -226,7 +228,7 @@ function completionGateFor(root, config, gitRunner) {
             if (outcome.kind !== "loaded" || !outcome.config.features.completionGate.enabled) {
                 throw new Error("The redirected worktree has no enabled completion gate.");
             }
-            return completionGateFor(worktree, outcome.config, defaultGitRunner(worktree));
+            return completionGateFor(worktree, outcome.config, defaultGitRunner(worktree), harness);
         }
     });
 }
@@ -341,7 +343,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
         const completionGate = (harnessId === "agy" || harnessId === "claude") &&
             config.features.completionGate.enabled
             ? dependencies.completionGate ?? {
-                handle: async (normalized) => await completionGateFor(root, config, gitRunner).handle(normalized)
+                handle: async (normalized) => await completionGateFor(root, config, gitRunner, harnessId).handle(normalized)
             }
             : undefined;
         const worktreeGuard = config.worktree?.mode === "auto"
@@ -354,6 +356,14 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
                         : async (sessionId) => (await ensureSessionWorktree(dependencies.worktree, { cwd: mainRoot, sessionId })).path);
             }
             : undefined;
+        const worktreeEnter = config.worktree?.mode === "auto"
+            ? async (enter) => {
+                const mainRoot = await resolveMainRoot(gitRunner);
+                return mainRoot === null
+                    ? { action: "continue", status: "UNKNOWN", code: "WORKTREE_GUARD_UNAVAILABLE" }
+                    : await evaluateWorktreeEnter(mainRoot, enter.path, enter.sessionId);
+            }
+            : undefined;
         if (hookEvent === "SessionStart" && config.worktree?.mode === "auto" &&
             dependencies.worktree !== undefined && typeof parsedInput === "object" && parsedInput !== null) {
             const fields = parsedInput;
@@ -370,6 +380,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             config,
             trusted,
             ...(worktreeGuard === undefined ? {} : { worktreeGuard }),
+            ...(worktreeEnter === undefined ? {} : { worktreeEnter }),
             ...(dependencies.advisory === undefined
                 ? {}
                 : { advisory: dependencies.advisory }),

package/dist/packages/cli/src/public-plan.js

@@ -1,3 +1,4 @@
+import { join } from "node:path";
 import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { sha256 } from "../../../runtime/src/fs/hash.js";
 const OPAQUE_SUMMARY = "Opaque managed settings content withheld.";
@@ -35,6 +36,29 @@ export function toPublicOperation(operation) {
 export function toPublicOperations(operations) {
     return operations.map(toPublicOperation);
 }
+/**
+ * Pre-authorization changes join the ordinary operations, so every preview and
+ * confirmation shows them. A file in Codex's home is shown by absolute path;
+ * a file agent-ops does not wholly own is described, never printed.
+ */
+export function toPublicPreauthorization(changes) {
+    return (changes ?? []).map((change) => {
+        const path = publicPath(join(change.root, change.operation.path));
+        const operation = change.operation;
+        if (operation.kind === "remove") {
+            return { kind: "remove", path, expectedHash: operation.expectedHash };
+        }
+        return change.ownedContent
+            ? { kind: "write", path, expectedHash: operation.expectedHash, content: operation.content }
+            : {
+                kind: "write",
+                path,
+                expectedHash: operation.expectedHash,
+                contentHash: sha256(operation.content),
+                summary: redactSecrets(change.summary)
+            };
+    });
+}
 export function toPublicInstallPlan(plan, trust) {
     return {
         scope: plan.scope,
@@ -42,7 +66,10 @@ export function toPublicInstallPlan(plan, trust) {
         profiles: plan.profiles,
         capabilities: plan.capabilities,
         manifest: plan.manifest,
-        operations: toPublicOperations(plan.operations),
+        operations: [
+            ...toPublicOperations(plan.operations),
+            ...toPublicPreauthorization(plan.preauthorization)
+        ],
         detectedVerification: plan.detectedVerification,
         ...(trust === undefined ? {} : { trust })
     };
@@ -59,7 +86,10 @@ export function toPublicUninstallPlan(plan, trust) {
         installed: plan.installed,
         manifest: plan.manifest,
         manifestHash: plan.manifestHash,
-        operations: toPublicOperations(plan.operations),
+        operations: [
+            ...toPublicOperations(plan.operations),
+            ...toPublicPreauthorization(plan.preauthorization)
+        ],
         ...(trust === undefined ? {} : { trust })
     };
 }

package/dist/runtime/src/adapters/claude/config.js

@@ -11,7 +11,7 @@ const CLAUDE_LOOP_EVENTS = [
     "SubagentStop"
 ];
 const CLAUDE_HOOK_MARKER = "--managed-by=agent-ops";
-export const CLAUDE_PRE_TOOL_MATCHER = "Bash|Edit|MultiEdit|NotebookEdit|Write";
+export const CLAUDE_PRE_TOOL_MATCHER = "Bash|Edit|MultiEdit|NotebookEdit|Write|EnterWorktree";
 const CLAUDE_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.sh";
 const CLAUDE_WINDOWS_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.ps1";
 export function claudeSettingsTarget(scope) {

package/dist/runtime/src/adapters/claude/input.js

@@ -63,6 +63,23 @@ export function normalizeClaudeHookInput(input) {
             };
         }
     }
+    if (input.hook_event_name === "PreToolUse" &&
+        input.tool_name === "EnterWorktree" &&
+        isRecord(input.tool_input) &&
+        typeof projectRoot === "string" &&
+        projectRoot.length > 0) {
+        const target = input.tool_input.path;
+        // A `name` asks for a new worktree of Claude's own, which is not this
+        // hook's business.
+        if (typeof target === "string" && target.length > 0 && !target.includes("\0")) {
+            return {
+                event: "enter-worktree",
+                projectRoot,
+                path: resolve(projectRoot, target),
+                ...(sessionId === undefined ? {} : { sessionId })
+            };
+        }
+    }
     if (input.hook_event_name === "PreToolUse" &&
         input.tool_name === "Bash" &&
         isRecord(input.tool_input) &&

package/dist/runtime/src/adapters/claude/output.js

@@ -32,6 +32,15 @@ export function claudeHookOutput(event, result) {
             }
         });
     }
+    if (event === "PreToolUse" && result.decision === "allow") {
+        return json({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "allow",
+                permissionDecisionReason: denialReason
+            }
+        });
+    }
     if (event === "Stop" && result.evidence !== undefined) {
         if (result.status === "FAIL") {
             const failed = result.evidence.commandResults