@kylecheng3146/agent-ops 0.3.7 → 0.4.1

package/dist/packages/cli/src/cli.js

@@ -1,3 +1,5 @@
+import { writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
 import { CliArgumentError, parseArgs } from "./args.js";
 import { AgentOpsError } from "../../../runtime/src/fs/paths.js";
 import { errorEnvelope, okEnvelope, writeEnvelope } from "./output.js";
@@ -27,6 +29,7 @@ Commands:
              Manage independent task acceptance state
   verify     Run configured verification
   review     Run an independent review
+  batch      Verify and review a parent task's subtasks together
   allow-stop Grant one fingerprint-bound completion-gate Stop permit (requires --session)
   agy-run    Run headless agy with a process-exit completion recheck
   worktree <add|finish|list|resume|remove>
@@ -45,13 +48,16 @@ Options:
   --check-auth-target <target>        Repeatable doctor filter with --check-auth
   --task <id>
   --parent <task-id>                  Task create: record a subtask of this
-                                      task; task status: list its subtasks
+                                      task; task status: list its subtasks;
+                                      batch: the task whose subtasks it covers
+  --parent-base <git-ref>             Batch only: base for the parent task
+  --width <n>                         Batch only: reviews allowed at once (default 2)
   --target-version <version>          Update target version (offline-capable)
   --title <text>
   --criterion <json>                    Repeatable
   --evidence <criterion-id=reference>   Repeatable
   --session <id>
-  --base <git-ref>                    Verify/review/complete a clean committed range
+  --base <git-ref>                    Verify/review/batch/complete a clean committed range
   --dry-run
   --json
   --yes
@@ -106,6 +112,9 @@ Options:
   --scope <project|user>
   --harness <all|both|agy|claude|codex|opencode|comma-separated>
   --check-auth   Probe each review target's authentication with one real call
+  --output <file>
+                 Write the JSON envelope to <file> (mode 0600) and print one
+                 summary line, so no shell redirect is needed
   --json
 `,
     update: `Usage: agent-ops update [options]
@@ -172,8 +181,30 @@ fresh adversarial reviewer from the configured pair.
 Options:
   --task <id>          Required task whose original criteria are reviewed
   --base <git-ref>     Review a clean committed range
+  --output <file>      Write the JSON envelope to <file> (mode 0600) and print
+                       one summary line, so no shell redirect is needed
   --json
   --yes                Required authorization for both reviewer sessions
+`,
+    batch: `Usage: agent-ops batch --parent <task-id> --yes [options]
+
+Verify and review the active subtasks of a parent task, and the parent itself,
+together. Verify runs one task at a time and skips a task that already has
+fresh PASS evidence; each review starts as soon as its own verify passes.
+Nothing may commit or edit the worktree while it runs.
+
+Options:
+  --parent <task-id>   Required task whose active subtasks and itself are covered
+  --base <git-ref>     Base for the subtasks (default: each task's recorded
+                       review base, then the worktree base)
+  --parent-base <git-ref>
+                       Base for the parent task (same default)
+  --width <n>          Reviews allowed at once (default 2); a transient
+                       NOT_RUN lowers it to 1 and earns one retry
+  --output <file>      Write the JSON envelope to <file> (mode 0600) and print
+                       one summary line, so no shell redirect is needed
+  --json
+  --yes                Required authorization for the reviewer sessions
 `,
     "allow-stop": `Usage: agent-ops allow-stop --session <id> [options]
 
@@ -186,6 +217,7 @@ Options:
   --json
 `,
     worktree: `Usage: agent-ops worktree <add|finish|resume|remove> <name> [options]
+       agent-ops worktree commit --message <text> [--json]
        agent-ops worktree list [--json]
 
 Give one writing session its own Git worktree, so parallel sessions stop
@@ -205,6 +237,9 @@ voiding each other's verification and review. Run it from the main checkout.
                branch to the worktree's (after a clean rebase and
                re-verification if the branch moved), record the task in
                git notes, and remove the worktree. One finish runs at a time.
+  commit       Stage every change in the current worktree and commit it with
+               --message. Refuses the main checkout and a worktree another
+               session owns, and needs no Git in the shell.
   list         Every agent-ops worktree: session, commits ahead, uncommitted
                changes, task status and last activity.
   resume <name>
@@ -221,6 +256,7 @@ Options:
                    add: branch finish merges back into (defaults to the current
                    branch; required when the main checkout is detached)
   --force          remove: discard uncommitted or unmerged work
+  --message <text> commit: the commit message (also -m)
   --json
 `
 };
@@ -275,11 +311,24 @@ export async function runCli(argv, io, services) {
             return writeAndReturn(io, errorEnvelope("CLI_COMMAND_UNAVAILABLE", `Command is not implemented yet: ${args.command}`), args.json, 1);
         }
         const result = await execute(args);
-        return writeAndReturn(io, result, args.json, result.status === "ok"
+        const exitCode = result.status === "ok"
             ? 0
-            : result.code === "REVIEW_NOT_RUN"
+            : result.code === "REVIEW_NOT_RUN" || result.code === "BATCH_NOT_RUN"
                 ? 2
-                : 1);
+                : 1;
+        if (args.output !== undefined) {
+            // The envelope goes to the file whole; stdout carries one line, so an
+            // agent needs neither a shell redirect nor the whole report in context.
+            try {
+                await writeFile(resolve(args.output), `${JSON.stringify(result.data === undefined ? { ...result, data: null } : result)}\n`, { mode: 0o600 });
+            }
+            catch {
+                throw new AgentOpsError("CLI_OUTPUT_WRITE_FAILED", `Could not write ${args.output}.`);
+            }
+            io.writeStdout(`agent-ops: ${result.code} (${result.status}); envelope written to ${args.output}\n`);
+            return exitCode;
+        }
+        return writeAndReturn(io, result, args.json, exitCode);
     }
     catch (error) {
         if (error instanceof CliArgumentError) {

package/dist/packages/cli/src/commands/batch.js

@@ -0,0 +1,106 @@
+import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
+import { DEFAULT_BATCH_WIDTH, runBatch } from "../../../../runtime/src/review/batch.js";
+import { resolveBatchBase, selectBatchTasks } from "../../../../runtime/src/review/batch-select.js";
+import { redactSecrets } from "../../../../runtime/src/security/redact.js";
+import { safeTaskText } from "../../../../runtime/src/task/render.js";
+import { errorEnvelope } from "../output.js";
+function outcomeLabel(task) {
+    if (task.aborted) {
+        return "aborted";
+    }
+    if (task.review === null) {
+        return task.verify === "FAIL" ? "no review (verify failed)" : "not reviewed";
+    }
+    const reason = task.review.reason === undefined ? "" : ` ${task.review.reason}`;
+    return `${task.review.status}${reason}${task.review.reused === true ? " (reused)" : ""}${task.retried ? " (retried)" : ""}`;
+}
+function renderBatch(data) {
+    const lines = [
+        `Batch of ${data.tasks.length} task(s) under ${data.parentTaskId}, width ${data.width}.`,
+        "",
+        ...data.tasks.map((task) => `- ${task.taskId}  verify ${task.verify}  review ${outcomeLabel(task)}  base ${task.base.slice(0, 12)} (${task.baseSource})  ${safeTaskText(redactSecrets(task.title))}`)
+    ];
+    if (data.tasks.some((task) => task.aborted)) {
+        lines.push("", "The source changed or the run was interrupted; unfinished tasks were aborted. Run the batch again.");
+    }
+    return lines.join("\n");
+}
+function isPass(task) {
+    return !task.aborted && task.review?.status === "PASS";
+}
+/**
+ * The envelope's code follows the worst outcome that needs a human: a failed
+ * verify or review (fix the code) before a run that could not finish (run it
+ * again), so one defect is never hidden behind an unrelated NOT_RUN.
+ */
+function classify(tasks) {
+    if (tasks.every(isPass)) {
+        return "BATCH_RESULT";
+    }
+    return tasks.some((task) => task.verify === "FAIL" || task.review?.status === "FAIL")
+        ? "BATCH_FAILED"
+        : "BATCH_NOT_RUN";
+}
+export async function runBatchCommand(options) {
+    const { args } = options;
+    const parentTaskId = args.parentTaskId;
+    if (parentTaskId === undefined) {
+        throw new AgentOpsError("BATCH_PARENT_REQUIRED", "Batch requires --parent.");
+    }
+    const selected = selectBatchTasks(await options.tasks.list(), parentTaskId);
+    const plan = selected.map((record) => ({
+        record,
+        ...resolveBatchBase(record, record.task.id === parentTaskId, {
+            ...(args.base === undefined ? {} : { base: args.base }),
+            ...(args.parentBase === undefined ? {} : { parentBase: args.parentBase }),
+            ...(options.worktreeBase === undefined ? {} : { worktreeBase: options.worktreeBase })
+        })
+    }));
+    const baseOf = new Map(plan.map((item) => [item.record.task.id, item.base]));
+    const base = (id) => baseOf.get(id);
+    // The first answer is the clean-tree check: a batch reviews committed ranges.
+    if (!await options.guard()) {
+        return {
+            ...errorEnvelope("BATCH_DIRTY_WORKTREE", "Batch needs a clean working tree. Commit or discard your changes first."),
+            data: null
+        };
+    }
+    const width = args.width ?? DEFAULT_BATCH_WIDTH;
+    const outcomes = await runBatch(plan.map((item) => item.record.task.id), {
+        isVerified: (id) => options.isVerified(id, base(id)),
+        verify: (id, signal) => options.verify(id, base(id), signal),
+        review: (id, signal) => options.review(id, base(id), signal),
+        guard: options.guard
+    }, {
+        width,
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+        ...(options.onProgress === undefined ? {} : { onProgress: options.onProgress })
+    });
+    const byId = new Map(outcomes.map((outcome) => [outcome.id, outcome]));
+    const tasks = plan.map((item) => {
+        const outcome = byId.get(item.record.task.id);
+        return {
+            taskId: item.record.task.id,
+            title: item.record.task.title,
+            base: item.base,
+            baseSource: item.source,
+            verify: outcome.verify,
+            review: outcome.review,
+            retried: outcome.retried,
+            aborted: outcome.aborted
+        };
+    });
+    const code = classify(tasks);
+    const passed = tasks.filter(isPass).length;
+    const message = code === "BATCH_RESULT"
+        ? `Batch passed: ${passed} of ${tasks.length} task(s).`
+        : code === "BATCH_FAILED"
+            ? `Batch failed: ${passed} of ${tasks.length} task(s) passed.`
+            : `Batch was not completed: ${passed} of ${tasks.length} task(s) passed.`;
+    const summary = { message, parentTaskId, width, tasks };
+    const data = { ...summary, text: `${message}\n\n${renderBatch(summary)}` };
+    if (code === "BATCH_RESULT") {
+        return { code, status: "ok", data, errors: [] };
+    }
+    return { code, status: "error", data, errors: [{ code, message }] };
+}

package/dist/packages/cli/src/commands/hook.js

@@ -50,7 +50,10 @@ export async function runHookCommand(options) {
                 : { completionGate: options.completionGate }),
             ...(options.worktreeGuard === undefined
                 ? {}
-                : { worktreeGuard: options.worktreeGuard })
+                : { worktreeGuard: options.worktreeGuard }),
+            ...(options.worktreeEnter === undefined
+                ? {}
+                : { worktreeEnter: options.worktreeEnter })
         });
         return descriptor.runtime.formatOutput(options.event, result);
     }

package/dist/packages/cli/src/commands/init.js

@@ -119,6 +119,7 @@ export async function runInitCommand(options) {
         ...(args.completionGate === undefined
             ? {}
             : { completionGateEnabled: args.completionGate }),
+        ...(options.codexHome === undefined ? {} : { codexHome: options.codexHome }),
         ...(worktreeConfig === undefined
             ? {}
             : { worktree: worktreeConfig })

package/dist/packages/cli/src/commands/parallel.js

@@ -1,7 +1,8 @@
 import { okEnvelope } from "../output.js";
+import { resolveCommandSessionId, sessionIdFromEnvironment } from "../../../../runtime/src/hooks/codex-loop.js";
 import { addWorktree } from "../../../../runtime/src/parallel/service.js";
 import { finishWorktree } from "../../../../runtime/src/parallel/finish.js";
-import { idleWorktrees, listWorktrees, removeWorktree, resumeWorktree } from "../../../../runtime/src/parallel/manage.js";
+import { commitWorktree, idleWorktrees, listWorktrees, removeWorktree, resumeWorktree } from "../../../../runtime/src/parallel/manage.js";
 function listText(statuses, now) {
     if (statuses.length === 0)
         return "No agent-ops worktrees.";
@@ -49,11 +50,23 @@ export async function runWorktreeCommand(options) {
         const worktrees = await listWorktrees(options.deps, options.cwd);
         return okEnvelope("WORKTREE_LIST", { worktrees, text: listText(worktrees, Date.now()) });
     }
+    if (args.action === "commit") {
+        const committed = await commitWorktree(options.deps, {
+            cwd: options.cwd,
+            sessionId: args.sessionId ?? await resolveCommandSessionId(options.cwd),
+            message: args.worktreeMessage ?? ""
+        });
+        return okEnvelope("WORKTREE_COMMITTED", {
+            ...committed,
+            text: `Committed ${committed.commit} in ${committed.record.path}.\n` +
+                `Verify and review with --base ${committed.record.base} (or the commit before your first change), then finish from ${committed.record.mainRoot}.`
+        });
+    }
     if (args.action === "resume") {
         const record = await resumeWorktree(options.deps, {
             cwd: options.cwd,
             name: args.worktreeName,
-            sessionId: args.sessionId ?? process.env.AGENT_OPS_SESSION_ID
+            sessionId: args.sessionId ?? sessionIdFromEnvironment()
         });
         return okEnvelope("WORKTREE_RESUMED", {
             record,
@@ -78,7 +91,7 @@ export async function runWorktreeCommand(options) {
         const finished = await finishWorktree(options.deps, { cwd: options.cwd, name: args.worktreeName });
         return okEnvelope("WORKTREE_FINISHED", { ...finished, text: finishText(finished) });
     }
-    const sessionId = args.sessionId ?? process.env.AGENT_OPS_SESSION_ID;
+    const sessionId = args.sessionId ?? sessionIdFromEnvironment();
     const result = await addWorktree(options.deps, {
         cwd: options.cwd,
         name: args.worktreeName,

package/dist/packages/cli/src/commands/review.js

@@ -196,6 +196,28 @@ async function preflightReview(options, context, sourceFingerprint) {
         summary: { status: "PASS", sourceFingerprint, commands }
     };
 }
+/**
+ * Whether the task already holds current PASS verification evidence for the
+ * source a review of `base` (or the working tree) would measure. This is the
+ * same preflight `review` runs before it spawns, so a batch that skips verify
+ * on a true answer never reaches a review that then reports stale evidence.
+ */
+export async function hasFreshVerification(options, taskId, base) {
+    if (options.root === undefined || options.gitRunner === undefined) {
+        return false;
+    }
+    const context = await taskContext({ ...options, taskId });
+    if (context === undefined) {
+        return false;
+    }
+    const scope = await resolveReviewScope({
+        root: options.root,
+        runner: options.gitRunner,
+        ...(base === undefined ? {} : { base })
+    });
+    const fingerprint = await calculateSourceFingerprint(options.root, scope, options.gitRunner);
+    return (await preflightReview(options, context, fingerprint)).ok;
+}
 function scopeReason(error) {
     if (!(error instanceof AgentOpsError)) {
         return undefined;

package/dist/packages/cli/src/commands/uninstall.js

@@ -56,7 +56,8 @@ async function trustChange(options, plan) {
         : await planTrustRevoke(binding, options.trustStore);
 }
 export async function runUninstallCommand(options) {
-    const plan = await createUninstallPlan(options.root, options.args.harness);
+    const planOptions = options.codexHome === undefined ? {} : { codexHome: options.codexHome };
+    const plan = await createUninstallPlan(options.root, options.args.harness, planOptions);
     if (!plan.installed) {
         return okEnvelope("UNINSTALL_NOT_INSTALLED", {
             applied: false,
@@ -80,7 +81,7 @@ export async function runUninstallCommand(options) {
         !(await options.confirm(plan, trust))) {
         return uninstallError("UNINSTALL_CANCELLED", "Uninstall was cancelled; no files were changed.", plan, trust);
     }
-    await applyUninstallPlan(options.root, plan);
+    await applyUninstallPlan(options.root, plan, planOptions);
     if (trust.action === "revoke") {
         try {
             if (options.trustStore === undefined ||

package/dist/packages/cli/src/commands/update.js

@@ -112,6 +112,7 @@ export async function runUpdateCommand(options) {
         ...((options.hookTargets ?? options.args.hookTargets) === undefined
             ? {}
             : { hookTargets: options.hookTargets ?? options.args.hookTargets }),
+        ...(options.codexHome === undefined ? {} : { codexHome: options.codexHome }),
         ...(worktree === undefined ? {} : { worktree })
     });
     const trust = await trustChange(options, plan);

package/dist/packages/cli/src/context.js

@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { basename, dirname, join, sep } from "node:path";
 import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
 import { sha256 } from "../../../runtime/src/fs/hash.js";
 import { loadConfigFile } from "../../../runtime/src/config/load.js";
@@ -23,6 +24,30 @@ export const DEFAULT_CONFIG = {
     pathMappings: [],
     securityExceptions: []
 };
+/**
+ * Where a checkout's project config lives. Inside an agent-ops worktree it is
+ * the main checkout's: a branch must not change the config that decides its
+ * own gate, verifiers and trust before that change is merged, and a copy of a
+ * gitignored file can be missing or stale. Anything git cannot confirm is a
+ * worktree of this repository falls back to the checkout itself.
+ */
+export function projectConfigRoot(root) {
+    try {
+        const common = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        if (basename(common) !== ".git") {
+            return root;
+        }
+        const main = realpathSync(dirname(common));
+        const here = realpathSync(root);
+        return here.startsWith(`${join(main, ".worktrees")}${sep}`) &&
+            existsSync(join(main, ".agent-ops", "config.json"))
+            ? main
+            : root;
+    }
+    catch {
+        return root;
+    }
+}
 function defaultConfigLayer() {
     return {
         source: "default",
@@ -49,7 +74,7 @@ async function loadOptionalConfig(path) {
 export async function loadEffectiveConfig(root, scope, projectOverride) {
     const home = process.env.AGENT_OPS_HOME ?? homedir();
     const userPath = join(home, ".agent-ops", "config.json");
-    const projectPath = join(root, ".agent-ops", "config.json");
+    const projectPath = join(scope === "user" ? root : projectConfigRoot(root), ".agent-ops", "config.json");
     const layers = [defaultConfigLayer()];
     if (scope === "user") {
         const user = await loadOptionalConfig(userPath);
@@ -92,7 +117,7 @@ export async function loadEffectiveConfig(root, scope, projectOverride) {
 export async function loadProjectHookConfig(root) {
     const home = process.env.AGENT_OPS_HOME ?? homedir();
     const userPath = join(home, ".agent-ops", "config.json");
-    const projectPath = join(root, ".agent-ops", "config.json");
+    const projectPath = join(projectConfigRoot(root), ".agent-ops", "config.json");
     const layers = [defaultConfigLayer()];
     let project;
     try {

package/dist/packages/cli/src/hook-process.js

@@ -9,6 +9,7 @@ import { resolveContainedPath } from "../../../runtime/src/fs/paths.js";
 import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { claudeStopRecursionMarker } from "../../../runtime/src/adapters/claude/input.js";
 import { HARNESS_IDS, harnessDescriptor } from "../../../runtime/src/install/harness.js";
+import { evaluateWorktreeEnter } from "../../../runtime/src/parallel/enter.js";
 import { evaluateWorktreeWrite, resolveMainRoot } from "../../../runtime/src/parallel/guard.js";
 import { ensureSessionWorktree, recordSessionOrigin } from "../../../runtime/src/parallel/service.js";
 import { CompletionGateService } from "../../../runtime/src/hooks/completion-gate.js";
@@ -214,11 +215,12 @@ function shouldBuildStopVerification(harness, event, config, rawInput) {
  * The gate of one checkout. A session redirected into a worktree is judged by
  * that worktree's gate, built the same way from the worktree's own config.
  */
-function completionGateFor(root, config, gitRunner) {
+function completionGateFor(root, config, gitRunner, harness) {
     return new CompletionGateService({
         root,
         config,
         gitRunner,
+        ...(harness === undefined ? {} : { harness }),
         taskService: new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root)),
         evidenceStore: new FileEvidenceStore(root, root),
         forRoot: async (worktree) => {
@@ -226,7 +228,7 @@ function completionGateFor(root, config, gitRunner) {
             if (outcome.kind !== "loaded" || !outcome.config.features.completionGate.enabled) {
                 throw new Error("The redirected worktree has no enabled completion gate.");
             }
-            return completionGateFor(worktree, outcome.config, defaultGitRunner(worktree));
+            return completionGateFor(worktree, outcome.config, defaultGitRunner(worktree), harness);
         }
     });
 }
@@ -341,7 +343,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
         const completionGate = (harnessId === "agy" || harnessId === "claude") &&
             config.features.completionGate.enabled
             ? dependencies.completionGate ?? {
-                handle: async (normalized) => await completionGateFor(root, config, gitRunner).handle(normalized)
+                handle: async (normalized) => await completionGateFor(root, config, gitRunner, harnessId).handle(normalized)
             }
             : undefined;
         const worktreeGuard = config.worktree?.mode === "auto"
@@ -354,6 +356,14 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
                         : async (sessionId) => (await ensureSessionWorktree(dependencies.worktree, { cwd: mainRoot, sessionId })).path);
             }
             : undefined;
+        const worktreeEnter = config.worktree?.mode === "auto"
+            ? async (enter) => {
+                const mainRoot = await resolveMainRoot(gitRunner);
+                return mainRoot === null
+                    ? { action: "continue", status: "UNKNOWN", code: "WORKTREE_GUARD_UNAVAILABLE" }
+                    : await evaluateWorktreeEnter(mainRoot, enter.path, enter.sessionId);
+            }
+            : undefined;
         if (hookEvent === "SessionStart" && config.worktree?.mode === "auto" &&
             dependencies.worktree !== undefined && typeof parsedInput === "object" && parsedInput !== null) {
             const fields = parsedInput;
@@ -370,6 +380,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             config,
             trusted,
             ...(worktreeGuard === undefined ? {} : { worktreeGuard }),
+            ...(worktreeEnter === undefined ? {} : { worktreeEnter }),
             ...(dependencies.advisory === undefined
                 ? {}
                 : { advisory: dependencies.advisory }),

package/dist/packages/cli/src/public-plan.js

@@ -1,3 +1,4 @@
+import { join } from "node:path";
 import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { sha256 } from "../../../runtime/src/fs/hash.js";
 const OPAQUE_SUMMARY = "Opaque managed settings content withheld.";
@@ -35,6 +36,29 @@ export function toPublicOperation(operation) {
 export function toPublicOperations(operations) {
     return operations.map(toPublicOperation);
 }
+/**
+ * Pre-authorization changes join the ordinary operations, so every preview and
+ * confirmation shows them. A file in Codex's home is shown by absolute path;
+ * a file agent-ops does not wholly own is described, never printed.
+ */
+export function toPublicPreauthorization(changes) {
+    return (changes ?? []).map((change) => {
+        const path = publicPath(join(change.root, change.operation.path));
+        const operation = change.operation;
+        if (operation.kind === "remove") {
+            return { kind: "remove", path, expectedHash: operation.expectedHash };
+        }
+        return change.ownedContent
+            ? { kind: "write", path, expectedHash: operation.expectedHash, content: operation.content }
+            : {
+                kind: "write",
+                path,
+                expectedHash: operation.expectedHash,
+                contentHash: sha256(operation.content),
+                summary: redactSecrets(change.summary)
+            };
+    });
+}
 export function toPublicInstallPlan(plan, trust) {
     return {
         scope: plan.scope,
@@ -42,7 +66,10 @@ export function toPublicInstallPlan(plan, trust) {
         profiles: plan.profiles,
         capabilities: plan.capabilities,
         manifest: plan.manifest,
-        operations: toPublicOperations(plan.operations),
+        operations: [
+            ...toPublicOperations(plan.operations),
+            ...toPublicPreauthorization(plan.preauthorization)
+        ],
         detectedVerification: plan.detectedVerification,
         ...(trust === undefined ? {} : { trust })
     };
@@ -59,7 +86,10 @@ export function toPublicUninstallPlan(plan, trust) {
         installed: plan.installed,
         manifest: plan.manifest,
         manifestHash: plan.manifestHash,
-        operations: toPublicOperations(plan.operations),
+        operations: [
+            ...toPublicOperations(plan.operations),
+            ...toPublicPreauthorization(plan.preauthorization)
+        ],
         ...(trust === undefined ? {} : { trust })
     };
 }

package/dist/runtime/src/adapters/claude/config.js

@@ -11,7 +11,7 @@ const CLAUDE_LOOP_EVENTS = [
     "SubagentStop"
 ];
 const CLAUDE_HOOK_MARKER = "--managed-by=agent-ops";
-export const CLAUDE_PRE_TOOL_MATCHER = "Bash|Edit|MultiEdit|NotebookEdit|Write";
+export const CLAUDE_PRE_TOOL_MATCHER = "Bash|Edit|MultiEdit|NotebookEdit|Write|EnterWorktree";
 const CLAUDE_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.sh";
 const CLAUDE_WINDOWS_LOOP_LAUNCHER = "${CLAUDE_PROJECT_DIR}/.claude/hooks/agent-ops-loop.ps1";
 export function claudeSettingsTarget(scope) {

package/dist/runtime/src/adapters/claude/input.js

@@ -63,6 +63,23 @@ export function normalizeClaudeHookInput(input) {
             };
         }
     }
+    if (input.hook_event_name === "PreToolUse" &&
+        input.tool_name === "EnterWorktree" &&
+        isRecord(input.tool_input) &&
+        typeof projectRoot === "string" &&
+        projectRoot.length > 0) {
+        const target = input.tool_input.path;
+        // A `name` asks for a new worktree of Claude's own, which is not this
+        // hook's business.
+        if (typeof target === "string" && target.length > 0 && !target.includes("\0")) {
+            return {
+                event: "enter-worktree",
+                projectRoot,
+                path: resolve(projectRoot, target),
+                ...(sessionId === undefined ? {} : { sessionId })
+            };
+        }
+    }
     if (input.hook_event_name === "PreToolUse" &&
         input.tool_name === "Bash" &&
         isRecord(input.tool_input) &&

package/dist/runtime/src/adapters/claude/output.js

@@ -32,6 +32,15 @@ export function claudeHookOutput(event, result) {
             }
         });
     }
+    if (event === "PreToolUse" && result.decision === "allow") {
+        return json({
+            hookSpecificOutput: {
+                hookEventName: "PreToolUse",
+                permissionDecision: "allow",
+                permissionDecisionReason: denialReason
+            }
+        });
+    }
     if (event === "Stop" && result.evidence !== undefined) {
         if (result.status === "FAIL") {
             const failed = result.evidence.commandResults