@lumoai/cli 1.57.0 → 1.59.0

package/dist/cli/src/commands/task-status.js

@@ -6,6 +6,7 @@ const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
 const resolve_bound_task_1 = require("../lib/resolve-bound-task");
 const sanitize_1 = require("../lib/sanitize");
+const security_scan_1 = require("../../../shared/src/security-scan");
 const open_crossings_1 = require("../lib/open-crossings");
 const evidence_display_1 = require("../lib/evidence-display");
 /** One-line a possibly-multiline crossing detail and cap it so the safety block
@@ -22,6 +23,111 @@ const REASON_TAIL = 400;
 function tail(s, max) {
     return s.length > max ? `…${s.slice(-max)}` : s;
 }
+/** A missing `kind` is an older server's criterion entry (LUM-737 additive rule). */
+function isSecurityAction(a) {
+    return a.kind === 'SECURITY_FINDING';
+}
+function splitNextActions(actions) {
+    const criteria = [];
+    const security = [];
+    for (const a of actions) {
+        if (isSecurityAction(a))
+            security.push(a);
+        else
+            criteria.push(a);
+    }
+    return { criteria, security };
+}
+/** Same line grammar as the session-start / PreToolUse reminders. */
+function formatSecurityAction(a) {
+    const where = a.line == null ? a.filePath : `${a.filePath}:${a.line}`;
+    const title = (0, sanitize_1.sanitizeField)(a.statement.split(' — ').slice(1).join(' — '));
+    const tag = a.blocking ? 'blocks DONE' : 'advisory';
+    return `[${a.severity}] ${a.provenance} ${(0, sanitize_1.sanitizeField)(a.ruleId)} — ${(0, sanitize_1.sanitizeField)(where)} — ${title} (PR #${a.prNumber} · ${tag})`;
+}
+const SECURITY_HINT = 'Fix the findings and push (a fixed finding disappears on the next scan), or ask a human to disposition them in the web delivery panel — disposition is human-only, you cannot disposition them yourself, and a blocking finding refuses DONE with 409.';
+/** Render the `[SECURITY]` next-action lines (LUM-737 review): shared by the
+ *  criteria-present Next actions block and the zero-criteria early return so
+ *  undispositioned findings render identically either way. */
+function pushSecurityActions(lines, securityActions) {
+    for (const a of securityActions) {
+        lines.push(`  • [SECURITY] ${formatSecurityAction(a)}`);
+    }
+}
+/** Fail-closed security coverage lines (LUM-737): a failed read and every
+ *  open PR without a successful scan are stated, never left silent. */
+const EXTERNAL_ERROR_TAIL = 200;
+const SCAN_STAGE_ORDER = [
+    'secrets',
+    'external',
+    'supplyChain',
+    'judge',
+    'hunt',
+];
+/** LUM-735 — one line per linked PR's latest scan: `PR #945 · scan CLEAN ·
+ *  secrets RAN · external RAN (2 external findings) · supplyChain RAN
+ *  (1 dependency finding, 1 already on main) · judge RAN · hunt RAN`.
+ *  Stage segments only for keys present, in
+ *  secrets/external/supplyChain/judge/hunt order (LUM-739 added the hunt
+ *  layer); the `(N external findings)` count only decorates the external
+ *  segment, the dependency count (LUM-738, with its already-on-main share)
+ *  only the supplyChain segment, and each only when N > 0. */
+function formatScanSummaryLine(s) {
+    const segments = [];
+    for (const key of SCAN_STAGE_ORDER) {
+        const state = s.stages[key];
+        if (!state)
+            continue;
+        if (key === 'external' && s.externalFindings > 0) {
+            const noun = s.externalFindings === 1 ? 'finding' : 'findings';
+            segments.push(`external ${state} (${s.externalFindings} external ${noun})`);
+        }
+        else if (key === 'supplyChain' && (s.dependencyFindings ?? 0) > 0) {
+            const n = s.dependencyFindings ?? 0;
+            const noun = n === 1 ? 'finding' : 'findings';
+            const persisting = s.persistingFindings ?? 0;
+            const tail = persisting > 0 ? `, ${persisting} already on main` : '';
+            segments.push(`supplyChain ${state} (${n} dependency ${noun}${tail})`);
+        }
+        else {
+            segments.push(`${key} ${state}`);
+        }
+    }
+    let line = `  PR #${s.prNumber} · scan ${s.status}`;
+    if (segments.length > 0)
+        line += ` · ${segments.join(' · ')}`;
+    if (s.partial)
+        line += ' · partial';
+    // LUM-756 (P8): `error` has two writers — only the prefixed, scrubbed
+    // scanner reason may be printed, and only the text after the prefix. Stage
+    // A's raw crash text carries no prefix and is never shown here (same rule
+    // as the web panel and the PR summary).
+    const reason = s.stages.external === 'FAILED' ? (0, security_scan_1.externalFailureReason)(s.error) : null;
+    if (reason) {
+        line += ` — ${(0, sanitize_1.sanitizeField)(tail(reason, EXTERNAL_ERROR_TAIL))}`;
+    }
+    return line;
+}
+function pushSecurityCoverage(lines, data) {
+    if (data.securityFindings === undefined)
+        return; // older server
+    if (data.securityFindings === null) {
+        lines.push('⚠ Security-scan check failed — could not confirm whether any findings are undispositioned.');
+        return;
+    }
+    // LUM-735: absent `scans` = older server; tolerate silently, no block.
+    for (const s of data.securityFindings.scans ?? []) {
+        lines.push(formatScanSummaryLine(s));
+    }
+    for (const u of data.securityFindings.unconfirmedPrs) {
+        const why = u.reason === 'NONE'
+            ? 'no security scan has run'
+            : u.reason === 'FAILED'
+                ? 'security scan FAILED'
+                : `security scan still ${u.reason}`;
+        lines.push(`⚠ PR #${u.number}: ${why} — could not confirm it is clean.`);
+    }
+}
 /**
  * Render the acceptance status as prose. Same row grammar as
  * `criteria list` (`<id>  [TYPE]  SOURCE@rN  statement`) with a verdict
@@ -39,20 +145,35 @@ function formatTaskStatus(data, extras = {}) {
     if (data.escalated) {
         lines.push('⚠ Escalated: the machine loop is exhausted — a human has been paged. Stop retrying lumo verify.');
     }
+    // LUM-737 (whole-branch review): split once, up front, so both the
+    // zero-criteria early return below and the --full rollup can render/count
+    // undispositioned security findings without either dropping them or
+    // subtracting them from the criteria-met arithmetic.
+    const { criteria: unmetCriteria, security: securityActions } = splitNextActions(data.nextActions);
     if (data.criteria.length === 0) {
         lines.push('');
-        lines.push(`No acceptance criteria on ${t.identifier} — draft 3–7 and submit with lumo task criteria set ${t.identifier} --file <criteria.json>`);
+        lines.push(`No acceptance criteria on ${t.identifier} — draft them and submit with lumo task criteria set ${t.identifier} --file <criteria.json>`);
+        if (securityActions.length > 0) {
+            lines.push('');
+            lines.push(`Next actions (0 unmet · ${securityActions.length} security finding${securityActions.length === 1 ? '' : 's'}):`);
+            pushSecurityActions(lines, securityActions);
+            lines.push(SECURITY_HINT);
+        }
+        pushSecurityCoverage(lines, data);
         pushOpenCrossings(lines, extras);
         return lines.join('\n') + '\n';
     }
-    // LUM-564 声称 vs 核验: the agent's CLAIM (what it says it did) paired with
-    // the measured verification conclusion (what was actually confirmed) — the
-    // two columns regular 規律2 wants, instead of only the verification one. The
-    // machine-verification rollup (LUM-470) lives on the verification side here
-    // rather than as a standalone line, so the contrast is in one place.
-    pushClaimVsVerification(lines, data);
+    // LUM-733: the default report is the agent's self-check — criteria, next
+    // actions (including undispositioned security findings, LUM-737), and any
+    // open crossings. The dashboard sections (verification rollup, history,
+    // cost, struggle trail, trend) are human-dashboard material and cost
+    // context, so they only render under --full. The claim / faithfulness
+    // columns are no longer rendered in the terminal at all (the judge still
+    // runs server-side; --json carries its fields).
+    if (extras.full)
+        pushVerificationRollup(lines, unmetCriteria.length, data);
     lines.push('');
-    lines.push(`Criteria (${data.criteria.length} total, ${data.nextActions.length} unmet):`);
+    lines.push(`Criteria (${data.criteria.length} total, ${unmetCriteria.length} unmet):`);
     for (const c of data.criteria) {
         const glyph = c.latestVerdict == null
             ? '○'
@@ -127,7 +248,7 @@ function formatTaskStatus(data, extras = {}) {
             }
         }
     }
-    if (data.verificationHistory.length > 0) {
+    if (extras.full && data.verificationHistory.length > 0) {
         lines.push('');
         lines.push('History:');
         for (const h of data.verificationHistory) {
@@ -144,18 +265,23 @@ function formatTaskStatus(data, extras = {}) {
             }
         }
     }
-    pushCost(lines, data);
-    pushStruggleTrail(lines, data);
-    pushTrend(lines, data);
+    if (extras.full) {
+        pushCost(lines, data);
+        pushStruggleTrail(lines, data);
+        pushTrend(lines, data);
+    }
     lines.push('');
-    if (data.nextActions.length === 0) {
+    const securityLabel = securityActions.length === 0
+        ? ''
+        : ` · ${securityActions.length} security finding${securityActions.length === 1 ? '' : 's'}`;
+    if (unmetCriteria.length === 0 && securityActions.length === 0) {
         lines.push(data.currentRound > 0
             ? 'All criteria met by their latest verdicts — awaiting human adjudication.'
             : 'Nothing unmet — but no verification has run; run `lumo verify` to judge the contract.');
     }
     else {
-        lines.push(`Next actions (${data.nextActions.length} unmet):`);
-        for (const a of data.nextActions) {
+        lines.push(`Next actions (${unmetCriteria.length} unmet${securityLabel}):`);
+        for (const a of unmetCriteria) {
             lines.push(`  • [${a.verifierType}] ${(0, sanitize_1.sanitizeField)(a.statement)}`);
             if (a.checkpointer) {
                 lines.push(`    check: ${(0, sanitize_1.sanitizeField)(a.checkpointer)}`);
@@ -164,17 +290,22 @@ function formatTaskStatus(data, extras = {}) {
                 lines.push(`    why: ${(0, sanitize_1.sanitizeField)(tail(a.rejectionReason, REASON_TAIL))}`);
             }
         }
+        // LUM-737: findings after the contract — constraints on DONE, not criteria.
+        pushSecurityActions(lines, securityActions);
         if (data.escalated) {
             lines.push('Wait for human direction before touching these.');
         }
-        else {
-            const hasMachine = data.nextActions.some(a => a.verifierType === 'MACHINE');
+        else if (unmetCriteria.length > 0) {
+            const hasMachine = unmetCriteria.some(a => a.verifierType === 'MACHINE');
             const left = data.maxRounds - data.currentRound;
             lines.push(hasMachine
                 ? `Fix the unmet criteria, then run \`lumo verify\` (${left} round${left === 1 ? '' : 's'} left).`
                 : 'Remaining criteria are HUMAN-only — finish the work and hand off for human review.');
         }
+        if (securityActions.length > 0)
+            lines.push(SECURITY_HINT);
     }
+    pushSecurityCoverage(lines, data);
     pushOpenCrossings(lines, extras);
     return lines.join('\n') + '\n';
 }
@@ -222,104 +353,27 @@ function fmtDuration(totalSec) {
  * claim text is same-source with the web card (latest session's LLM run
  * summary, else its STOP turn digest) so the two surfaces cannot drift.
  */
-function pushClaimVsVerification(lines, data) {
+/**
+ * LUM-733: the measured verification rollup (--full only) — machine-verified
+ * vs human-override over the MACHINE criteria, and how many criteria are met.
+ * The former "Claim vs verification" pairing (claim text + faithfulness
+ * verdict) is no longer rendered in the terminal.
+ */
+function pushVerificationRollup(lines, unmetCriteriaCount, data) {
     lines.push('');
-    lines.push('Claim vs verification:');
-    // ── Claim (声称): the agent's self-report — estimate-tier, never measured.
-    lines.push('  ▸ Claim — what the agent says it did');
-    lines.push('    (agent self-report · estimated, not verification):');
-    const claim = data.claim;
-    if (claim && claim.source === 'AGENT' && claim.text) {
-        // LUM-597: the agent's OWN self-report (attached to verify) — the
-        // authoritative claim faithfulness judges, not a summarizer paraphrase.
-        for (const cl of (0, sanitize_1.sanitizeField)(claim.text).split('\n')) {
-            lines.push(`      ${cl}`);
-        }
-        lines.push('      ↳ source: agent self-report (verify --note)');
-    }
-    else if (claim && claim.source === 'RUN_SUMMARY' && claim.text) {
-        for (const cl of (0, sanitize_1.sanitizeField)(claim.text).split('\n')) {
-            lines.push(`      ${cl}`);
-        }
-        lines.push('      ↳ source: synthesized run summary (no self-report)');
-    }
-    else if (claim && claim.source === 'DIGEST') {
-        // LUM-583 ③ / LUM-574: a raw turn digest is not a claim — withhold it and
-        // say the formal summary is still generating, same-source with the web card.
-        lines.push('      generating — the formal run summary is still being synthesized');
-    }
-    else {
-        // Fail-closed: no run summary → say so, never invent a claim. Run summaries
-        // are synthesized when the bound task reaches DONE (LUM-481).
-        lines.push('      not generated yet — the agent run summary is synthesized when the task reaches DONE');
-    }
-    // ── Faithfulness (LUM-583): the third state — is the claim itself true? Read
-    // from the persisted LUM-582 verdict; PENDING (not yet judged) is distinct
-    // from UNJUDGEABLE (a real verdict), STALE keeps the verdict but flags a
-    // pending re-check. Skipped only when the server didn't emit it (older server).
-    pushFaithfulness(lines, data.faithfulness);
-    // ── Verification (核验): the measured verdict — machine-verified vs override.
-    lines.push('  ▸ Verification — what was actually confirmed (measured):');
+    lines.push('Verification:');
     const mv = data.machineVerification;
     if (data.currentRound === 0) {
-        // Nothing verified yet — the claim stands unconfirmed. Don't imply a pass.
-        lines.push('      no verification has run yet — the claim is unconfirmed');
-    }
-    else {
-        if (mv.total > 0) {
-            lines.push(`      ${mv.machineVerified} machine-verified / ${mv.humanOverridden} human override (of ${mv.total} MACHINE criteria)`);
-        }
-        const met = data.criteria.length - data.nextActions.length;
-        lines.push(`      ${met} of ${data.criteria.length} criteria met by their latest verdict`);
-    }
-}
-/**
- * Append the "Faithfulness" conclusion (LUM-583) — the third state over the
- * 声称/核验 columns: whether the agent's CLAIM is itself TRUE, judged
- * independently against the delivery (LUM-582). Same read model the web honest
- * report renders, so the two surfaces cannot drift. Fail-closed: PENDING (not
- * yet judged) reads distinctly from UNJUDGEABLE (a real verdict), and STALE
- * keeps the prior verdict while flagging a pending re-check. Skipped only when
- * the server didn't emit the field (older server) — never fabricated.
- */
-function pushFaithfulness(lines, f) {
-    if (!f)
-        return; // older server: field absent → don't fabricate a conclusion.
-    const verdictPhrase = (v) => {
-        switch (v) {
-            case 'FAITHFUL':
-                return 'faithful — the claim matches the delivery';
-            case 'OVERSTATED':
-                return 'overstated — the claim says more than the diff/PR shows';
-            case 'UNDERREPORT':
-                return 'under-reported — the claim says less than the diff/PR shows';
-            default:
-                return "unjudgeable — couldn't decide from the diff/PR";
-        }
-    };
-    let body;
-    if (f.state === 'PENDING') {
-        body =
-            'not yet judged — the faithfulness check runs in a batch after delivery';
-    }
-    else if (f.state === 'STALE') {
-        body = `${f.verdict ? verdictPhrase(f.verdict) : 'judged'} (stale — re-checked on the next batch)`;
-    }
-    else {
-        body = verdictPhrase(f.state);
-    }
-    const ev = [];
-    if (f.prNumbers.length > 0) {
-        ev.push(`PR ${f.prNumbers.map(n => `#${n}`).join(', ')}`);
+        lines.push('  no verification has run yet');
+        return;
     }
-    if (f.diffShas.length > 0) {
-        ev.push(f.diffShas
-            .slice(0, 3)
-            .map(s => (0, sanitize_1.sanitizeField)(s).slice(0, 7))
-            .join(' '));
+    if (mv.total > 0) {
+        lines.push(`  ${mv.machineVerified} machine-verified / ${mv.humanOverridden} human override (of ${mv.total} MACHINE criteria)`);
     }
-    lines.push('  ▸ Faithfulness — does the claim match the delivery (LUM-583):');
-    lines.push(`      ${body}${ev.length > 0 ? ` · evidence: ${ev.join(' · ')}` : ''}`);
+    // LUM-737 (whole-branch review): `unmetCriteriaCount` excludes SECURITY_FINDING
+    // next actions — met/unmet counts criteria only, never security findings.
+    const met = data.criteria.length - unmetCriteriaCount;
+    lines.push(`  ${met} of ${data.criteria.length} criteria met by their latest verdict`);
 }
 /**
  * Append the honest "Cost" section (LUM-560) — 规律 1: surface the costs a human
@@ -619,6 +673,7 @@ async function taskStatus(identifier, options = {}) {
         return;
     }
     process.stdout.write(formatTaskStatus(data, {
+        full: options.full === true,
         openCrossings: crossingsResult,
         dispositionUrl: (0, open_crossings_1.dispositionUrl)(base, creds.workspaceSlug ?? 'lumo', data.task.identifier),
         // LUM-563: resolve the local repo's web base so a `commit:` evidence

package/dist/cli/src/commands/task-update.js

@@ -4,6 +4,8 @@ exports.decideSprintAction = decideSprintAction;
 exports.normalizeStatus = normalizeStatus;
 exports.buildUpdatePayload = buildUpdatePayload;
 exports.formatUpdatedTaskLine = formatUpdatedTaskLine;
+exports.partitionLinkedPrs = partitionLinkedPrs;
+exports.describeDoneTransition = describeDoneTransition;
 exports.taskUpdate = taskUpdate;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
@@ -12,6 +14,8 @@ const tag_resolver_1 = require("../lib/tag-resolver");
 const resolve_1 = require("../lib/resolve");
 const sanitize_1 = require("../lib/sanitize");
 const next_steps_1 = require("../lib/next-steps");
+const confirmation_1 = require("../lib/confirmation");
+const blocked_error_1 = require("../lib/blocked-error");
 const ALLOWED_STATUSES = ['TODO', 'IN_PROGRESS', 'IN_REVIEW', 'DONE'];
 /**
  * Pure function: given the task's current sprint binding and the resolved
@@ -102,6 +106,101 @@ function formatUpdatedTaskLine(task) {
     }
     return head;
 }
+/**
+ * Split linked PRs into merged vs everything else. "Unmerged" is deliberately
+ * broad — open, closed-without-merge, draft (state "open"), or an unknown
+ * state all count — because the question the ⚠ line asks is "are you sure
+ * the work actually landed?", and only `merged` answers yes.
+ */
+function partitionLinkedPrs(prs) {
+    const merged = [];
+    const unmerged = [];
+    for (const pr of prs) {
+        if (pr.state === 'merged')
+            merged.push(pr);
+        else
+            unmerged.push(pr);
+    }
+    return { merged, unmerged };
+}
+function formatPrLine(pr) {
+    const state = (pr.state ?? 'unknown').padEnd(7);
+    const title = pr.title ? (0, sanitize_1.sanitizeField)(pr.title) : '(untitled)';
+    const url = pr.url ? `  ${pr.url}` : '';
+    return `#${pr.number}  ${state}  ${title}${url}`;
+}
+/**
+ * The changes[] block of the DONE envelope: what is about to change, every
+ * linked PR with its synced state, and — last — a ⚠ line naming the PRs that
+ * have not merged. That single line replaces LUM-731's second y/N prompt:
+ * the protocol is one step, and the agent relays the whole block verbatim.
+ */
+function describeDoneTransition(task, prs) {
+    const escapedTitle = (0, sanitize_1.sanitizeField)(task.title).replace(/"/g, '\\"');
+    const lines = [
+        `Will move ${task.identifier} "${escapedTitle}" to DONE`,
+        `Status: ${task.status} → DONE`,
+    ];
+    if (prs.length === 0) {
+        lines.push('Pull requests: none linked');
+        return lines;
+    }
+    for (const pr of prs)
+        lines.push(formatPrLine(pr));
+    const { unmerged } = partitionLinkedPrs(prs);
+    if (unmerged.length > 0) {
+        const summary = unmerged
+            .map(pr => `#${pr.number} ${pr.state ?? 'unknown'}`)
+            .join(', ');
+        lines.push(`⚠ ${unmerged.length} linked pull request${unmerged.length === 1 ? '' : 's'} not merged: ${summary}`);
+    }
+    return lines;
+}
+/**
+ * Look the task up and emit the DONE confirmation envelope (exit 4). Runs
+ * before any side effect — tag find-or-create included — so a refused DONE
+ * leaves nothing behind. Returns the exit code to propagate; prints its own
+ * error on a failed lookup.
+ */
+async function emitDoneConfirmation(args) {
+    const { base, apiUrl, token, identifier } = args;
+    const showUrl = `${base}/api/tasks/by-identifier/${encodeURIComponent(identifier)}`;
+    let res;
+    try {
+        res = await fetch(showUrl, {
+            headers: { Authorization: `Bearer ${token}` },
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (!res.ok) {
+        let serverMsg = null;
+        try {
+            const errBody = (await res.json());
+            if (typeof errBody.error === 'string')
+                serverMsg = errBody.error;
+        }
+        catch {
+            // not JSON
+        }
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: task lookup failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { task } = (await res.json());
+    return (0, confirmation_1.emitConfirmation)({
+        command: 'task update',
+        changes: describeDoneTransition(task, task.pullRequests ?? []),
+    });
+}
 /**
  * Thin wrapper so the next-step block always lands last (LUM-686). The update
  * flow has several success exits — a plain PATCH, plus the sprint bind/unbind
@@ -181,6 +280,16 @@ async function runTaskUpdate(identifier, opts, collected) {
         return 1;
     }
     const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    // LUM-755: DONE without --confirm stops here with the confirmation
+    // envelope — before tag resolution (find-or-create) or any other write.
+    if (status === 'DONE' && !opts.confirm) {
+        return emitDoneConfirmation({
+            base: (0, api_1.trimTrailingSlash)(apiUrl),
+            apiUrl,
+            token: creds.token,
+            identifier,
+        });
+    }
     // Resolve tag refs into ids
     let tagIds;
     let addTagIds;
@@ -276,6 +385,26 @@ async function runTaskUpdate(identifier, opts, collected) {
             catch {
                 // Body wasn't JSON; fall through to status-only message
             }
+            // LUM-755: a DONE refused by a server gate (send-back / boundary
+            // crossing / blocking security finding) is a human-only block, not a
+            // generic error — surface it structured (exit 5) with every blocker.
+            if (res.status === 409 &&
+                status === 'DONE' &&
+                (0, blocked_error_1.isDoneGateRefusal)(serverMsg)) {
+                const { blockers, unconfirmed } = await (0, blocked_error_1.collectDoneBlockers)({
+                    base,
+                    token: creds.token,
+                    identifier,
+                });
+                return (0, blocked_error_1.emitBlocked)((0, blocked_error_1.buildBlockedError)({
+                    identifier,
+                    message: serverMsg,
+                    blockers,
+                    unconfirmed,
+                    apiUrl,
+                    workspaceSlug: creds.workspaceSlug ?? '',
+                }));
+            }
             if (serverMsg) {
                 console.error(`Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`);
             }

package/dist/cli/src/commands/verify.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkpointerEnv = checkpointerEnv;
 exports.runCheckpointer = runCheckpointer;
 exports.verify = verify;
 const child_process_1 = require("child_process");
@@ -13,6 +14,20 @@ const MAX_OUTPUT_BUFFER = 10 * 1024 * 1024;
 function tail(s, max) {
     return s.length > max ? `…${s.slice(-max)}` : s;
 }
+/**
+ * The environment a checkpointer runs in: the CLI's own, minus the flags the
+ * CLI folds into process.env for itself. `--no-hints` becomes
+ * `LUMO_NO_HINTS=1` (see index.ts preAction) and would otherwise be inherited
+ * by e.g. a jest suite that covers the hints block, failing it for a reason
+ * unrelated to the criterion (LUM-752).
+ */
+const CLI_ONLY_ENV = ['LUMO_NO_HINTS'];
+function checkpointerEnv(base = process.env) {
+    const env = { ...base };
+    for (const k of CLI_ONLY_ENV)
+        delete env[k];
+    return env;
+}
 /**
  * Execute one MACHINE checkpointer in the local repo (runs client-side — the
  * server can't run repo tests) and fold the result into a structured verdict.
@@ -26,6 +41,7 @@ function runCheckpointer(criterionId, checkpointer, timeoutMs) {
         timeout: timeoutMs,
         maxBuffer: MAX_OUTPUT_BUFFER,
         cwd: process.cwd(),
+        env: checkpointerEnv(),
     });
     if (r.error) {
         const timedOut = r.error.code === 'ETIMEDOUT' ||
@@ -144,19 +160,12 @@ async function verify(identifier, options = {}) {
             `The contract is HUMAN-only; finish your work and hand off for human review (lumo task update ${taskId} --status in_review).\n`);
         return;
     }
-    // ── Require the self-report (LUM-597) ────────────────────────────────────
-    // Requesting acceptance is a structured action; `--note` is the agent's
-    // mandatory self-report. It is captured deterministically here (the agent
-    // can't be made to phrase it well, but it can be made to provide one); its
-    // truthfulness is the faithfulness audit's job downstream. No note → no round
-    // is posted (no round burned), so re-running with one is free.
-    const note = options.note?.trim();
-    if (!note) {
-        console.error('Error: --note is required — state what you did and why it is ready, e.g.\n' +
-            `  lumo verify ${taskId} --note "implemented X in foo.ts because Y; tests + tsc pass"\n` +
-            'This self-report is recorded as your claim and checked against the diff for faithfulness.');
-        return 1;
-    }
+    // ── Optional self-report (LUM-733) ───────────────────────────────────────
+    // `--note` is the agent's one-line self-report. When given it rides with the
+    // round and is frozen as the task's claim (source AGENT) on IN_REVIEW; when
+    // omitted the round still posts and the claim degrades to the synthesized
+    // run summary. It is never a precondition for verifying.
+    const note = options.note?.trim() || undefined;
     // ── Execute every checkpointer locally ───────────────────────────────────
     process.stdout.write(`Verifying ${taskId} — ${machine.length} MACHINE criteria\n`);
     const results = [];

package/dist/cli/src/commands/worktree-rm.js

@@ -1,8 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeWorktreeRm = describeWorktreeRm;
 exports.worktreeRm = worktreeRm;
 const worktree_1 = require("../lib/worktree");
 const worktree_ref_1 = require("../lib/worktree-ref");
+const confirmation_1 = require("../lib/confirmation");
+/**
+ * The changes[] block for the confirmation envelope. `dirty` adds the
+ * discard warning that --force acknowledges; `deleteBranch` flips the branch
+ * line from "kept" to "deleted".
+ */
+function describeWorktreeRm(args) {
+    const lines = [
+        `Will remove worktree ${args.path}${args.branch ? ` (branch ${args.branch})` : ''}`,
+    ];
+    if (args.dirty) {
+        lines.push('⚠ The worktree has uncommitted changes — they will be discarded (--force acknowledges this)');
+    }
+    if (args.branch) {
+        lines.push(args.deleteBranch
+            ? `Branch ${args.branch} will be deleted too (--delete-branch; git refuses an unmerged branch)`
+            : `Branch ${args.branch} is kept (pass --delete-branch to delete it)`);
+    }
+    return lines;
+}
 async function worktreeRm(rawId, opts) {
     let taskId;
     try {
@@ -27,14 +48,21 @@ async function worktreeRm(rawId, opts) {
         console.error(`Error: no worktree found for ${taskId}`);
         return 1;
     }
-    if (!opts.yes) {
-        console.error(`Error: refusing to remove ${target.path} without --yes (destructive)`);
-        return 1;
-    }
     const dirty = (0, worktree_1.gitOutput)(['status', '--porcelain'], target.path).length > 0;
-    if (dirty && !opts.force) {
-        console.error(`Error: ${target.path} has uncommitted changes — pass --force to remove anyway`);
-        return 1;
+    // LUM-755: two gates, one envelope. Missing --confirm, or a dirty tree
+    // without --force, both stop here with the same structured refusal; the
+    // confirmCommand carries whichever flags are still missing.
+    if (!(0, confirmation_1.isConfirmed)(opts) || (dirty && !opts.force)) {
+        return (0, confirmation_1.emitConfirmation)({
+            command: 'worktree rm',
+            changes: describeWorktreeRm({
+                path: target.path,
+                branch: target.branch ?? null,
+                dirty,
+                deleteBranch: Boolean(opts.deleteBranch),
+            }),
+            extraFlags: dirty ? ['--force'] : [],
+        });
     }
     const removeArgs = dirty && opts.force
         ? ['worktree', 'remove', '--force', target.path]