@martinloop/mcp 0.8.6 → 0.8.7

package/dist/package-version.d.ts

@@ -1 +1 @@
-export declare const MARTIN_MCP_PACKAGE_VERSION = "0.8.6";
+export declare const MARTIN_MCP_PACKAGE_VERSION = "0.8.7";

package/dist/package-version.js

@@ -1,3 +1,3 @@
 // Auto-generated by build — do not edit by hand.
 // Source of truth: packages/mcp/package.json#version
-export const MARTIN_MCP_PACKAGE_VERSION = "0.8.6";
+export const MARTIN_MCP_PACKAGE_VERSION = "0.8.7";

package/dist/tools/preflight.js

@@ -1,5 +1,5 @@
 import { probeCodexLaunch, resolveCliCommandAvailability } from "../vendor/adapters/index.js";
-import { fetchSelectedMessage, getMcpInstalledVersion, isCooldownExpired, isDismissed, isNewerVersion, loadDeliveryRecord, recordShown, resolveDefaultLedgerPath, resolveRunsRoot, saveDeliveryRecord, } from "../vendor/core/index.js";
+import { fetchSelectedMessage, getMcpInstalledVersion, isCooldownExpired, isDismissed, isNewerVersion, loadDeliveryRecord, recordShown, resolveDefaultLedgerPath, resolveRunsRoot, saveDeliveryRecord, describeMalformedVerifier, } from "../vendor/core/index.js";
 import { MARTIN_MCP_PACKAGE_VERSION } from "../package-version.js";
 import { resolveSafeRepoRoot } from "../server-validation.js";
 import { createSkippedCliAvailability, formatUsd, getEngineAvailability, resolveExecutionMode } from "./tool-support.js";
@@ -27,6 +27,9 @@ export async function martinPreflightTool(input) {
         })
         : undefined;
     const warnings = [];
+    const malformedVerifiers = (input.verificationPlan ?? [])
+        .map((command) => describeMalformedVerifier(command))
+        .filter((reason) => reason !== undefined);
     const allowedPaths = input.allowedPaths ?? [];
     const deniedPaths = input.deniedPaths ?? [];
     const overlappingScopes = allowedPaths.filter((candidate) => deniedPaths.includes(candidate));
@@ -47,6 +50,7 @@ export async function martinPreflightTool(input) {
     if ((input.verificationPlan?.length ?? 0) === 0) {
         warnings.push("No verificationPlan was provided; Martin can run, but completion confidence will be lower.");
     }
+    warnings.push(...malformedVerifiers);
     if ((input.allowedPaths?.length ?? 0) === 0) {
         warnings.push("No allowedPaths were provided; Martin will rely on the broader repo root scope.");
     }
@@ -58,7 +62,7 @@ export async function martinPreflightTool(input) {
     const policy = buildPolicyPackDefinition(input.policyPack, signals);
     const engineReady = !executionMode.liveMode ||
         (engineAvailability.available && (engine !== "codex" || codexProbe?.ok !== false));
-    const ok = engineReady;
+    const ok = engineReady && malformedVerifiers.length === 0;
     const receiptScope = {
         invocationRoot: workspaceRoot,
         workingDirectory,
@@ -69,9 +73,9 @@ export async function martinPreflightTool(input) {
         ok,
         summary: ok
             ? `Preflight ready for ${engine} in ${workingDirectory} with a ${formatUsd(budget.maxUsd)} budget cap and ${runContract.risk.level} risk.`
-            : `Preflight blocked: ${engine === "codex" && codexProbe && !codexProbe.ok
+            : `Preflight blocked: ${malformedVerifiers[0] ?? (engine === "codex" && codexProbe && !codexProbe.ok
                 ? codexProbe.summary
-                : `${engine} is not available for live execution.`}`,
+                : `${engine} is not available for live execution.`)}`,
         warnings,
         receiptScope,
         scope: {

package/dist/vendor/adapters/claude-cli.js

@@ -152,7 +152,7 @@ function extractClaudeObservedModel(stdout) {
     return undefined;
 }
 function extractUsage(parsed, modelLabel, modelSource) {
-    if (!parsed?.usage) {
+    if (!parsed) {
         return normalizeUsage({
             actualUsd: 0,
             tokensIn: 0,
@@ -160,11 +160,12 @@ function extractUsage(parsed, modelLabel, modelSource) {
             provenance: "unavailable"
         });
     }
-    const promptTokens = parsed.usage.inputTokens ?? parsed.usage.input_tokens ?? 0;
-    const cacheCreationInputTokens = parsed.usage.cacheCreationInputTokens ?? parsed.usage.cache_creation_input_tokens ?? 0;
-    const cachedInputTokens = parsed.usage.cacheReadInputTokens ?? parsed.usage.cache_read_input_tokens ?? 0;
+    const usage = parsed.usage ?? {};
+    const promptTokens = usage.inputTokens ?? usage.input_tokens ?? 0;
+    const cacheCreationInputTokens = usage.cacheCreationInputTokens ?? usage.cache_creation_input_tokens ?? 0;
+    const cachedInputTokens = usage.cacheReadInputTokens ?? usage.cache_read_input_tokens ?? 0;
     const tokensIn = promptTokens + cachedInputTokens + cacheCreationInputTokens;
-    const tokensOut = parsed.usage.outputTokens ?? parsed.usage.output_tokens ?? 0;
+    const tokensOut = usage.outputTokens ?? usage.output_tokens ?? 0;
     const pricingResolution = resolveModelPricing(modelLabel);
     // Prefer Claude's own authoritative total_cost_usd (present on the final
     // `result` event in json/stream-json output) over our pricing-table estimate,
@@ -653,6 +654,13 @@ function createStreamingUsageInspector(capUsd, modelLabel, promptTokenEstimate,
  * the final `result` event, which carries the same `result`/`usage`/
  * `total_cost_usd` fields as the single-blob `json` format.
  */
+function findClaudeResultError(result) {
+    const errorSubtype = result.subtype?.startsWith("error") === true;
+    if (result.is_error !== true && !errorSubtype) {
+        return undefined;
+    }
+    return truncate(result.result ?? result.error ?? result.subtype ?? "unknown error", 500);
+}
 function parseStreamJsonResult(stdout) {
     let lastResult;
     for (const rawLine of stdout.split(/\r?\n/u)) {
@@ -880,6 +888,19 @@ export function createAgentCliAdapter(options) {
                     failure: { message: failureMessage }
                 };
             }
+            // A Claude session that ended in an error (API failure, max turns) did no
+            // verified work: never let the verifier certify the untouched workspace.
+            const claudeResultError = parsed ? findClaudeResultError(parsed) : undefined;
+            if (claudeResultError !== undefined) {
+                const failureMessage = `${options.command} reported an error: ${claudeResultError}`;
+                return {
+                    status: "failed",
+                    summary: `${options.command} session ended in an error before verifier execution.`,
+                    usage: extractUsage(parsed, options.model, options.model ? "explicit_override" : "agent_default"),
+                    verification: { passed: false, summary: `Verifier not run: ${failureMessage}` },
+                    failure: { message: failureMessage }
+                };
+            }
             const producedStructuredCompletion = parsed?.result !== undefined ||
                 (codexJsonlResult !== undefined &&
                     (agentResult.exitCode === 0 || codexTurnCompleted(agentResult.stdout))) ||

package/dist/vendor/contracts/index.d.ts

@@ -51,6 +51,8 @@ export interface ApprovalPolicy {
     migrations?: boolean;
     configChanges?: boolean;
     externalWrites?: boolean;
+    /** Allows an attempt to remove or rewrite lines in existing test files. */
+    testChanges?: boolean;
 }
 export interface VerificationStep {
     /** Shell command to run. */
@@ -430,9 +432,23 @@ export interface RollbackBoundaryArtifact {
     strategy: RollbackBoundaryStrategy;
     capturedAt: string;
     headRef?: string;
+    /** Branch HEAD pointed at when the boundary was captured; absent when detached. */
+    headBranch?: string;
     trackedDirtyFiles: string[];
     untrackedFiles: string[];
     snapshots: RollbackFileSnapshot[];
+    /**
+     * Git-ignored files present at the boundary. Dependency and build output
+     * directories are recorded as a single collapsed `dir/` entry.
+     */
+    ignoredFiles?: RollbackIgnoredFileStamp[];
+}
+export interface RollbackIgnoredFileStamp {
+    path: string;
+    size: number;
+    mtimeMs: number;
+    /** Content hash for non-output ignored files; contents are never persisted. */
+    sha256?: string;
 }
 export type RollbackOutcomeStatus = "restored" | "not_required" | "failed" | "unavailable";
 export interface RollbackOutcomeArtifact {
@@ -450,6 +466,11 @@ export interface RollbackOutcomeArtifact {
     };
     restoredFiles: string[];
     deletedFiles: string[];
+    /** Set when attempt-created commits were rewound to the boundary HEAD. */
+    rewoundHead?: {
+        from: string;
+        to: string;
+    };
     error?: string;
 }
 export { createGovernanceSnapshot } from "./governance.js";

package/dist/vendor/contracts/swarm.js

@@ -456,7 +456,7 @@ function budgetWidened(parent, child) {
             && (child.maxTokens === undefined || child.maxTokens > parent.maxTokens));
 }
 function approvalWidened(parent, child) {
-    const keys = ["dependencyAdds", "migrations", "configChanges", "externalWrites"];
+    const keys = ["dependencyAdds", "migrations", "configChanges", "externalWrites", "testChanges"];
     return keys.some((key) => child[key] === true && parent[key] !== true);
 }
 function addDuplicateErrors(values, code, path, errors) {

package/dist/vendor/core/index.d.ts

@@ -2,14 +2,15 @@ import { type ApprovalPolicy, type AgentExecutionIntent, type ContextHandoffRece
 import { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, type ExitDecision } from "./policy.js";
 import { evaluateChangeApprovalLeash, evaluateFilesystemLeash, evaluateSecretLeash, redactSecretsFromText, resolveExecutionProfile, evaluateVerificationLeash } from "./leash.js";
 import { buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations } from "./grounding.js";
-import { captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, restoreRollbackBoundary } from "./rollback.js";
+import { captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, listIgnoredFileChangesSinceBoundary, restoreRollbackBoundary } from "./rollback.js";
 import { type RunStore } from "./persistence/index.js";
 import { type ExitPolicyOverrides } from "./exits.js";
 import { type ExitSignalSource } from "./exit-signal.js";
 import { type VerifierExecutionBinding } from "./verified-handoff.js";
 export type { AgentExecutionIntent, ApprovalPolicy, BudgetPreflightEstimate, BudgetSettlement, CostProvenance, EvidenceVector, ExecutionProfile, FailureClass, InterventionType, PatchDecision, PatchDecisionArtifact, PatchDecisionReasonCode, PatchScore, MutationMode, RollbackBoundaryArtifact, RollbackBoundaryStrategy, RollbackFileSnapshot, RollbackOutcomeArtifact, RollbackOutcomeStatus, PolicyPhase, CallStage, AgentRole, FirstDelta, RoutingEconomics } from "../contracts/index.js";
 export { DEFAULT_AGENT_EXECUTION_INTENT, DEFAULT_PROVIDER_EXECUTION_TIMEOUT_MS, GOVERNED_AUTONOMOUS_BOUNDARY, normalizeProviderExecutionTimeoutMs } from "../contracts/index.js";
-export { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, evaluateVerificationLeash, evaluateFilesystemLeash, evaluateChangeApprovalLeash, evaluateSecretLeash, resolveExecutionProfile, redactSecretsFromText, buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations, captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, restoreRollbackBoundary };
+export { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, evaluateVerificationLeash, evaluateFilesystemLeash, evaluateChangeApprovalLeash, evaluateSecretLeash, resolveExecutionProfile, redactSecretsFromText, buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations, captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, listIgnoredFileChangesSinceBoundary, restoreRollbackBoundary };
+export { describeMalformedVerifier } from "./verifier-input.js";
 export type { BudgetPreflightDecision, BudgetPreflightInput, CostGovernorState, EvidenceVectorInput, EvaluatedPatchDecision, ExitDecision, FailureAssessment, PatchDecisionInput, RecoveryDecision, RecoveryRecipe } from "./policy.js";
 export type { ResolvedExecutionProfile, SafetyLeashDecision, SafetyViolation } from "./leash.js";
 export type { GroundingScanResult, GroundingViolation, GroundingViolationKind, RepoGroundingHit, RepoGroundingIndex } from "./grounding.js";
@@ -24,7 +25,7 @@ export { calculateAvoidedUsd, calculateLoopAvoidedUsd } from "./savings.js";
 export type { AvoidedUsdInput } from "./savings.js";
 export { classifyRoute, evaluatePreworkBurnPolicy } from "./routing.js";
 export type { RouteDecision, RouteClassificationInput } from "./routing.js";
-export { validateTestIntegrity, snapshotTestFiles, identifyNewTests, findTestFiles, isTestFile, extractImports, hasTrivialAssertionsOnly, importsPreExistingCode } from "./test-integrity.js";
+export { validateTestIntegrity, snapshotTestFiles, identifyNewTests, findTestFiles, isTestFile, extractImports, hasTrivialAssertionsOnly, importsPreExistingCode, isTestPath, findWeakenedTestFiles } from "./test-integrity.js";
 export type { TestIntegrityReport, TestIntegrityFinding } from "./test-integrity.js";
 export { analyzeRepoStyle, buildPromptDirectives } from "./repo-analyzer.js";
 export type { RepoStyleProfile } from "./repo-analyzer.js";
@@ -32,7 +33,7 @@ export { runContextIntegrityPrecheck } from "./context-integrity.js";
 export type { ContextIntegrityPrecheck, ContextIntegrityVerdict } from "./context-integrity.js";
 export { compilePromptPacket } from "./compiler.js";
 export type { PromptPacket, CompilerAdapterRequest } from "./compiler.js";
-export { buildVerifiedHandoff, deriveVerifiedHandoffLifecycleTruth, deriveVerifiedHandoffExecutionBoundary, resolveVerifiedHandoffOutcome, toTestIntegrityVerdict, verifierActuallyPassed, } from "./verified-handoff.js";
+export { buildVerifiedHandoff, NO_FILE_CHANGES_WARNING, deriveVerifiedHandoffLifecycleTruth, deriveVerifiedHandoffExecutionBoundary, resolveVerifiedHandoffOutcome, toTestIntegrityVerdict, verifierActuallyPassed, } from "./verified-handoff.js";
 export type { BoundVerifierEvidence, BuildVerifiedHandoffInput, VerifierExecutionBinding, } from "./verified-handoff.js";
 export { createFileRunStore, makeLedgerEvent, readAllLoopRecords, readLatestLoopRecord, readLatestLoopRecordFromFile, readLoopRecordsFromFile, resolveRunsRoot, resolveReceiptIntegrityPath, verifyReceiptIntegrityFromFiles, writeReceiptIntegrityMaterial } from "./persistence/index.js";
 export type { AttemptArtifacts, LedgerEvent, LedgerEventKind, LoopAttemptRecord, LoopRunRecord, ReceiptIntegrityChainEntry, RunContract, RunStore, StoredReceiptIntegrityMaterial } from "./persistence/index.js";

package/dist/vendor/core/index.js

@@ -2,7 +2,8 @@ import { DEFAULT_AGENT_EXECUTION_INTENT, normalizeProviderExecutionTimeoutMs, ap
 import { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe } from "./policy.js";
 import { evaluateChangeApprovalLeash, evaluateFilesystemLeash, evaluateSecretLeash, redactSecretsFromText, resolveExecutionProfile, evaluateVerificationLeash } from "./leash.js";
 import { buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations } from "./grounding.js";
-import { captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, restoreRollbackBoundary } from "./rollback.js";
+import { captureRollbackBoundary, findEscapingLinks, listAttemptChangedFilesSinceBoundary, listIgnoredFileChangesSinceBoundary, restoreRollbackBoundary } from "./rollback.js";
+import { findWeakenedTestFiles } from "./test-integrity.js";
 import { compilePromptPacket } from "./compiler.js";
 import { makeLedgerEvent, resolveRunsRoot, runDir } from "./persistence/index.js";
 import { createDefaultExitPolicy, evaluateExitPolicy, hashProgressState, toLegacyExitDecision } from "./exits.js";
@@ -14,7 +15,8 @@ import { decideCircuitBreak } from "./trajectory.js";
 import { verifyContextHandoff, decideContextCircuitBreak } from "./context-handoff.js";
 import { verifierActuallyPassed, } from "./verified-handoff.js";
 export { DEFAULT_AGENT_EXECUTION_INTENT, DEFAULT_PROVIDER_EXECUTION_TIMEOUT_MS, GOVERNED_AUTONOMOUS_BOUNDARY, normalizeProviderExecutionTimeoutMs } from "../contracts/index.js";
-export { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, evaluateVerificationLeash, evaluateFilesystemLeash, evaluateChangeApprovalLeash, evaluateSecretLeash, resolveExecutionProfile, redactSecretsFromText, buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations, captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, restoreRollbackBoundary };
+export { classifyFailure, computeEvidenceVector, evaluatePatchDecision, evaluateCostGovernor, evaluateBudgetPreflight, inferExit, nextPolicyPhase, policyPhaseToLifecycleState, scorePatchDecision, selectRecoveryRecipe, evaluateVerificationLeash, evaluateFilesystemLeash, evaluateChangeApprovalLeash, evaluateSecretLeash, resolveExecutionProfile, redactSecretsFromText, buildRepoGroundingIndex, loadOrBuildRepoGroundingIndex, queryRepoGroundingIndex, scanPatchForGroundingViolations, captureRollbackBoundary, listAttemptChangedFilesSinceBoundary, listIgnoredFileChangesSinceBoundary, restoreRollbackBoundary };
+export { describeMalformedVerifier } from "./verifier-input.js";
 export { buildContextGraphSnapshot, queryContextGraph } from "./context-graph.js";
 export { ExternalOutcomeContractError, ExternalOutcomePolicyError, hashExternalOutcomeContract, verifyExternalOutcomes, writeExternalOutcomeEvidence, } from "./external-outcome.js";
 export { createLocalIdentityAuthority, hasIdentityScope, issueIdentityToken, verifyIdentityToken } from "./identity.js";
@@ -24,7 +26,7 @@ export { calculateAvoidedUsd, calculateLoopAvoidedUsd } from "./savings.js";
 // ─── Routing economics ─────────────────────────────────────────────────────
 export { classifyRoute, evaluatePreworkBurnPolicy } from "./routing.js";
 // ─── Test Integrity Validation ──────────────────────────────────────────────
-export { validateTestIntegrity, snapshotTestFiles, identifyNewTests, findTestFiles, isTestFile, extractImports, hasTrivialAssertionsOnly, importsPreExistingCode } from "./test-integrity.js";
+export { validateTestIntegrity, snapshotTestFiles, identifyNewTests, findTestFiles, isTestFile, extractImports, hasTrivialAssertionsOnly, importsPreExistingCode, isTestPath, findWeakenedTestFiles } from "./test-integrity.js";
 // ─── Repo Style Analyzer ────────────────────────────────────────────────────
 export { analyzeRepoStyle, buildPromptDirectives } from "./repo-analyzer.js";
 // ─── Context Integrity Pre-gate ──────────────────────────────────────────────
@@ -32,7 +34,7 @@ export { runContextIntegrityPrecheck } from "./context-integrity.js";
 // ─── Prompt packet compiler ──────────────────────────────────────────────────
 export { compilePromptPacket } from "./compiler.js";
 // ─── Verified Handoff builder ────────────────────────────────────────────────
-export { buildVerifiedHandoff, deriveVerifiedHandoffLifecycleTruth, deriveVerifiedHandoffExecutionBoundary, resolveVerifiedHandoffOutcome, toTestIntegrityVerdict, verifierActuallyPassed, } from "./verified-handoff.js";
+export { buildVerifiedHandoff, NO_FILE_CHANGES_WARNING, deriveVerifiedHandoffLifecycleTruth, deriveVerifiedHandoffExecutionBoundary, resolveVerifiedHandoffOutcome, toTestIntegrityVerdict, verifierActuallyPassed, } from "./verified-handoff.js";
 // ─── Persistence (RunStore, LedgerEvent, FileRunStore) ──────────────────────
 export { createFileRunStore, makeLedgerEvent, readAllLoopRecords, readLatestLoopRecord, readLatestLoopRecordFromFile, readLoopRecordsFromFile, resolveRunsRoot, resolveReceiptIntegrityPath, verifyReceiptIntegrityFromFiles, writeReceiptIntegrityMaterial } from "./persistence/index.js";
 export { compileAndPersistContext } from "./persistence/index.js";
@@ -1073,9 +1075,37 @@ export async function runMartin(input) {
                     }
                 }));
             }
-            const changedFiles = tracksWorkspaceMutations
-                ? resolveChangedFiles(result, request.context.repoRoot, rollbackBoundary)
-                : [];
+            let changedFiles = [];
+            try {
+                changedFiles = tracksWorkspaceMutations
+                    ? resolveChangedFiles(result, request.context.repoRoot, rollbackBoundary)
+                    : [];
+            }
+            catch (error) {
+                for (const filePath of normalizeFileEffectPaths(result.execution?.changedFiles ?? [])) {
+                    touchedDuringExecution.add(filePath);
+                }
+                const observationExitDecision = {
+                    shouldExit: true,
+                    lifecycleState: "human_escalation",
+                    status: "exited",
+                    reason: `Workspace change observation became unavailable: ${fileEffectErrorMessage(error)}`,
+                    reasonCode: "workspace_observation_unavailable"
+                };
+                if (input.store) {
+                    await input.store.appendLedger(loop.loopId, makeLedgerEvent({
+                        kind: "run.exited",
+                        runId: loop.loopId,
+                        payload: createRunExitPayload(observationExitDecision)
+                    }));
+                }
+                await stopSignalMonitorAndDrainDiagnostics();
+                const terminationEnvelope = await persistGuardStop(observationExitDecision);
+                const finalizedLoop = await finalizeCurrentLoop(observationExitDecision, now());
+                const finalizedWithEnvelope = { ...finalizedLoop, terminationEnvelope };
+                await persistLoopRecordIfSupported(input.store, finalizedWithEnvelope);
+                return { loop: finalizedWithEnvelope, decision: observationExitDecision };
+            }
             for (const filePath of normalizeFileEffectPaths(changedFiles)) {
                 touchedDuringExecution.add(filePath);
             }
@@ -1097,9 +1127,17 @@ export async function runMartin(input) {
             // returned a non-empty list. A repoRoot alone is insufficient — git may fail (e.g. not
             // a git repo) and silently return [], which would falsely trigger no_code_change.
             const changedFileEvidenceAvailable = result.execution?.changedFiles !== undefined || changedFiles.length > 0;
+            const ignoredChanges = tracksWorkspaceMutations
+                ? listIgnoredFileChangesSinceBoundary({ repoRoot: request.context.repoRoot, boundary: rollbackBoundary })
+                : { created: [], modified: [], deleted: [] };
+            const escapingLinks = tracksWorkspaceMutations && request.context.repoRoot
+                ? findEscapingLinks(request.context.repoRoot, [...changedFiles, ...ignoredChanges.created])
+                : [];
             const filesystemDecision = evaluateFilesystemLeash({
                 repoRoot: request.context.repoRoot,
                 changedFiles,
+                ignoredFiles: [...ignoredChanges.created, ...ignoredChanges.modified, ...ignoredChanges.deleted],
+                escapingLinks,
                 allowedPaths: request.context.allowedPaths,
                 deniedPaths: request.context.deniedPaths,
                 mutationMode: request.context.mutationMode
@@ -1127,7 +1165,14 @@ export async function runMartin(input) {
                     repoRoot: request.context.repoRoot,
                     boundary: rollbackBoundary,
                     restoredAt: attemptCompletedAt,
-                    decision: patchDecision.decision
+                    decision: patchDecision.decision,
+                    // Attempt-created ignored violations are removed. Modified or deleted
+                    // baseline ignored violations are restored from the bounded in-memory snapshot.
+                    removePaths: violatingIgnoredPaths(filesystemDecision.violations, ignoredChanges.created),
+                    restoreIgnoredPaths: violatingIgnoredPaths(filesystemDecision.violations, [
+                        ...ignoredChanges.modified,
+                        ...ignoredChanges.deleted
+                    ])
                 });
                 if (input.store) {
                     await input.store.writeAttemptArtifacts(loop.loopId, currentAttemptIndex, {
@@ -1176,8 +1221,16 @@ export async function runMartin(input) {
                     decision: filesystemExitDecision
                 };
             }
+            const weakenedTestFiles = tracksWorkspaceMutations && request.context.repoRoot && rollbackBoundary?.headRef
+                ? findWeakenedTestFiles({
+                    repoRoot: request.context.repoRoot,
+                    baseRef: rollbackBoundary.headRef,
+                    changedFiles
+                })
+                : [];
             const changeApprovalDecision = evaluateChangeApprovalLeash({
                 changedFiles,
+                weakenedTestFiles,
                 executionProfile: request.context.executionProfile,
                 approvalPolicy: request.context.approvalPolicy
             });
@@ -1550,6 +1603,8 @@ function safetyLeashReasonCode(decision, safetySurface) {
             return "migration_approval_required";
         case "config_change_approval_required":
             return "config_change_approval_required";
+        case "test_change_approval_required":
+            return "test_change_approval_required";
         default:
             return `${safetySurface}_safety_block`;
     }
@@ -1595,7 +1650,8 @@ function observeRunFileEffects(input) {
     try {
         const netChangedAtCompletion = normalizeFileEffectPaths(listAttemptChangedFilesSinceBoundary({
             repoRoot: input.repoRoot,
-            boundary: input.boundary
+            boundary: input.boundary,
+            includeBaselineSnapshotChanges: true
         }));
         const netChanged = new Set(netChangedAtCompletion);
         return {
@@ -1714,18 +1770,23 @@ function mergeCostProvenance(previous, current) {
     }
     return COST_PROVENANCE_RANK[current] < COST_PROVENANCE_RANK[previous] ? current : previous;
 }
+/**
+ * Git-backed observation that degrades the same way `resolveChangedFiles` does:
+ * when Git becomes unavailable after the attempt, fall back only if the adapter
+ * reported its own changed files; otherwise fail closed.
+ */
+function violatingIgnoredPaths(violations, ignoredPaths) {
+    const violating = new Set(violations.map((violation) => violation.file?.replace(/\/$/u, "")).filter(Boolean));
+    return ignoredPaths.filter((filePath) => violating.has(filePath.replace(/\/$/u, "")));
+}
 function resolveChangedFiles(result, repoRoot, rollbackBoundary) {
     const adapterReported = normalizeFileEffectPaths(result.execution?.changedFiles ?? []);
-    try {
-        const gitObserved = listAttemptChangedFilesSinceBoundary({ repoRoot, boundary: rollbackBoundary });
-        return normalizeFileEffectPaths([...adapterReported, ...gitObserved]);
-    }
-    catch (error) {
-        if (result.execution?.changedFiles !== undefined) {
-            return adapterReported;
-        }
-        throw error;
-    }
+    const gitObserved = listAttemptChangedFilesSinceBoundary({
+        repoRoot,
+        boundary: rollbackBoundary,
+        includeBaselineSnapshotChanges: true
+    });
+    return normalizeFileEffectPaths([...adapterReported, ...gitObserved]);
 }
 function buildPatchDiff(result, changedFiles) {
     if (result.execution?.patch) {

package/dist/vendor/core/leash.d.ts

@@ -1,6 +1,6 @@
 import type { ApprovalPolicy, ExecutionProfile, LoopTask } from "../contracts/index.js";
 export type SafetySurface = "command" | "filesystem" | "secret" | "spend" | "network" | "dependency";
-export type SafetyViolationKind = "command_blocked" | "path_not_allowed" | "path_denied" | "path_outside_repo" | "network_blocked" | "dependency_approval_required" | "migration_approval_required" | "config_change_approval_required" | "secret_value" | "protected_path";
+export type SafetyViolationKind = "command_blocked" | "path_not_allowed" | "path_denied" | "path_outside_repo" | "network_blocked" | "dependency_approval_required" | "migration_approval_required" | "config_change_approval_required" | "test_change_approval_required" | "secret_value" | "protected_path";
 export interface SafetyViolation {
     kind: SafetyViolationKind;
     message: string;
@@ -30,6 +30,14 @@ export declare function evaluateVerificationLeash(task: Pick<LoopTask, "verifica
 export declare function evaluateFilesystemLeash(input: {
     repoRoot?: string;
     changedFiles: string[];
+    /**
+     * Git-ignored files the attempt created or modified. These are checked only
+     * against denied paths and protected secret files, never allowed paths, so
+     * dependency installs and build output stay unaffected.
+     */
+    ignoredFiles?: string[];
+    /** Symlinks or junctions created inside the repo that resolve outside it. */
+    escapingLinks?: string[];
     allowedPaths?: string[];
     deniedPaths?: string[];
     mutationMode?: "edit" | "read_only" | "verify_only";
@@ -43,6 +51,8 @@ export declare function resolveExecutionProfile(input: {
 }): ResolvedExecutionProfile;
 export declare function evaluateChangeApprovalLeash(input: {
     changedFiles: string[];
+    /** Existing test files the attempt deleted or removed lines from. */
+    weakenedTestFiles?: string[];
     executionProfile?: ExecutionProfile;
     approvalPolicy?: ApprovalPolicy;
 }): SafetyLeashDecision;

package/dist/vendor/core/leash.js

@@ -1,4 +1,5 @@
 import { isAbsolute, relative, resolve } from "node:path";
+import { isInsideDependencyOrBuildDirectory } from "./output-directories.js";
 const BLOCKED_PATTERNS = [
     /(^|[\s;&|`(])rm\s+-rf(\s|$)/iu,
     /git\s+reset\s+--hard/iu,
@@ -186,8 +187,13 @@ export function evaluateVerificationLeash(task) {
     };
 }
 export function evaluateFilesystemLeash(input) {
-    const violations = [];
-    for (const rawFile of input.changedFiles) {
+    const violations = (input.escapingLinks ?? []).map((link) => ({
+        kind: "path_outside_repo",
+        file: link,
+        message: `Link inside the repo points outside the configured repo root: ${link}`
+    }));
+    const escapingLinks = new Set(input.escapingLinks ?? []);
+    for (const rawFile of input.changedFiles.filter((file) => !escapingLinks.has(file))) {
         const normalized = normalizeChangedFile(rawFile, input.repoRoot);
         if (normalized.outsideRepo) {
             violations.push({
@@ -218,6 +224,10 @@ export function evaluateFilesystemLeash(input) {
             continue;
         }
         const allowedPaths = input.allowedPaths ?? [];
+        if (isProtectedSecretFile(file) && !isExplicitlyAllowed(file, allowedPaths)) {
+            violations.push(protectedSecretViolation(file));
+            continue;
+        }
         if (allowedPaths.length > 0 && !allowedPaths.some((pattern) => matchesPathPattern(file, pattern))) {
             violations.push({
                 kind: "path_not_allowed",
@@ -226,6 +236,25 @@ export function evaluateFilesystemLeash(input) {
             });
         }
     }
+    for (const rawFile of input.ignoredFiles ?? []) {
+        const file = normalizePathForMatching(rawFile);
+        if (!file) {
+            continue;
+        }
+        if ((input.deniedPaths ?? []).some((pattern) => matchesPathPattern(file, pattern))) {
+            violations.push({
+                kind: "path_denied",
+                file,
+                message: `Git-ignored file matches a denylisted path: ${file}`
+            });
+            continue;
+        }
+        if (!isInsideDependencyOrBuildDirectory(file) &&
+            isProtectedSecretFile(file) &&
+            !isExplicitlyAllowed(file, input.allowedPaths ?? [])) {
+            violations.push(protectedSecretViolation(file));
+        }
+    }
     if (violations.length > 0) {
         return {
             allowed: false,
@@ -357,6 +386,15 @@ export function evaluateChangeApprovalLeash(input) {
             });
         }
     }
+    if (!input.approvalPolicy?.testChanges) {
+        for (const file of input.weakenedTestFiles ?? []) {
+            violations.push({
+                kind: "test_change_approval_required",
+                file,
+                message: `Removing or rewriting existing test code requires approval: ${file}`
+            });
+        }
+    }
     if (violations.length > 0) {
         return {
             allowed: false,
@@ -366,7 +404,7 @@ export function evaluateChangeApprovalLeash(input) {
             profile: profile.name,
             blockedCommands: [],
             violations,
-            reason: "Safety leash blocked dependency, migration, or configuration changes that require approval."
+            reason: "Safety leash blocked dependency, migration, configuration, or existing-test changes that require approval."
         };
     }
     return {
@@ -408,6 +446,42 @@ function normalizeChangedFile(file, repoRoot) {
         outsideRepo: false
     };
 }
+const SAFE_ENV_TEMPLATE_SUFFIXES = new Set(["example", "sample", "template", "dist", "defaults"]);
+const PRIVATE_KEY_BASENAMES = new Set(["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519"]);
+const SECRET_MATERIAL_EXTENSIONS = new Set(["pem", "key", "p12", "pfx"]);
+/** Files that conventionally hold credentials or private key material. */
+function isProtectedSecretFile(file) {
+    const leaf = normalizePathForMatching(file).split("/").at(-1) ?? "";
+    if (leaf === ".env") {
+        return true;
+    }
+    if (leaf.startsWith(".env.")) {
+        return !SAFE_ENV_TEMPLATE_SUFFIXES.has(leaf.slice(".env.".length).toLowerCase());
+    }
+    if (PRIVATE_KEY_BASENAMES.has(leaf)) {
+        return true;
+    }
+    const extension = leaf.includes(".") ? leaf.split(".").at(-1)?.toLowerCase() : undefined;
+    return extension !== undefined && SECRET_MATERIAL_EXTENSIONS.has(extension);
+}
+/**
+ * A protected file counts as allowed only when an allowed-path entry targets it
+ * specifically; broad wildcards such as `**` or `src/*` do not approve secrets.
+ */
+function isExplicitlyAllowed(file, allowedPaths) {
+    return allowedPaths.some((pattern) => {
+        const leafPattern = normalizePathForMatching(pattern).split("/").at(-1) ?? "";
+        return !/^\*+$/u.test(leafPattern) && matchesPathPattern(file, pattern);
+    });
+}
+function protectedSecretViolation(file) {
+    return {
+        kind: "protected_path",
+        file,
+        message: `Changed file is a protected secret or key file: ${file}. ` +
+            "Name it explicitly in allowed paths to permit agent writes."
+    };
+}
 function matchesPathPattern(file, pattern) {
     const normalizedFile = normalizePathForMatching(file);
     const normalizedPattern = normalizePathForMatching(pattern);

package/dist/vendor/core/output-directories.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Directory names that hold dependency installs or build output. Git-ignored
+ * content under them is tracked as a single collapsed entry and is not checked
+ * file by file for protected secrets.
+ */
+export declare const DEPENDENCY_AND_BUILD_DIRECTORIES: ReadonlySet<string>;
+export declare function isInsideDependencyOrBuildDirectory(repoPath: string): boolean;

package/dist/vendor/core/output-directories.js

@@ -0,0 +1,36 @@
+/**
+ * Directory names that hold dependency installs or build output. Git-ignored
+ * content under them is tracked as a single collapsed entry and is not checked
+ * file by file for protected secrets.
+ */
+export const DEPENDENCY_AND_BUILD_DIRECTORIES = new Set([
+    "node_modules",
+    "bower_components",
+    "jspm_packages",
+    ".pnpm-store",
+    ".yarn",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".tox",
+    ".gradle",
+    ".next",
+    ".nuxt",
+    ".turbo",
+    ".cache",
+    ".parcel-cache",
+    "target",
+    "dist",
+    "build",
+    "out",
+    "coverage",
+    "vendor"
+]);
+export function isInsideDependencyOrBuildDirectory(repoPath) {
+    const segments = repoPath.replace(/\\/gu, "/").split("/").filter(Boolean);
+    // A trailing collapsed entry such as `node_modules/` is itself the directory.
+    return segments.some((segment) => DEPENDENCY_AND_BUILD_DIRECTORIES.has(segment));
+}

package/dist/vendor/core/rollback.d.ts

@@ -1,18 +1,42 @@
 import type { PatchDecision, RollbackBoundaryArtifact, RollbackOutcomeArtifact } from "../contracts/index.js";
+export interface IgnoredFileChanges {
+    created: string[];
+    modified: string[];
+    deleted: string[];
+}
 export declare class RollbackStateUnavailableError extends Error {
     constructor(message: string);
 }
 export declare function listAttemptChangedFilesSinceBoundary(input: {
     repoRoot?: string;
     boundary?: RollbackBoundaryArtifact;
+    /** Include content changes to dirty/untracked paths that existed at the boundary. */
+    includeBaselineSnapshotChanges?: boolean;
 }): string[];
 export declare function captureRollbackBoundary(input: {
     repoRoot?: string;
     capturedAt: string;
 }): Promise<RollbackBoundaryArtifact | undefined>;
+/**
+ * Git-ignored files the attempt created or modified since the boundary.
+ * Boundaries recorded before the ignored inventory existed report nothing.
+ */
+export declare function listIgnoredFileChangesSinceBoundary(input: {
+    repoRoot?: string;
+    boundary?: RollbackBoundaryArtifact;
+}): IgnoredFileChanges;
 export declare function restoreRollbackBoundary(input: {
     repoRoot?: string;
     boundary?: RollbackBoundaryArtifact;
     restoredAt: string;
     decision: PatchDecision;
+    /** Extra attempt-created paths (for example ignored files) to delete. */
+    removePaths?: string[];
+    /** Pre-existing ignored paths to restore from the in-memory boundary. */
+    restoreIgnoredPaths?: string[];
 }): Promise<RollbackOutcomeArtifact | undefined>;
+/**
+ * Repo-relative links (symlinks or junctions) among `paths` whose target
+ * resolves outside the repository. Paths are first collapsed to the link.
+ */
+export declare function findEscapingLinks(repoRoot: string, paths: string[]): string[];