@muggleai/works 5.27.0-staging.242 → 5.27.0-staging.244

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "muggleai",
       "source": "./plugin",
       "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-      "version": "5.27.0-staging.242"
+      "version": "5.27.0-staging.244"
     }
   ]
 }

package/dist/{chunk-EK5DJBSY.js → chunk-EPIM27JX.js}

@@ -4719,6 +4719,7 @@ mcpToolNamePattern(
 mcpToolNamePattern("muggle-local-telemetry-event-emit");
 mcpToolNamePattern("muggle-remote-user-feedback-create");
 var LOCK_POLL_INTERVAL_MS = 10;
+var UNRECORDED_LOCK_HOLDER_GRACE_MS = 1e4;
 
 // src/guardrails/types.ts
 var ProviderPrState = /* @__PURE__ */ ((ProviderPrState2) => {
@@ -5104,10 +5105,17 @@ function recordedHolder(lockPath) {
     return void 0;
   }
 }
-function breakLockIfHolderIsDead(lockPath) {
+function isUnrecordedLockPastGrace(lockPath) {
+  try {
+    return Date.now() - statSync(lockPath).mtimeMs > UNRECORDED_LOCK_HOLDER_GRACE_MS;
+  } catch {
+    return false;
+  }
+}
+function breakAbandonedLock(lockPath) {
   const holder = recordedHolder(lockPath);
-  if (!holder) return;
-  if (holder.host !== hostname() || isProcessAlive(holder.pid)) return;
+  const isAbandoned = holder ? holder.host === hostname() && !isProcessAlive(holder.pid) : isUnrecordedLockPastGrace(lockPath);
+  if (!isAbandoned) return;
   try {
     unlinkSync(lockPath);
   } catch {
@@ -5132,7 +5140,7 @@ function withFileLock(lockPath, waitMs, run) {
         })
       );
     } catch {
-      breakLockIfHolderIsDead(lockPath);
+      breakAbandonedLock(lockPath);
       if (Date.now() >= deadline) return void 0;
       pauseBetweenAttempts();
       continue;

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { runCli } from './chunk-EK5DJBSY.js';
+import { runCli } from './chunk-EPIM27JX.js';
 import './chunk-FI6VHHZN.js';
 
 // src/cli/main.ts

package/dist/index.js

@@ -1,2 +1,2 @@
-export { src_exports as commands, createUnifiedMcpServer, server_exports as server } from './chunk-EK5DJBSY.js';
+export { src_exports as commands, createUnifiedMcpServer, server_exports as server } from './chunk-EPIM27JX.js';
 export { createChildLogger, e2e_exports as e2e, getConfig, getLocalQaTools, getLogger, getQaTools, local_exports as localQa, mcp_exports as mcp, e2e_exports as qa, src_exports as shared } from './chunk-FI6VHHZN.js';

package/dist/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "muggle",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.27.0-staging.242",
+  "version": "5.27.0-staging.244",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/dist/plugin/.codex-mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.27.0-staging.242",
+        "@muggleai/works@5.27.0-staging.244",
         "serve"
       ],
       "env": {

package/dist/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "muggle",
-  "version": "5.27.0-staging.242",
+  "version": "5.27.0-staging.244",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
   "author": {
     "name": "Muggle AI",

package/dist/plugin/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "muggle",
   "displayName": "Muggle AI",
   "description": "Real-browser E2E acceptance for your coding agent: test the flows you changed and open the PR with screenshots. Built for flows other tools can't reach: managed test identities with live inboxes (magic links, email OTP and 2FA, verification mail, password resets), an encrypted secret store for login and test credentials, and a test graph that runs prerequisite flows first. Plain-English tests become replayable scripts on localhost or preview URLs.",
-  "version": "5.27.0-staging.242",
+  "version": "5.27.0-staging.244",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/dist/plugin/.mcp.json

@@ -4,7 +4,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@muggleai/works@5.27.0-staging.242",
+        "@muggleai/works@5.27.0-staging.244",
         "serve"
       ]
     }

package/dist/plugin/hooks/README.md

@@ -26,7 +26,7 @@ Enforcement is reserved for the handoffs that were being skipped: the E2E accept
 
 A recorder that *clears* an obligation — a walkthrough posted, a failure diagnosed, a test case classified — records only when the call did not visibly fail (`callOutcome.ts`). Recording from the request alone let a rejected `gh pr comment` mark the walkthrough posted, so the gate went quiet on a PR that never received it.
 
-Each guardrail is a bash gate script in `../scripts/` holding a `guardrail_wants` pre-filter and the `guardrails.mjs` subcommand it feeds; the bundled `../scripts/guardrails.mjs` holds the decision logic (built from `src/guardrails/`, vitest-covered). The busy events — a shell command before and after it runs, and every turn end — register one `guardrail-dispatch.sh` command listing their gates, which reads the payload once, asks every gate's pre-filter in that one process, and starts Node once (`guardrails.mjs run <gates...>`) for just the gates that could fire, merging their responses. Rarer events call a gate script directly. Per-session state in `~/.muggle-ai/guardrails/<session_id>.json` tracks what fired. Any *failure* degrades to `{}` (allow) — a gate blocks only by an explicit, tested decision, never by accident; `guardrail-lib.sh` is the one place that falls back, and `run` isolates gates from each other.
+Each guardrail is a bash gate script in `../scripts/` holding a `guardrail_wants` pre-filter and the `guardrails.mjs` subcommand it feeds; the bundled `../scripts/guardrails.mjs` holds the decision logic (built from `src/guardrails/`, vitest-covered). The busy events — a shell command before and after it runs, and every turn end — register one `guardrail-dispatch.sh` command listing their gates, which reads the payload once, asks every gate's pre-filter in that one process, and starts Node once (`guardrails.mjs run <gates...>`) for just the gates that could fire, merging their responses. Rarer events call a gate script directly. Per-session state in `~/.muggle-ai/guardrails/<session_id>.json` tracks what fired. Every hook commits to it under the session's lock, re-reading inside it, because of two hooks that read, change and write it unlocked the later erases the earlier; a hook that cannot take the lock within its wait saves its change beside the state file for a detached job to commit, and one with nothing new to record takes no lock. A lock is broken when its recorded holder is dead, or, when it names none (a hook killed between creating it and recording itself), once it is 10 seconds old. Any *failure* degrades to `{}` (allow) — a gate blocks only by an explicit, tested decision, never by accident; `guardrail-lib.sh` is the one place that falls back, and `run` isolates gates from each other.
 
 Every `hooks.json` command enters through `../scripts/hook-entry.sh`, with the hook's script and arguments set as positional parameters first: `set -- guardrail-dispatch.sh guardrail-e2e-gate.sh …; . "${CLAUDE_PLUGIN_ROOT}/scripts/hook-entry.sh"`. Claude Code runs a hook command through Git Bash on Windows and through `/bin/sh` elsewhere. Inside Git Bash the entry sources the script into that same shell, so a hook costs the one Git Bash start Claude Code makes rather than a second `bash` with its own MSYS runtime init — measured at 0.3–1.2 s per firing on a loaded box. Anywhere else `/bin/sh` may be dash, so the entry is POSIX sh and hands the script to a bash of its own, as `bash "<script>"` did. A gate script tells it is the hook's own script — not one `guardrail-dispatch.sh` sourced for its pre-filter — through `guardrail_is_hook_script`, which reads the script path the entry records, or `$0` when bash ran the script.
 
@@ -42,7 +42,7 @@ Pre-filters are bash builtins only (`guardrail-lib.sh`), so an irrelevant event
 | `PostToolUse` (AskUserQuestion) | `guardrail-offer-ran.sh` | record | a next-options offer ran while a terminal PR was pending | — | clear `terminalPending` — the only exit for the post-merge Stop gate |
 | `PostToolUse` (Agent, Task) | `guardrail-record-delegation.sh` | record | a `muggle:acceptance-tester` was launched into the background — its response carries no finished report yet | — | append to `e2eDelegations` with the PR URLs its brief names; for a bounded window the E2E and debug-path gates hold off, and the walkthrough gate sets those PRs aside, so the session is never steered into a second browser run alongside the agent's. Shares the AskUserQuestion group's dispatch |
 | `PostToolUse` (Skill + muggle telemetry-skill-emit) | `guardrail-skill-stages.sh` | advise | a skill this plugin ships was invoked; its `SKILL.md` frontmatter may declare `mandatoryStages`. Registered on the skill's own MCP announcement too, so the declaration still lands if the Skill payload ever stops carrying a name. A muggle-test announcement is also an E2E run (the clean SKIP verdict), recorded here alone, so the skill, its stages and the run land in one commit; a write that cannot take the session's lock in time is saved beside the state file and committed by a detached job once the lock frees | — | record `lastInvokedSkillName` + `mandatoryStages` (and `e2eRun` for a muggle-test announcement), and name the declared files as required reading at the moment of use |
-| `PostToolUse` (Read) | `guardrail-record-stage-read.sh` | record | a markdown file under a `skills/` directory was opened | — | append to `stagesRead` — how the stage gate tells a stage that was read from one that was skipped |
+| `PostToolUse` (Read) | `guardrail-record-stage-read.sh` | record | a markdown file under a `skills/` directory was opened | — | append to `stagesRead` — how the stage gate tells a stage that was read from one that was skipped; a route entry file in the plugin's skills tree, opened while a skill runs, also adds the `mandatoryStages` its frontmatter declares |
 | `PostToolUse` (Bash + muggle telemetry-event-emit / user-feedback-create) | `guardrail-record-stage-signals.sh` | record | a Step 6f `pre-execution-classification` emit, debug-path evidence for a failed run (a `*-failure-classified\|resolved` emit or feedback naming it), or a `MUGGLE_STAGE_SKIP` / `MUGGLE_CLASSIFY_SKIP` / `MUGGLE_DEBUG_SKIP` marker | — | set `classifiedTestCaseIds` / `debuggedRuns` / the matching skip flag |
 | `PostToolUse` (Bash) | `guardrail-record-comment-replies.sh` | record | an unresolved-thread fetch named review threads still awaiting an answer (classified by the `<!-- muggle-do:bot -->` marker, never the author login), a threaded reply the provider **confirmed** answered comments in one, or a `MUGGLE_REPLY_SKIP` marker deferred them | — | claim each thread and cover the comments answered, in the per-PR ledger beside the muggle-do slot |
 | `PreToolUse` (Bash, `if` a command names `gh`/`glab`) | `guardrail-report-format.sh` | **enforce** | a `gh pr comment\|create\|edit` body — or a `gh api … issues/comments/<id>` PATCH editing one — reads like an E2E report but lacks the `build-pr-section` sentinel | — | **deny** — render via `muggle build-pr-section` instead |

package/dist/plugin/scripts/guardrail-record-stage-read.sh

@@ -4,6 +4,8 @@ set -uo pipefail
 # stage-read observer (PostToolUse/Read, and PostToolUse/Bash through the
 # dispatcher). Records that a file in the skills tree was opened, which is how
 # the Stop gate tells a mandatory stage that was read from one that was skipped.
+# A route's entry file that declares `mandatoryStages` adds that route's stages
+# when it is opened during a skill's run.
 # A host with no Read tool (Codex) opens stage files through the shell — `cat`,
 # `sed -n` — so a shell command that prints one counts as a read too. Emits no
 # directive.