@open-agent-toolkit/cli 0.1.69 → 0.1.73

package/dist/commands/config/index.js

@@ -7,7 +7,7 @@ import { readGlobalOptions } from '../shared/shared.utils.js';
 import { compileDispatchCeilingPreset } from '../../config/dispatch-ceiling-preset.js';
 import { normalizeDispatchMatrix, validateDispatchRouteTarget, walkDispatchMatrix, } from '../../config/dispatch-matrix.js';
 import { dispatchPolicyModeDescription, dispatchPolicyPolicyDescription, managedDispatchPolicyValueList, } from '../../config/dispatch-policy-options.js';
-import { VALID_DISPATCH_POLICY_MODES, VALID_MANAGED_DISPATCH_POLICIES, normalizeWorkflowPostImplementSequence, readOatConfig, readOatLocalConfig, readUserConfig, writeOatConfig, writeOatLocalConfig, writeUserConfig, } from '../../config/oat-config.js';
+import { VALID_DISPATCH_POLICY_MODES, VALID_MANAGED_DISPATCH_POLICIES, MAX_GATE_TIMEOUT_MS, MIN_GATE_TIMEOUT_MS, isValidGateTimeoutMs, normalizeWorkflowPostImplementSequence, readOatConfig, readOatLocalConfig, readUserConfig, writeOatConfig, writeOatLocalConfig, writeUserConfig, } from '../../config/oat-config.js';
 import { resolveEffectiveConfig, } from '../../config/resolve.js';
 import { resolveAssetsRoot } from '../../fs/assets.js';
 import { resolveProjectRoot } from '../../fs/paths.js';
@@ -57,12 +57,16 @@ const KEY_ORDER = [
     'workflow.autoNarrowReReviewScope',
     'workflow.autoArtifactReview.plan',
     'workflow.autoArtifactReview.analysis',
+    'workflow.projectLog',
+    'workflow.projectLogLedgerPath',
     'workflow.designMode',
     'workflow.dispatchPolicy.mode',
     'workflow.dispatchPolicy.policy',
     'workflow.dispatchCeiling.preset',
     'workflow.dispatchCeiling.providers.codex',
     'workflow.dispatchCeiling.providers.claude',
+    'workflow.gateTimeouts.code',
+    'workflow.gateTimeouts.artifact',
     'worktrees.root',
 ];
 const CONFIG_CATALOG = [
@@ -462,6 +466,28 @@ const CONFIG_CATALOG = [
         owningCommand: 'oat config set workflow.autoArtifactReview.analysis <true|false>',
         description: 'Automatically run the bounded accuracy-review loop for generated analysis artifacts before apply workflows consume them. Resolution: local > shared > user > default.',
     },
+    {
+        key: 'workflow.projectLog',
+        group: 'Workflow Preferences (3-layer: local > shared > user)',
+        file: '.oat/config.local.json | .oat/config.json | ~/.oat/config.json',
+        scope: 'workflow',
+        type: 'true | false | auto',
+        defaultValue: 'auto',
+        mutability: 'read/write',
+        owningCommand: 'oat config set workflow.projectLog <true|false|auto>',
+        description: 'Controls the append-only per-project observation log. auto creates it on first append; an existing artifact always remains enabled. Resolution: local > shared > user > default.',
+    },
+    {
+        key: 'workflow.projectLogLedgerPath',
+        group: 'Workflow Preferences (3-layer: local > shared > user)',
+        file: '.oat/config.local.json | .oat/config.json | ~/.oat/config.json',
+        scope: 'workflow',
+        type: 'string',
+        defaultValue: '.oat/repo/reference/project-observations.md',
+        mutability: 'read/write',
+        owningCommand: 'oat config set workflow.projectLogLedgerPath <repo-relative-path>',
+        description: 'Repo-relative ledger path used by project-log rollup. Resolution: local > shared > user > default.',
+    },
     {
         key: 'workflow.designMode',
         group: 'Workflow Preferences (3-layer: local > shared > user)',
@@ -583,6 +609,8 @@ const DEFAULT_DEPENDENCIES = {
 };
 function isConfigKey(value) {
     return (KEY_ORDER.includes(value) ||
+        value === 'workflow.dispatchCeiling' ||
+        value === 'workflow.dispatchCeiling.providers' ||
         isDispatchCeilingProviderKey(value));
 }
 function isDispatchCeilingProviderKey(value) {
@@ -741,6 +769,23 @@ function parseWorkflowValue(key, rawValue) {
     if (WORKFLOW_BOOLEAN_KEYS.has(key)) {
         return parseBooleanValue(key, rawValue);
     }
+    if (key === 'workflow.projectLog') {
+        const normalized = rawValue.trim().toLowerCase();
+        if (normalized === 'true' || normalized === 'false') {
+            return normalized === 'true';
+        }
+        if (normalized === 'auto') {
+            return normalized;
+        }
+        throw new Error(`Invalid value for ${key}: expected one of true | false | auto, got '${rawValue}'`);
+    }
+    if (key === 'workflow.projectLogLedgerPath') {
+        const normalized = rawValue.trim();
+        if (!normalized) {
+            throw new Error(`Invalid value for ${key}: expected a non-empty string path`);
+        }
+        return normalized;
+    }
     if (key === 'workflow.postImplementSequence') {
         const normalized = rawValue.trim();
         if (normalized.startsWith('{') || normalized.startsWith('[')) {
@@ -758,6 +803,14 @@ function parseWorkflowValue(key, rawValue) {
             return sequence;
         }
     }
+    if (key === 'workflow.gateTimeouts.code' ||
+        key === 'workflow.gateTimeouts.artifact') {
+        const value = Number(rawValue);
+        if (!isValidGateTimeoutMs(value)) {
+            throw new Error(`Invalid value for ${key}: expected an integer between ${MIN_GATE_TIMEOUT_MS} and ${MAX_GATE_TIMEOUT_MS}`);
+        }
+        return value;
+    }
     const allowed = WORKFLOW_ENUM_VALUES[key];
     if (allowed) {
         const normalized = rawValue.trim();
@@ -875,6 +928,16 @@ function applyWorkflowValue(workflow, key, value) {
             postImplementSequence: value,
         };
     }
+    if (subKey.startsWith('gateTimeouts.')) {
+        const timeoutKey = subKey.slice('gateTimeouts.'.length);
+        return {
+            ...workflow,
+            gateTimeouts: {
+                ...workflow.gateTimeouts,
+                [timeoutKey]: value,
+            },
+        };
+    }
     if (subKey === 'dispatchPolicy.mode') {
         const mode = value;
         if (mode === 'inherit') {
@@ -991,6 +1054,10 @@ async function getConfigValue(repoRoot, userConfigDir, key, dependencies, preser
     const resolved = await dependencies.resolveEffectiveConfig(repoRoot, userConfigDir, dependencies.processEnv);
     const entry = resolved.resolved[key];
     if (!entry) {
+        const aggregate = buildResolvedConfigAggregate(resolved, key);
+        if (aggregate) {
+            return { key, ...aggregate };
+        }
         return { key, value: null, source: 'default' };
     }
     return {
@@ -1001,6 +1068,44 @@ async function getConfigValue(repoRoot, userConfigDir, key, dependencies, preser
         source: entry.source,
     };
 }
+function buildResolvedConfigAggregate(resolved, key) {
+    const prefix = `${key}.`;
+    const entries = Object.entries(resolved.resolved).filter(([entryKey]) => entryKey.startsWith(prefix));
+    if (entries.length === 0) {
+        return null;
+    }
+    const value = {};
+    let source = 'default';
+    const sourceRank = {
+        default: 0,
+        user: 1,
+        shared: 2,
+        local: 3,
+        env: 4,
+    };
+    for (const [entryKey, entry] of entries) {
+        if (sourceRank[entry.source] > sourceRank[source]) {
+            source = entry.source;
+        }
+        const parts = entryKey.slice(prefix.length).split('.');
+        let cursor = value;
+        for (const [index, part] of parts.entries()) {
+            if (index === parts.length - 1) {
+                cursor[part] = entry.value;
+            }
+            else {
+                const nested = cursor[part];
+                if (typeof nested !== 'object' ||
+                    nested === null ||
+                    Array.isArray(nested)) {
+                    cursor[part] = {};
+                }
+                cursor = cursor[part];
+            }
+        }
+    }
+    return { value, source };
+}
 async function listConfigKeys(repoRoot, userConfigDir, dependencies) {
     const resolved = await dependencies.resolveEffectiveConfig(repoRoot, userConfigDir, dependencies.processEnv);
     const staticKeys = new Set(KEY_ORDER);

package/dist/commands/gate/__fixtures__/fake-runtime.d.mts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=fake-runtime.d.mts.map

package/dist/commands/gate/__fixtures__/fake-runtime.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-runtime.d.mts","sourceRoot":"","sources":["../../../../src/commands/gate/__fixtures__/fake-runtime.mjs"],"names":[],"mappings":""}

package/dist/commands/gate/__fixtures__/fake-runtime.mjs

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { writeSync } from 'node:fs';
+import { appendFile, mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const prompt = process.argv.at(-1) ?? '';
+const delayMs = Number(process.env.FAKE_GATE_DELAY_MS ?? '0');
+const exitCode = Number(process.env.FAKE_GATE_EXIT_CODE ?? '0');
+const artifactMode = process.env.FAKE_GATE_ARTIFACT ?? 'none';
+const transcriptIntervalMs = Number(process.env.FAKE_GATE_TRANSCRIPT_INTERVAL_MS ?? '0');
+function promptValue(key) {
+    return prompt.match(new RegExp(`^${key}: (.+)$`, 'm'))?.[1] ?? 'unknown';
+}
+function projectPath() {
+    return (prompt.match(/^Resolved OAT project path: (.+)\. Run the review/m)?.[1] ??
+        '.oat/projects/shared/demo');
+}
+async function writeTranscript() {
+    const encodedCwd = process.cwd().split(/[/.]/u).filter(Boolean).join('-');
+    const transcriptRoot = process.env.FAKE_GATE_TRANSCRIPT_DIR ??
+        join(process.env.HOME ?? '', '.cursor', 'projects', encodedCwd, 'agent-transcripts');
+    const transcript = join(transcriptRoot, 'fake-session', 'fake-session.jsonl');
+    await mkdir(join(transcript, '..'), { recursive: true });
+    await appendFile(transcript, `${Date.now()}\n`);
+}
+async function writeArtifact() {
+    const runId = artifactMode === 'wrong-run'
+        ? 'wrong-run-id'
+        : promptValue('oat_gate_run_id');
+    const project = projectPath();
+    const reviewsDir = join(process.cwd(), project, 'reviews');
+    await mkdir(reviewsDir, { recursive: true });
+    await writeFile(join(reviewsDir, `fake-review-${Date.now()}.md`), [
+        '---',
+        'oat_generated: true',
+        `oat_generated_at: ${new Date().toISOString()}`,
+        `oat_review_type: ${prompt.match(/^Review type: (.+)\.$/m)?.[1] ?? 'code'}`,
+        `oat_review_scope: ${prompt.match(/^Review scope: (.+)\.$/m)?.[1] ?? 'final'}`,
+        'oat_review_invocation: gate',
+        `oat_project: ${project}`,
+        `oat_gate_run_id: ${runId}`,
+        `oat_gate_target: ${promptValue('oat_gate_target')}`,
+        `oat_gate_runtime: ${promptValue('oat_gate_runtime')}`,
+        `oat_invocation_model: ${promptValue('oat_invocation_model')}`,
+        `oat_invocation_reasoning_effort: ${promptValue('oat_invocation_reasoning_effort')}`,
+        `oat_invocation_source: ${promptValue('oat_invocation_source')}`,
+        'oat_review_critical_count: 0',
+        'oat_review_important_count: 0',
+        'oat_review_medium_count: 0',
+        'oat_review_minor_count: 0',
+        '---',
+        '',
+        '# Fake runtime review',
+        '',
+        '## Findings',
+        '',
+        '### Critical',
+        '',
+        'None',
+        '',
+        '### Important',
+        '',
+        'None',
+        '',
+        '### Medium',
+        '',
+        'None',
+        '',
+        '### Minor',
+        '',
+        'None',
+        '',
+    ].join('\n'));
+}
+if (process.env.FAKE_GATE_REQUIRE_HEADLESS === '1') {
+    if (process.env.OAT_GATE_HEADLESS !== '1' ||
+        process.env.OAT_NON_INTERACTIVE !== '1' ||
+        !process.env.OAT_GATE_RUN_ID) {
+        process.stdout.write('OAT_GATE_REFUSAL: fake runtime did not receive headless context\n');
+        process.exit(9);
+    }
+}
+if (process.env.FAKE_GATE_WRITE_ROUTE_RECEIPT_RUNTIME &&
+    !process.env.FAKE_GATE_REQUIRE_ROUTE_RUNTIME) {
+    await writeFile(process.env.OAT_GATE_ROUTE_RECEIPT_PATH, JSON.stringify({
+        route: 'inline',
+        reason: 'deterministic fake route receipt',
+        cliRoot: process.env.OAT_GATE_CLI_ROOT,
+        runtime: process.env.FAKE_GATE_WRITE_ROUTE_RECEIPT_RUNTIME,
+    }));
+}
+if (process.env.FAKE_GATE_REQUIRE_ROUTE_RUNTIME) {
+    const cliPath = process.env.OAT_GATE_CLI_PATH;
+    const cliRoot = process.env.OAT_GATE_CLI_ROOT;
+    const configuredRuntime = process.env.FAKE_GATE_REQUIRE_ROUTE_RUNTIME;
+    const runtime = process.env.OAT_GATE_RUNTIME;
+    const model = process.env.OAT_INVOCATION_MODEL;
+    const promptRuntime = promptValue('oat_gate_runtime');
+    const promptModel = promptValue('oat_invocation_model');
+    if (!runtime ||
+        !model ||
+        runtime !== configuredRuntime ||
+        runtime !== promptRuntime ||
+        model !== promptModel) {
+        writeSync(1, `FAKE_GATE_ROUTE_INPUT_ERROR:${String(runtime)}:${String(model)}:${configuredRuntime}:${promptRuntime}:${promptModel}\n`);
+        process.stdout.write('OAT_GATE_REFUSAL: canonical gate route inputs were absent or inconsistent\n');
+        process.exit(10);
+    }
+    const marker = runtime === 'claude'
+        ? { CLAUDECODE: '1' }
+        : runtime === 'cursor'
+            ? { CURSOR_AGENT: '1' }
+            : { CODEX_SESSION_ID: 'fake-session' };
+    const result = cliPath
+        ? spawnSync(cliPath, [
+            'gate',
+            'route',
+            '--json',
+            '--expect-runtime',
+            runtime,
+            '--expect-model',
+            model,
+            '--can-await',
+            'false',
+        ], {
+            encoding: 'utf8',
+            env: { ...process.env, ...marker },
+        })
+        : undefined;
+    let route;
+    try {
+        route = result?.status === 0 ? JSON.parse(result.stdout) : undefined;
+    }
+    catch {
+        route = undefined;
+    }
+    if (route?.route !== 'inline' ||
+        route?.cliRoot !== cliRoot ||
+        typeof route?.reason !== 'string') {
+        writeSync(1, `FAKE_GATE_ROUTE_ERROR:${result?.status ?? 'absent'}:${JSON.stringify(result?.stdout ?? '')}:${JSON.stringify(result?.stderr ?? '')}:${String(route?.cliRoot)}:${String(cliRoot)}\n`);
+        process.stdout.write('OAT_GATE_REFUSAL: branch-local gate route was unavailable or invalid\n');
+        process.exit(10);
+    }
+    if (process.env.FAKE_GATE_REPORT_ROUTE === '1') {
+        process.stdout.write(`FAKE_GATE_ROUTE:${route.route}:${runtime}:${model}:${route.cliRoot}\n`);
+    }
+}
+if (process.env.FAKE_GATE_STDOUT) {
+    process.stdout.write(`${process.env.FAKE_GATE_STDOUT}\n`);
+}
+if (process.env.FAKE_GATE_REFUSAL) {
+    process.stdout.write(`OAT_GATE_REFUSAL: ${process.env.FAKE_GATE_REFUSAL}\n`);
+}
+let transcriptTimer;
+if (transcriptIntervalMs > 0) {
+    await writeTranscript();
+    transcriptTimer = setInterval(() => {
+        void writeTranscript();
+    }, transcriptIntervalMs);
+}
+await new Promise((resolve) => setTimeout(resolve, delayMs));
+if (transcriptTimer)
+    clearInterval(transcriptTimer);
+if (artifactMode === 'correlated' || artifactMode === 'wrong-run') {
+    await writeArtifact();
+}
+process.exit(exitCode);

package/dist/commands/gate/activity-probes.d.ts

@@ -0,0 +1,35 @@
+export interface GateActivityEvidence {
+    source: 'transcript-dir';
+    runtime: string;
+    scope: 'project-dir' | 'ambient-runtime';
+    observedPath: string;
+    lastChangeAt: number | null;
+    totalSizeBytes: number | null;
+    changedSinceBaseline: boolean;
+    observedAt: number;
+}
+export interface GateActivityProbeStatus {
+    status: 'available' | 'path-absent' | 'error';
+    runtime: string;
+    scope: 'project-dir' | 'ambient-runtime';
+    attemptedPath: string;
+    observedAt: number;
+    evidence?: GateActivityEvidence;
+}
+export interface GateActivityProbe {
+    runtime: 'claude' | 'codex' | 'cursor';
+    probe(observedAt?: number): Promise<GateActivityEvidence | null>;
+    observe(observedAt?: number): Promise<GateActivityProbeStatus>;
+}
+export interface GateActivityProbeContext {
+    runtime: string;
+    cwd: string;
+    home: string;
+    spawnedAt: number;
+    realCwd?: string;
+}
+export declare function encodeClaudeProjectPath(cwd: string): string;
+export declare function encodeCursorProjectPath(cwd: string): string;
+export declare function resolveGateActivityPaths(context: GateActivityProbeContext, observedAt?: number): string[];
+export declare function createGateActivityProbe(context: GateActivityProbeContext): Promise<GateActivityProbe | null>;
+//# sourceMappingURL=activity-probes.d.ts.map

package/dist/commands/gate/activity-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-probes.d.ts","sourceRoot":"","sources":["../../../src/commands/gate/activity-probes.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,GAAG,iBAAiB,CAAC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,GAAG,iBAAiB,CAAC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC;AAOD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACvC,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACjE,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAWD,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,EACjC,UAAU,SAAoB,GAC7B,MAAM,EAAE,CA6BV;AA+DD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAyDnC"}

package/dist/commands/gate/activity-probes.js

@@ -0,0 +1,135 @@
+import { readdir, realpath, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+const MAX_TRAVERSAL_DEPTH = 2;
+export function encodeClaudeProjectPath(cwd) {
+    return cwd.replace(/[/._]/gu, '-');
+}
+export function encodeCursorProjectPath(cwd) {
+    return cwd.split(/[/._]/u).filter(Boolean).join('-');
+}
+function utcDatePath(timestamp) {
+    const date = new Date(timestamp);
+    return [
+        String(date.getUTCFullYear()),
+        String(date.getUTCMonth() + 1).padStart(2, '0'),
+        String(date.getUTCDate()).padStart(2, '0'),
+    ];
+}
+export function resolveGateActivityPaths(context, observedAt = context.spawnedAt) {
+    const cwdVariants = [...new Set([context.cwd, context.realCwd])].filter((cwd) => Boolean(cwd));
+    if (context.runtime === 'claude') {
+        return cwdVariants.map((cwd) => join(context.home, '.claude', 'projects', encodeClaudeProjectPath(cwd)));
+    }
+    if (context.runtime === 'cursor') {
+        return cwdVariants.map((cwd) => join(context.home, '.cursor', 'projects', encodeCursorProjectPath(cwd), 'agent-transcripts'));
+    }
+    if (context.runtime === 'codex') {
+        const sessionsRoot = join(context.home, '.codex', 'sessions');
+        const paths = [
+            join(sessionsRoot, ...utcDatePath(context.spawnedAt)),
+            join(sessionsRoot, ...utcDatePath(observedAt)),
+        ];
+        return [...new Set(paths)];
+    }
+    return [];
+}
+async function collectMetadata(path, depth) {
+    const pathStat = await stat(path);
+    let lastChangeAt = pathStat.mtimeMs;
+    let totalSizeBytes = pathStat.size;
+    if (!pathStat.isDirectory() || depth >= MAX_TRAVERSAL_DEPTH) {
+        return { lastChangeAt, totalSizeBytes };
+    }
+    const entries = await readdir(path, { withFileTypes: true });
+    for (const entry of entries) {
+        const child = await collectMetadata(join(path, entry.name), depth + 1);
+        lastChangeAt = Math.max(lastChangeAt, child.lastChangeAt);
+        totalSizeBytes += child.totalSizeBytes;
+    }
+    return { lastChangeAt, totalSizeBytes };
+}
+async function snapshotPaths(paths) {
+    let found = false;
+    let lastChangeAt = 0;
+    let totalSizeBytes = 0;
+    try {
+        for (const path of paths) {
+            try {
+                const snapshot = await collectMetadata(path, 0);
+                found = true;
+                lastChangeAt = Math.max(lastChangeAt, snapshot.lastChangeAt);
+                totalSizeBytes += snapshot.totalSizeBytes;
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    'code' in error &&
+                    error.code === 'ENOENT') {
+                    continue;
+                }
+                return { status: 'error' };
+            }
+        }
+    }
+    catch {
+        return { status: 'error' };
+    }
+    return found
+        ? {
+            status: 'available',
+            snapshot: { lastChangeAt, totalSizeBytes },
+        }
+        : { status: 'path-absent' };
+}
+export async function createGateActivityProbe(context) {
+    const resolvedContext = {
+        ...context,
+        realCwd: await realpath(context.cwd).catch(() => context.cwd),
+    };
+    const initialPaths = resolveGateActivityPaths(resolvedContext);
+    if (initialPaths.length === 0)
+        return null;
+    const baseline = await snapshotPaths(initialPaths);
+    const scope = context.runtime === 'codex' ? 'ambient-runtime' : 'project-dir';
+    const observe = async (observedAt = Date.now()) => {
+        const paths = resolveGateActivityPaths(resolvedContext, observedAt);
+        const current = await snapshotPaths(paths);
+        const attemptedPath = paths.join(',');
+        if (current.status !== 'available' || !current.snapshot) {
+            return {
+                status: current.status,
+                runtime: context.runtime,
+                scope,
+                attemptedPath,
+                observedAt,
+            };
+        }
+        const evidence = {
+            source: 'transcript-dir',
+            runtime: context.runtime,
+            scope,
+            observedPath: attemptedPath,
+            lastChangeAt: current.snapshot.lastChangeAt,
+            totalSizeBytes: current.snapshot.totalSizeBytes,
+            changedSinceBaseline: baseline.status !== 'available' ||
+                !baseline.snapshot ||
+                current.snapshot.lastChangeAt !== baseline.snapshot.lastChangeAt ||
+                current.snapshot.totalSizeBytes !== baseline.snapshot.totalSizeBytes,
+            observedAt,
+        };
+        return {
+            status: 'available',
+            runtime: context.runtime,
+            scope,
+            attemptedPath,
+            observedAt,
+            evidence,
+        };
+    };
+    return {
+        runtime: context.runtime,
+        observe,
+        async probe(observedAt = Date.now()) {
+            return (await observe(observedAt)).evidence ?? null;
+        },
+    };
+}

package/dist/commands/gate/branch-local-cli.d.ts

@@ -0,0 +1,31 @@
+export interface GateCliLaunch {
+    command: string;
+    args: string[];
+    cwd?: string;
+}
+export interface BranchLocalGateCli {
+    cliPath: string;
+    cliRoot: string;
+    routeReceiptPath: string;
+    shimRoot: string;
+}
+export interface ValidatedGateRouteEnvelope {
+    route: 'inline' | 'delegate-sync' | 'refuse';
+    reason: string;
+    cliRoot: string;
+}
+export interface GateRouteReceipt extends ValidatedGateRouteEnvelope {
+    runtime: string;
+}
+export declare function currentGateCliRoot(): string;
+export declare function currentGateCliLaunch(): GateCliLaunch;
+export declare function createBranchLocalGateCli(input: {
+    runId: string;
+    launch: GateCliLaunch;
+    cliRoot?: string;
+    tempRoot?: string;
+}): Promise<BranchLocalGateCli>;
+export declare function removeBranchLocalGateCli(shim: BranchLocalGateCli): Promise<void>;
+export declare function validateGateRouteEnvelope(output: string, expectedCliRoot: string): ValidatedGateRouteEnvelope;
+export declare function readGateRouteReceipt(path: string, expectedCliRoot: string, expectedRuntime: string): Promise<GateRouteReceipt>;
+//# sourceMappingURL=branch-local-cli.d.ts.map

package/dist/commands/gate/branch-local-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-local-cli.d.ts","sourceRoot":"","sources":["../../../src/commands/gate/branch-local-cli.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,0BAA0B;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAUpD;AA4CD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+B9B;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,0BAA0B,CA2B5B;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAU3B"}

package/dist/commands/gate/branch-local-cli.js

@@ -0,0 +1,116 @@
+import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export function currentGateCliRoot() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), '../../../../..');
+}
+export function currentGateCliLaunch() {
+    const entrypoint = process.argv[1];
+    if (!entrypoint) {
+        throw new Error('Unable to resolve the running OAT CLI entrypoint.');
+    }
+    return {
+        command: process.execPath,
+        args: [...resolveCurrentLoaderArgs(process.execArgv), entrypoint],
+        cwd: process.cwd(),
+    };
+}
+function resolveCurrentLoaderArgs(args) {
+    const resolved = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === '--import' || argument === '--require') {
+            const specifier = args[index + 1];
+            resolved.push(argument);
+            if (specifier) {
+                resolved.push(resolveLoaderSpecifier(argument, specifier));
+                index += 1;
+            }
+            continue;
+        }
+        const inline = argument.match(/^(--import|--require)=(.+)$/);
+        if (inline) {
+            resolved.push(`${inline[1]}=${resolveLoaderSpecifier(inline[1], inline[2])}`);
+            continue;
+        }
+        resolved.push(argument);
+    }
+    return resolved;
+}
+function resolveLoaderSpecifier(flag, specifier) {
+    if (specifier.startsWith('/') ||
+        specifier.startsWith('.') ||
+        specifier.startsWith('file:')) {
+        return specifier;
+    }
+    try {
+        return flag === '--require'
+            ? createRequire(import.meta.url).resolve(specifier)
+            : import.meta.resolve(specifier);
+    }
+    catch {
+        return specifier;
+    }
+}
+export async function createBranchLocalGateCli(input) {
+    const cliRoot = input.cliRoot ?? currentGateCliRoot();
+    const shimRoot = join(input.tempRoot ?? tmpdir(), 'oat-gate-runs', input.runId);
+    const cliPath = join(shimRoot, 'bin', 'oat');
+    const routeReceiptPath = join(shimRoot, 'route-receipt.json');
+    await mkdir(dirname(cliPath), { recursive: true });
+    await writeFile(cliPath, [
+        '#!/usr/bin/env node',
+        "import { spawnSync } from 'node:child_process';",
+        `const command = ${JSON.stringify(input.launch.command)};`,
+        `const args = ${JSON.stringify(input.launch.args)};`,
+        'const result = spawnSync(command, [...args, ...process.argv.slice(2)], {',
+        "  stdio: 'inherit',",
+        '  env: process.env,',
+        `  cwd: ${JSON.stringify(input.launch.cwd)},`,
+        '});',
+        'if (result.error) {',
+        '  process.stderr.write(`${result.error.message}\\n`);',
+        '}',
+        'process.exit(result.status ?? 1);',
+        '',
+    ].join('\n'));
+    await chmod(cliPath, 0o700);
+    return { cliPath, cliRoot, routeReceiptPath, shimRoot };
+}
+export async function removeBranchLocalGateCli(shim) {
+    await rm(shim.shimRoot, { recursive: true, force: true });
+}
+export function validateGateRouteEnvelope(output, expectedCliRoot) {
+    let parsed;
+    try {
+        parsed = JSON.parse(output);
+    }
+    catch (error) {
+        throw new Error('Branch-local gate route did not return JSON.', {
+            cause: error,
+        });
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        throw new Error('Branch-local gate route returned no decision envelope.');
+    }
+    const envelope = parsed;
+    if (!['inline', 'delegate-sync', 'refuse'].includes(String(envelope.route)) ||
+        typeof envelope.reason !== 'string') {
+        throw new Error('Branch-local gate route returned help or an invalid decision envelope.');
+    }
+    if (envelope.cliRoot !== expectedCliRoot) {
+        throw new Error(`Branch-local gate route resolved outside the expected checkout (${String(envelope.cliRoot)} != ${expectedCliRoot}).`);
+    }
+    return envelope;
+}
+export async function readGateRouteReceipt(path, expectedCliRoot, expectedRuntime) {
+    const output = await readFile(path, 'utf8').catch(() => '');
+    const envelope = validateGateRouteEnvelope(output, expectedCliRoot);
+    const parsed = JSON.parse(output);
+    if (parsed.runtime !== expectedRuntime) {
+        throw new Error(`Branch-local gate route receipt runtime did not match (${String(parsed.runtime)} != ${expectedRuntime}).`);
+    }
+    return { ...envelope, runtime: expectedRuntime };
+}