@sema-agent/core 2.13.0 → 4.0.0

package/dist/tools/worktree.js

@@ -47,7 +47,9 @@ const EXIT_DESCRIPTION = "Exit a worktree session created by EnterWorktree and r
     "- The directory you're in if EnterWorktree was never called\n" +
     "\n" +
     "If called outside an EnterWorktree session, the tool is a no-op: it reports that no worktree session is " +
-    "active and takes no action. Filesystem state is unchanged.\n" +
+    "active and takes no action. Filesystem state is unchanged. The one exception is contradictory arguments " +
+    "(`keep: true` together with `discardChanges: true`), which are rejected before anything else, with or " +
+    "without an active session — that path changes nothing on disk either.\n" +
     "\n" +
     "## Behavior\n" +
     "\n" +
@@ -63,6 +65,16 @@ const EXIT_DESCRIPTION = "Exit a worktree session created by EnterWorktree and r
     "or the user asked to discard it); it cannot be combined with `keep: true`.\n" +
     "- Once exited, EnterWorktree can be called again to create a fresh worktree.";
 const shq = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+function reasonOf(e) {
+    if (e instanceof Error)
+        return e.message;
+    if (typeof e === "object" && e !== null) {
+        const m = e.message;
+        if (typeof m === "string" && m !== "")
+            return m;
+    }
+    return String(e);
+}
 async function resolveBaseCommit(env, repoRoot, baseRef) {
     const rev = async (ref) => {
         const r = await env.exec(`git rev-parse --verify --quiet ${shq(`${ref}^{commit}`)}`, { cwd: repoRoot });
@@ -123,89 +135,105 @@ export function createWorktreeTools(env, opts) {
                     "Use ExitWorktree to leave it before creating a new worktree, or pass `path` to switch into an " +
                     "existing worktree of this repository.");
             }
-            const probe = await env.exec("git rev-parse --is-inside-work-tree", { cwd: repoRoot });
-            if (!probe.ok || probe.value.exitCode !== 0) {
-                const detail = probe.ok ? (probe.value.stderr || probe.value.stdout).trim().split("\n")[0] : String(probe.error);
-                return errorResult(`Error (EnterWorktree): the working directory ${repoRoot} is not a git repository` +
-                    `${detail ? ` (${detail})` : ""}. This deployment has no VCS-agnostic worktree extension point, ` +
-                    "so worktree isolation is unavailable here.");
+            if (session.entering === true) {
+                return errorResult("Error (EnterWorktree): another EnterWorktree call on this session is already in progress — wait for it to " +
+                    "finish and then act on its result. Two concurrent entries would leave one worktree untracked and unremovable.");
             }
-            if (path !== undefined) {
-                const candidate = resolve(cwdRef.current, path);
-                const top = await env.exec("git rev-parse --show-toplevel", { cwd: candidate });
-                if (!top.ok || top.value.exitCode !== 0) {
-                    return errorResult(`Error (EnterWorktree): ${candidate} is not an accessible git worktree (cannot resolve its top-level directory).`);
-                }
-                const target = top.value.stdout.trim();
-                const list = await env.exec("git worktree list --porcelain", { cwd: repoRoot });
-                if (!list.ok || list.value.exitCode !== 0) {
-                    return errorResult("Error (EnterWorktree): could not read `git worktree list` for this repository.");
-                }
-                const registered = list.value.stdout
-                    .split("\n")
-                    .filter((l) => l.startsWith("worktree "))
-                    .map((l) => l.slice("worktree ".length).trim());
-                if (!registered.includes(target)) {
-                    return errorResult(`Error (EnterWorktree): ${target} is not a registered worktree of this repository ` +
-                        "(it does not appear in `git worktree list`).");
+            if (session.exiting === true) {
+                return errorResult("Error (EnterWorktree): an ExitWorktree call on this session is already in progress — wait for it to finish " +
+                    "before entering another worktree.");
+            }
+            session.entering = true;
+            try {
+                const probe = await env.exec("git rev-parse --is-inside-work-tree", { cwd: repoRoot });
+                if (!probe.ok || probe.value.exitCode !== 0) {
+                    const detail = probe.ok ? (probe.value.stderr || probe.value.stdout).trim().split("\n")[0] : String(probe.error);
+                    return errorResult(`Error (EnterWorktree): the working directory ${repoRoot} is not a git repository` +
+                        `${detail ? ` (${detail})` : ""}. This deployment has no VCS-agnostic worktree extension point, ` +
+                        "so worktree isolation is unavailable here.");
                 }
-                if (target === registered[0]) {
-                    return errorResult(`Error (EnterWorktree): ${target} is the main working tree, not a linked worktree — nothing to enter.`);
+                if (path !== undefined) {
+                    const candidate = resolve(cwdRef.current, path);
+                    const top = await env.exec("git rev-parse --show-toplevel", { cwd: candidate });
+                    if (!top.ok || top.value.exitCode !== 0) {
+                        return errorResult(`Error (EnterWorktree): ${candidate} is not an accessible git worktree (cannot resolve its top-level directory).`);
+                    }
+                    const target = top.value.stdout.trim();
+                    const list = await env.exec("git worktree list --porcelain", { cwd: repoRoot });
+                    if (!list.ok || list.value.exitCode !== 0) {
+                        return errorResult("Error (EnterWorktree): could not read `git worktree list` for this repository.");
+                    }
+                    const registered = list.value.stdout
+                        .split("\n")
+                        .filter((l) => l.startsWith("worktree "))
+                        .map((l) => l.slice("worktree ".length).trim());
+                    if (!registered.includes(target)) {
+                        return errorResult(`Error (EnterWorktree): ${target} is not a registered worktree of this repository ` +
+                            "(it does not appear in `git worktree list`).");
+                    }
+                    if (target === registered[0]) {
+                        return errorResult(`Error (EnterWorktree): ${target} is the main working tree, not a linked worktree — nothing to enter.`);
+                    }
+                    const rootCanon = await env.canonicalPath(repoRoot);
+                    const fence = rootCanon.ok ? rootCanon.value : repoRoot;
+                    if (target !== fence && !target.startsWith(fence.endsWith("/") ? fence : `${fence}/`)) {
+                        return errorResult(`Error (EnterWorktree): the worktree ${target} lives outside the task root ${repoRoot}; ` +
+                            "file containment stays anchored at the task root, so it cannot be entered from this session.");
+                    }
+                    const head = await env.exec("git rev-parse HEAD", { cwd: target });
+                    if (!head.ok || head.value.exitCode !== 0) {
+                        return errorResult(`Error (EnterWorktree): cannot resolve HEAD of the worktree ${target}.`);
+                    }
+                    const previous = session.current;
+                    const originalCwd = previous ? previous.originalCwd : cwdRef.current;
+                    session.current = { worktreeDir: target, originalCwd, baseSha: head.value.stdout.trim(), entered: true };
+                    cwdRef.current = target;
+                    return {
+                        content: `Switched into the existing worktree at ${target}${previous ? ` (the previous worktree at ${previous.worktreeDir} was left on disk, untouched)` : ""}. ` +
+                            "The session's working directory is now this worktree — subsequent commands and relative paths " +
+                            "operate there. Note this is a cwd switch, not a sandbox: file containment stays anchored at the " +
+                            "task root. ExitWorktree will restore the original directory but will NOT remove a worktree " +
+                            "entered via `path`.",
+                        details: { type: "worktree", action: "enter", worktreeDir: target },
+                    };
                 }
-                if (target !== repoRoot && !target.startsWith(repoRoot.endsWith("/") ? repoRoot : `${repoRoot}/`)) {
-                    return errorResult(`Error (EnterWorktree): the worktree ${target} lives outside the task root ${repoRoot}; ` +
-                        "file containment stays anchored at the task root, so it cannot be entered from this session.");
+                const base = await resolveBaseCommit(env, repoRoot, baseRef ?? "fresh");
+                if ("error" in base)
+                    return errorResult(`Error (EnterWorktree): ${base.error}.`);
+                let createdDir;
+                try {
+                    const { worktreeDir } = await addWorktree(env, {
+                        repoRoot,
+                        sessionId: name ?? "worktree",
+                        commit: base.sha,
+                        rootEnvAt: (dir) => Object.create(env, {
+                            cwd: { value: dir, configurable: true },
+                            destroy: { value: undefined, writable: true, configurable: true },
+                        }),
+                    });
+                    createdDir = worktreeDir;
                 }
-                const head = await env.exec("git rev-parse HEAD", { cwd: target });
-                if (!head.ok || head.value.exitCode !== 0) {
-                    return errorResult(`Error (EnterWorktree): cannot resolve HEAD of the worktree ${target}.`);
+                catch (e) {
+                    return errorResult(`Error (EnterWorktree): ${e instanceof Error ? e.message : String(e)}`);
                 }
-                const previous = session.current;
-                const originalCwd = previous ? previous.originalCwd : cwdRef.current;
-                session.current = { worktreeDir: target, originalCwd, baseSha: head.value.stdout.trim(), entered: true };
-                cwdRef.current = target;
+                session.current = {
+                    worktreeDir: createdDir,
+                    originalCwd: cwdRef.current,
+                    baseSha: base.sha,
+                };
+                cwdRef.current = createdDir;
                 return {
-                    content: `Switched into the existing worktree at ${target}${previous ? ` (the previous worktree at ${previous.worktreeDir} was left on disk, untouched)` : ""}. ` +
-                        "The session's working directory is now this worktree — subsequent commands and relative paths " +
+                    content: `Created worktree at ${createdDir} (base: ${base.label}${base.note ?? ""}). ` +
+                        "The session's working directory is now the worktree — subsequent commands and relative paths " +
                         "operate there. Note this is a cwd switch, not a sandbox: file containment stays anchored at the " +
-                        "task root. ExitWorktree will restore the original directory but will NOT remove a worktree " +
-                        "entered via `path`.",
-                    details: { type: "worktree", action: "enter", worktreeDir: target },
+                        "task root, so the rest of the repository remains reachable. " +
+                        "Use ExitWorktree to leave (an unchanged worktree is removed; a changed one is kept).",
+                    details: { type: "worktree", action: "create", worktreeDir: createdDir, base: base.label },
                 };
             }
-            const base = await resolveBaseCommit(env, repoRoot, baseRef ?? "fresh");
-            if ("error" in base)
-                return errorResult(`Error (EnterWorktree): ${base.error}.`);
-            let createdDir;
-            try {
-                const { worktreeDir } = await addWorktree(env, {
-                    repoRoot,
-                    sessionId: name ?? "worktree",
-                    commit: base.sha,
-                    rootEnvAt: (dir) => Object.create(env, {
-                        cwd: { value: dir, configurable: true },
-                        destroy: { value: undefined, writable: true, configurable: true },
-                    }),
-                });
-                createdDir = worktreeDir;
-            }
-            catch (e) {
-                return errorResult(`Error (EnterWorktree): ${e instanceof Error ? e.message : String(e)}`);
+            finally {
+                session.entering = false;
             }
-            session.current = {
-                worktreeDir: createdDir,
-                originalCwd: cwdRef.current,
-                baseSha: base.sha,
-            };
-            cwdRef.current = createdDir;
-            return {
-                content: `Created worktree at ${createdDir} (base: ${base.label}${base.note ?? ""}). ` +
-                    "The session's working directory is now the worktree — subsequent commands and relative paths " +
-                    "operate there. Note this is a cwd switch, not a sandbox: file containment stays anchored at the " +
-                    "task root, so the rest of the repository remains reachable. " +
-                    "Use ExitWorktree to leave (an unchanged worktree is removed; a changed one is kept).",
-                details: { type: "worktree", action: "create", worktreeDir: createdDir, base: base.label },
-            };
         },
     });
     const exit = defineTool({
@@ -239,86 +267,150 @@ export function createWorktreeTools(env, opts) {
                 return ("No-op: there is no active EnterWorktree session to exit. This tool only operates on the " +
                     "worktree created by EnterWorktree in this session; no filesystem changes were made.");
             }
-            const active = session.current;
-            session.current = undefined;
-            let restoredTo = active.originalCwd;
-            let restoreNote = "";
-            const origThere = await env.exists(active.originalCwd);
-            if (origThere.ok && !origThere.value) {
-                restoredTo = repoRoot;
-                restoreNote = ` (the original directory ${active.originalCwd} no longer exists — fell back to the repository root)`;
+            if (session.exiting === true) {
+                return errorResult("Error (ExitWorktree): an exit of this worktree session is already in progress — wait for it to finish. " +
+                    "Running a second exit now would race the same removal.");
             }
-            cwdRef.current = restoredTo;
-            if (active.entered) {
-                const discardNote = discardChanges === true ? " (`discardChanges` does not apply to a worktree this session did not create)" : "";
-                return {
-                    content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
-                        `The worktree at ${active.worktreeDir} was entered via \`path\` (not created by this session) and ` +
-                        `was left on disk, untouched${discardNote}.`,
-                    details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: true },
-                };
+            const active = session.current;
+            session.exiting = true;
+            try {
+                const outcome = await runExit(active, { keep, discardChanges, wantsRemove });
+                session.current = undefined;
+                return outcome;
             }
-            const wtThere = await env.exists(active.worktreeDir);
-            if (wtThere.ok && !wtThere.value) {
-                await pruneWorktrees(env, repoRoot).catch(() => undefined);
-                return {
-                    content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
-                        `The worktree at ${active.worktreeDir} was already gone from disk (removed externally, not by this ` +
-                        "session — any uncommitted work in it is lost); stale git worktree metadata was pruned.",
-                    details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: false },
-                };
+            catch (e) {
+                return errorResult(`Error (ExitWorktree): the exit failed before it could complete (${reasonOf(e)}). The worktree session at ` +
+                    `${active.worktreeDir} is still active and nothing was removed — retry ExitWorktree.`);
             }
-            let changed = true;
-            let changeDetail = "could not verify the worktree state — keeping it to be safe";
-            const status = await env.exec("git status --porcelain", { cwd: active.worktreeDir });
-            if (status.ok && status.value.exitCode === 0) {
-                const dirtyFiles = status.value.stdout.split("\n").filter((l) => l.trim() !== "").length;
-                const ahead = await env.exec(`git rev-list --count ${shq(`${active.baseSha}..HEAD`)}`, { cwd: active.worktreeDir });
-                const commits = ahead.ok && ahead.value.exitCode === 0 ? parseInt(ahead.value.stdout.trim(), 10) || 0 : -1;
-                if (commits >= 0) {
-                    changed = dirtyFiles > 0 || commits > 0;
-                    const parts = [];
-                    if (dirtyFiles > 0)
-                        parts.push(`${dirtyFiles} uncommitted ${dirtyFiles === 1 ? "file" : "files"}`);
-                    if (commits > 0)
-                        parts.push(`${commits} new ${commits === 1 ? "commit" : "commits"}`);
-                    changeDetail = parts.join(" and ");
-                }
+            finally {
+                session.exiting = false;
             }
-            if (keep === true || (changed && discardChanges !== true)) {
-                const why = keep === true ? "keep was requested" : `it has ${changeDetail}`;
-                const removeHint = wantsRemove && keep !== true
-                    ? " To remove it anyway and permanently discard these changes, re-invoke with discard_changes: true."
-                    : "";
+        },
+    });
+    async function runExit(active, opts2) {
+        const { keep, discardChanges, wantsRemove } = opts2;
+        let restoredTo = active.originalCwd;
+        let restoreNote = "";
+        const origThere = await env.exists(active.originalCwd);
+        if (origThere.ok && !origThere.value) {
+            restoredTo = repoRoot;
+            restoreNote = ` (the original directory ${active.originalCwd} no longer exists — fell back to the repository root)`;
+        }
+        else if (!origThere.ok) {
+            restoreNote = ` (whether ${active.originalCwd} still exists could not be verified: ${reasonOf(origThere.error)} — the directory was restored as-is)`;
+        }
+        cwdRef.current = restoredTo;
+        if (active.entered) {
+            const discardNote = discardChanges === true ? " (`discardChanges` does not apply to a worktree this session did not create)" : "";
+            const enteredThere = await env.exists(active.worktreeDir);
+            if (enteredThere.ok && !enteredThere.value) {
                 return {
                     content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
-                        `The worktree was KEPT at ${active.worktreeDir} (${why}) — inspect or merge it there, and remove it ` +
-                        "later with `git worktree remove` if no longer needed." +
-                        removeHint,
-                    details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: true },
+                        `The worktree at ${active.worktreeDir} was entered via \`path\` (not created by this session), so this ` +
+                        `session never touched it — but it is no longer on disk (removed by something else while it was entered)${discardNote}.`,
+                    details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: false },
                 };
             }
-            await env.exec(`git worktree remove --force ${shq(active.worktreeDir)}`, { cwd: repoRoot }).catch(() => undefined);
-            await pruneWorktrees(env, repoRoot).catch(() => undefined);
-            const stillThere = await env.exists(active.worktreeDir);
-            const detailForDiscard = changeDetail.startsWith("could not verify")
-                ? "changes that could not be enumerated"
-                : changeDetail;
-            const stateClause = changed ? `had ${detailForDiscard} (discarded — discardChanges was set)` : "had no changes";
-            if (stillThere.ok && stillThere.value) {
-                return {
-                    content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
-                        `The worktree at ${active.worktreeDir} ${changed ? "was marked for discard" : "had no changes"} but could NOT be removed — it is still on disk; ` +
-                        "remove it manually with `git worktree remove --force` if no longer needed.",
-                    details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: true },
-                };
+            const enteredUnverified = enteredThere.ok ? "" : ` (whether it is still on disk could not be verified: ${reasonOf(enteredThere.error)})`;
+            return {
+                content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
+                    `The worktree at ${active.worktreeDir} was entered via \`path\` (not created by this session) and ` +
+                    `was left on disk, untouched${enteredUnverified}${discardNote}.`,
+                details: {
+                    type: "worktree",
+                    action: "exit",
+                    worktreeDir: active.worktreeDir,
+                    ...(enteredThere.ok ? { kept: true } : {}),
+                },
+            };
+        }
+        const wtThere = await env.exists(active.worktreeDir);
+        if (wtThere.ok && !wtThere.value) {
+            const pruned = await pruneWorktrees(env, repoRoot);
+            return {
+                content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
+                    `The worktree at ${active.worktreeDir} was already gone from disk (removed externally, not by this ` +
+                    "session — any uncommitted work in it is lost); " +
+                    (pruned.ok
+                        ? "stale git worktree metadata was pruned."
+                        : `stale git worktree metadata could NOT be pruned (${pruned.detail}) — run \`git worktree prune\` in ${repoRoot} to clear the leftover registration.`),
+                details: {
+                    type: "worktree",
+                    action: "exit",
+                    worktreeDir: active.worktreeDir,
+                    kept: false,
+                    ...(pruned.ok ? {} : { metadataPruned: false }),
+                },
+            };
+        }
+        let changed = true;
+        let changeDetail = "could not verify the worktree state — keeping it to be safe";
+        const status = await env.exec("git status --porcelain", { cwd: active.worktreeDir });
+        if (status.ok && status.value.exitCode === 0) {
+            const dirtyFiles = status.value.stdout.split("\n").filter((l) => l.trim() !== "").length;
+            const ahead = await env.exec(`git rev-list --count ${shq(`${active.baseSha}..HEAD`)}`, { cwd: active.worktreeDir });
+            const commits = ahead.ok && ahead.value.exitCode === 0 ? parseInt(ahead.value.stdout.trim(), 10) || 0 : -1;
+            if (commits >= 0) {
+                changed = dirtyFiles > 0 || commits > 0;
+                const parts = [];
+                if (dirtyFiles > 0)
+                    parts.push(`${dirtyFiles} uncommitted ${dirtyFiles === 1 ? "file" : "files"}`);
+                if (commits > 0)
+                    parts.push(`${commits} new ${commits === 1 ? "commit" : "commits"}`);
+                changeDetail = parts.join(" and ");
             }
+        }
+        if (keep === true || (changed && discardChanges !== true)) {
+            const why = keep === true ? "keep was requested" : `it has ${changeDetail}`;
+            const removeHint = wantsRemove && keep !== true
+                ? " To remove it anyway and permanently discard these changes, re-invoke with discard_changes: true."
+                : "";
             return {
                 content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
-                    `The worktree at ${active.worktreeDir} ${stateClause} and was removed.`,
-                details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: false },
+                    `The worktree was KEPT at ${active.worktreeDir} (${why}) — inspect or merge it there, and remove it ` +
+                    "later with `git worktree remove` if no longer needed." +
+                    removeHint,
+                details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: true },
             };
-        },
-    });
+        }
+        const removeFailure = await env
+            .exec(`git worktree remove --force ${shq(active.worktreeDir)}`, { cwd: repoRoot })
+            .then((r) => r.ok && r.value.exitCode === 0
+            ? undefined
+            : r.ok
+                ? (r.value.stderr || r.value.stdout || `exit ${r.value.exitCode}`).trim()
+                : reasonOf(r.error), (e) => reasonOf(e));
+        const pruned = await pruneWorktrees(env, repoRoot);
+        const stillThere = await env.exists(active.worktreeDir);
+        const removalNote = removeFailure !== undefined ? ` (the removal command reported: ${removeFailure})` : "";
+        const pruneNote = pruned.ok ? "" : ` (stale git worktree metadata could NOT be pruned: ${pruned.detail} — run \`git worktree prune\` in ${repoRoot})`;
+        const pruneDetail = pruned.ok ? {} : { metadataPruned: false };
+        const detailForDiscard = changeDetail.startsWith("could not verify")
+            ? "changes that could not be enumerated"
+            : changeDetail;
+        const stateClause = changed ? `had ${detailForDiscard} (discarded — discardChanges was set)` : "had no changes";
+        if (stillThere.ok && stillThere.value) {
+            return {
+                content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
+                    `The worktree at ${active.worktreeDir} ${changed ? "was marked for discard" : "had no changes"} but could NOT be removed — it is still on disk${removalNote}${pruneNote}; ` +
+                    "remove it manually with `git worktree remove --force` if no longer needed.",
+                details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: true, ...pruneDetail },
+            };
+        }
+        if (!stillThere.ok) {
+            return {
+                content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
+                    `The worktree at ${active.worktreeDir} ${stateClause}, and its removal was attempted but could NOT be verified ` +
+                    `(${reasonOf(stillThere.error)})${removalNote}${pruneNote} — check ${active.worktreeDir} and remove it manually with ` +
+                    "`git worktree remove --force` if it is still there.",
+                details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, ...pruneDetail },
+            };
+        }
+        return {
+            content: `Exited the worktree session; working directory restored to ${restoredTo}${restoreNote}. ` +
+                `The worktree at ${active.worktreeDir} ${stateClause} and was removed.${removalNote}${pruneNote}`,
+            details: { type: "worktree", action: "exit", worktreeDir: active.worktreeDir, kept: false, ...pruneDetail },
+        };
+    }
     return [enter, exit];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/core",
-  "version": "2.13.0",
+  "version": "4.0.0",
   "description": "Stateless, task-oriented AI agent core",
   "type": "module",
   "license": "BUSL-1.1",
@@ -41,6 +41,7 @@
     "dist",
     "README.md",
     "NOTICE.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "engines": {
@@ -57,7 +58,13 @@
     "eval": "tsx eval/run.ts",
     "prepare": "npm run build",
     "prepublishOnly": "npm run build && npm run test",
-    "gate:blackbox": "node scripts/run-blackbox-gate.mjs"
+    "gate:blackbox": "node scripts/run-blackbox-gate.mjs",
+    "gate:ledger": "node scripts/verify-hardening-ledger.mjs",
+    "gate:compensation": "node scripts/verify-compensation-registry.mjs",
+    "gate:message-branching": "node scripts/verify-no-message-branching.mjs",
+    "gate:failloud": "node scripts/verify-failloud.mjs",
+    "gate:domain-lexicon": "node scripts/verify-domain-lexicon.mjs",
+    "gate:single-mint": "node scripts/verify-single-mint.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.29.0",