@specforge/canary-cli 0.1.12 → 0.1.14

package/dist/tools/core/git-injection.d.ts

@@ -19,6 +19,14 @@ export interface WorktreeGitEvidence {
  * agent is not inside a git worktree, so SWS still records the WorkSession.
  */
 export declare function readWorktreeGitEvidence(run?: GitRunner): WorktreeGitEvidence;
+/**
+ * The worktree HEAD commit hash (`git rev-parse HEAD`), or `null` when not inside a
+ * git worktree or the repo has no commit yet. The MCP-local reads this on
+ * `complete_work_session` and binds it as `WorkSession.commitSha` — the per-session
+ * commit proof the CWS git-evidence gate requires to finalize (M23.2). The deployed
+ * Lambda has no worktree, so only this CLI can observe it.
+ */
+export declare function readHeadCommitSha(run?: GitRunner): string | null;
 /** One injected file-change action (a subset of the AWS `record_file_change` payload). */
 export interface LocalFileChangeAction {
     action: 'record_file_change';

package/dist/tools/core/git-injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-injection.d.ts","sourceRoot":"","sources":["../../../src/tools/core/git-injection.ts"],"names":[],"mappings":"AA2BA,kFAAkF;AAClF,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,IAAI,CAAC;AAE1D,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,SAU9B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,sFAAsF;IACtF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,SAA4B,GAAG,mBAAmB,CAc9F;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC/C,YAAY,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IACjD,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,UAAU,SAAS;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,GAAG,EAAE,SAAS,GACb,qBAAqB,EAAE,CA4BzB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,GAAE,SAA4B,GAAG,qBAAqB,EAAE,CAE/G"}
+{"version":3,"file":"git-injection.d.ts","sourceRoot":"","sources":["../../../src/tools/core/git-injection.ts"],"names":[],"mappings":"AA2BA,kFAAkF;AAClF,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,IAAI,CAAC;AAE1D,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,SAU9B,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,sFAAsF;IACtF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yFAAyF;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,SAA4B,GAAG,mBAAmB,CAc9F;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,SAA4B,GAAG,MAAM,GAAG,IAAI,CAGlF;AAED,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC/C,YAAY,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IACjD,MAAM,EAAE,SAAS,CAAC;CACnB;AAED,UAAU,SAAS;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,GAAG,EAAE,SAAS,GACb,qBAAqB,EAAE,CA4BzB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,GAAE,SAA4B,GAAG,qBAAqB,EAAE,CAE/G"}

package/dist/tools/core/git-injection.js

@@ -24,6 +24,10 @@ function readWorktreeGitEvidence(run = defaultGitRunner) {
     branch: branch === null || branch === "" ? null : branch
   };
 }
+function readHeadCommitSha(run = defaultGitRunner) {
+  const sha = run(["rev-parse", "HEAD"]);
+  return sha === null || sha === "" ? null : sha;
+}
 function deriveLocalFileChanges(statusPorcelain, ctx) {
   if (!statusPorcelain) return [];
   const actions = [];
@@ -68,6 +72,7 @@ function classifyPorcelain(xy) {
 export {
   defaultGitRunner,
   deriveLocalFileChanges,
+  readHeadCommitSha,
   readLocalFileChanges,
   readWorktreeGitEvidence
 };

package/dist/tools/core/git-injection.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/tools/core/git-injection.ts"],"sourcesContent":["/**\n * MCP-local git-evidence injection (M23.2).\n *\n * The work lifecycle's SWS/AWS verbs need worktree git evidence that only the\n * MCP-LOCAL (this CLI, running on the agent's machine — the deployed Lambda has\n * NO worktree) can observe. Per `docs/architecture/work-lifecycle-flow.md` §0 +\n * [[project_coherence_score]]:\n *\n *  - **SWS** (`start_work_session`): runs `git status` for the clean-workspace\n *    precondition (`gitClean`) and reports the worktree provenance —\n *    `worktreePath` via `git rev-parse --show-toplevel` + `branch` via\n *    `git rev-parse --abbrev-ref HEAD` — so SWS persists\n *    `WorkSession.worktreePath`/`branch` (M16.2). When the agent is NOT inside a\n *    git worktree (\"caso esteja em uma\") the provenance is `null` (SWS still\n *    records the WorkSession) and `gitClean` defaults to `true` (a non-git caller\n *    is never \"dirty\" — it must not be blocked by the precondition).\n *  - **AWS** (`action_work_session`, `validateFiles: 'local'`): runs\n *    `git status --porcelain` and injects one `record_file_change` action per\n *    created/modified/deleted file (the agent only reports the `referenced`\n *    files git cannot see).\n *\n * The git commands run through an injectable `GitRunner` (defaults to a real,\n * non-throwing `git` spawn) so the layer is unit-testable without a live repo and\n * never throws inside a tool handler.\n */\nimport { execFileSync } from 'node:child_process';\n\n/** Runs a `git` sub-command; returns trimmed stdout, or `null` on any failure. */\nexport type GitRunner = (args: string[]) => string | null;\n\n/** Default runner: spawn `git`, return trimmed stdout, `null` on any failure. */\nexport const defaultGitRunner: GitRunner = (args) => {\n  try {\n    const out = execFileSync('git', args, {\n      encoding: 'utf8',\n      stdio: ['ignore', 'pipe', 'ignore'],\n    });\n    return out.trim();\n  } catch {\n    return null;\n  }\n};\n\nexport interface WorktreeGitEvidence {\n  /**\n   * `true` when the worktree has no uncommitted changes — OR when the caller is\n   * not inside a git repo (a non-git caller is never \"dirty\", so SWS still runs).\n   */\n  gitClean: boolean;\n  /** Worktree root (`git rev-parse --show-toplevel`); `null` when not in a worktree. */\n  worktreePath: string | null;\n  /** Current branch (`git rev-parse --abbrev-ref HEAD`); `null` when not in a worktree. */\n  branch: string | null;\n}\n\n/**\n * SWS git evidence — the clean-status precondition input + the worktree\n * provenance (M23.2). Emits `null` provenance (and `gitClean: true`) when the\n * agent is not inside a git worktree, so SWS still records the WorkSession.\n */\nexport function readWorktreeGitEvidence(run: GitRunner = defaultGitRunner): WorktreeGitEvidence {\n  const worktreePath = run(['rev-parse', '--show-toplevel']);\n  if (worktreePath === null || worktreePath === '') {\n    // Not inside a git worktree — SWS still records the WorkSession.\n    return { gitClean: true, worktreePath: null, branch: null };\n  }\n  const branch = run(['rev-parse', '--abbrev-ref', 'HEAD']);\n  const status = run(['status', '--porcelain']);\n  return {\n    // A failed `git status` (null) must not block SWS → treat as clean.\n    gitClean: status === null ? true : status.trim() === '',\n    worktreePath,\n    branch: branch === null || branch === '' ? null : branch,\n  };\n}\n\n/** One injected file-change action (a subset of the AWS `record_file_change` payload). */\nexport interface LocalFileChangeAction {\n  action: 'record_file_change';\n  workSessionId: string;\n  ticketId: string;\n  expectedPath: string;\n  expectedAction: 'create' | 'modify' | 'delete';\n  actualAction: 'created' | 'modified' | 'deleted';\n  status: 'matched';\n}\n\ninterface DeriveCtx {\n  workSessionId: string;\n  ticketId: string;\n}\n\n/**\n * Parse `git status --porcelain` into the `record_file_change` set the MCP-local\n * injects in `validateFiles: 'local'` mode — one action per created/modified/\n * deleted path (the agent reports the `referenced` files itself). A rename (`R`)\n * surfaces as a create of the new path.\n */\nexport function deriveLocalFileChanges(\n  statusPorcelain: string | null,\n  ctx: DeriveCtx,\n): LocalFileChangeAction[] {\n  if (!statusPorcelain) return [];\n  const actions: LocalFileChangeAction[] = [];\n  for (const raw of statusPorcelain.split('\\n')) {\n    const line = raw.replace(/\\r$/, '');\n    if (line.trim() === '') continue;\n    // porcelain v1: `XY<space>path` — XY is the 2-char status, path starts at col 3.\n    const xy = line.slice(0, 2);\n    let path = line.slice(3).trim();\n    // Rename/copy renders as `old -> new`; record the new path.\n    const arrow = path.indexOf(' -> ');\n    if (arrow >= 0) path = path.slice(arrow + 4).trim();\n    // git quotes paths with special chars.\n    if (path.startsWith('\"') && path.endsWith('\"')) path = path.slice(1, -1);\n    if (path === '') continue;\n    const kind = classifyPorcelain(xy);\n    if (!kind) continue;\n    actions.push({\n      action: 'record_file_change',\n      workSessionId: ctx.workSessionId,\n      ticketId: ctx.ticketId,\n      expectedPath: path,\n      expectedAction: kind.expected,\n      actualAction: kind.actual,\n      status: 'matched',\n    });\n  }\n  return actions;\n}\n\n/**\n * Read the worktree's changed-file set (`git status --porcelain`) and map it to\n * the `record_file_change` actions the MCP-local injects (AWS `validateFiles:\n * 'local'`). Empty when not inside a git worktree.\n */\nexport function readLocalFileChanges(ctx: DeriveCtx, run: GitRunner = defaultGitRunner): LocalFileChangeAction[] {\n  return deriveLocalFileChanges(run(['status', '--porcelain']), ctx);\n}\n\nfunction classifyPorcelain(\n  xy: string,\n): { expected: 'create' | 'modify' | 'delete'; actual: 'created' | 'modified' | 'deleted' } | null {\n  const s = xy.trim();\n  if (s === '') return null;\n  // Untracked / added / renamed / copied → a new (created) file.\n  if (s === '??' || s.includes('A') || s.includes('R') || s.includes('C')) {\n    return { expected: 'create', actual: 'created' };\n  }\n  if (s.includes('D')) return { expected: 'delete', actual: 'deleted' };\n  if (s.includes('M') || s.includes('T') || s.includes('U')) {\n    return { expected: 'modify', actual: 'modified' };\n  }\n  return null;\n}\n"],"mappings":"AAyBA,SAAS,oBAAoB;AAMtB,MAAM,mBAA8B,CAAC,SAAS;AACnD,MAAI;AACF,UAAM,MAAM,aAAa,OAAO,MAAM;AAAA,MACpC,UAAU;AAAA,MACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACpC,CAAC;AACD,WAAO,IAAI,KAAK;AAAA,EAClB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmBO,SAAS,wBAAwB,MAAiB,kBAAuC;AAC9F,QAAM,eAAe,IAAI,CAAC,aAAa,iBAAiB,CAAC;AACzD,MAAI,iBAAiB,QAAQ,iBAAiB,IAAI;AAEhD,WAAO,EAAE,UAAU,MAAM,cAAc,MAAM,QAAQ,KAAK;AAAA,EAC5D;AACA,QAAM,SAAS,IAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAM,SAAS,IAAI,CAAC,UAAU,aAAa,CAAC;AAC5C,SAAO;AAAA;AAAA,IAEL,UAAU,WAAW,OAAO,OAAO,OAAO,KAAK,MAAM;AAAA,IACrD;AAAA,IACA,QAAQ,WAAW,QAAQ,WAAW,KAAK,OAAO;AAAA,EACpD;AACF;AAwBO,SAAS,uBACd,iBACA,KACyB;AACzB,MAAI,CAAC,gBAAiB,QAAO,CAAC;AAC9B,QAAM,UAAmC,CAAC;AAC1C,aAAW,OAAO,gBAAgB,MAAM,IAAI,GAAG;AAC7C,UAAM,OAAO,IAAI,QAAQ,OAAO,EAAE;AAClC,QAAI,KAAK,KAAK,MAAM,GAAI;AAExB,UAAM,KAAK,KAAK,MAAM,GAAG,CAAC;AAC1B,QAAI,OAAO,KAAK,MAAM,CAAC,EAAE,KAAK;AAE9B,UAAM,QAAQ,KAAK,QAAQ,MAAM;AACjC,QAAI,SAAS,EAAG,QAAO,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK;AAElD,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AACvE,QAAI,SAAS,GAAI;AACjB,UAAM,OAAO,kBAAkB,EAAE;AACjC,QAAI,CAAC,KAAM;AACX,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,eAAe,IAAI;AAAA,MACnB,UAAU,IAAI;AAAA,MACd,cAAc;AAAA,MACd,gBAAgB,KAAK;AAAA,MACrB,cAAc,KAAK;AAAA,MACnB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOO,SAAS,qBAAqB,KAAgB,MAAiB,kBAA2C;AAC/G,SAAO,uBAAuB,IAAI,CAAC,UAAU,aAAa,CAAC,GAAG,GAAG;AACnE;AAEA,SAAS,kBACP,IACiG;AACjG,QAAM,IAAI,GAAG,KAAK;AAClB,MAAI,MAAM,GAAI,QAAO;AAErB,MAAI,MAAM,QAAQ,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG;AACvE,WAAO,EAAE,UAAU,UAAU,QAAQ,UAAU;AAAA,EACjD;AACA,MAAI,EAAE,SAAS,GAAG,EAAG,QAAO,EAAE,UAAU,UAAU,QAAQ,UAAU;AACpE,MAAI,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG;AACzD,WAAO,EAAE,UAAU,UAAU,QAAQ,WAAW;AAAA,EAClD;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../src/tools/core/git-injection.ts"],"sourcesContent":["/**\n * MCP-local git-evidence injection (M23.2).\n *\n * The work lifecycle's SWS/AWS verbs need worktree git evidence that only the\n * MCP-LOCAL (this CLI, running on the agent's machine — the deployed Lambda has\n * NO worktree) can observe. Per `docs/architecture/work-lifecycle-flow.md` §0 +\n * [[project_coherence_score]]:\n *\n *  - **SWS** (`start_work_session`): runs `git status` for the clean-workspace\n *    precondition (`gitClean`) and reports the worktree provenance —\n *    `worktreePath` via `git rev-parse --show-toplevel` + `branch` via\n *    `git rev-parse --abbrev-ref HEAD` — so SWS persists\n *    `WorkSession.worktreePath`/`branch` (M16.2). When the agent is NOT inside a\n *    git worktree (\"caso esteja em uma\") the provenance is `null` (SWS still\n *    records the WorkSession) and `gitClean` defaults to `true` (a non-git caller\n *    is never \"dirty\" — it must not be blocked by the precondition).\n *  - **AWS** (`action_work_session`, `validateFiles: 'local'`): runs\n *    `git status --porcelain` and injects one `record_file_change` action per\n *    created/modified/deleted file (the agent only reports the `referenced`\n *    files git cannot see).\n *\n * The git commands run through an injectable `GitRunner` (defaults to a real,\n * non-throwing `git` spawn) so the layer is unit-testable without a live repo and\n * never throws inside a tool handler.\n */\nimport { execFileSync } from 'node:child_process';\n\n/** Runs a `git` sub-command; returns trimmed stdout, or `null` on any failure. */\nexport type GitRunner = (args: string[]) => string | null;\n\n/** Default runner: spawn `git`, return trimmed stdout, `null` on any failure. */\nexport const defaultGitRunner: GitRunner = (args) => {\n  try {\n    const out = execFileSync('git', args, {\n      encoding: 'utf8',\n      stdio: ['ignore', 'pipe', 'ignore'],\n    });\n    return out.trim();\n  } catch {\n    return null;\n  }\n};\n\nexport interface WorktreeGitEvidence {\n  /**\n   * `true` when the worktree has no uncommitted changes — OR when the caller is\n   * not inside a git repo (a non-git caller is never \"dirty\", so SWS still runs).\n   */\n  gitClean: boolean;\n  /** Worktree root (`git rev-parse --show-toplevel`); `null` when not in a worktree. */\n  worktreePath: string | null;\n  /** Current branch (`git rev-parse --abbrev-ref HEAD`); `null` when not in a worktree. */\n  branch: string | null;\n}\n\n/**\n * SWS git evidence — the clean-status precondition input + the worktree\n * provenance (M23.2). Emits `null` provenance (and `gitClean: true`) when the\n * agent is not inside a git worktree, so SWS still records the WorkSession.\n */\nexport function readWorktreeGitEvidence(run: GitRunner = defaultGitRunner): WorktreeGitEvidence {\n  const worktreePath = run(['rev-parse', '--show-toplevel']);\n  if (worktreePath === null || worktreePath === '') {\n    // Not inside a git worktree — SWS still records the WorkSession.\n    return { gitClean: true, worktreePath: null, branch: null };\n  }\n  const branch = run(['rev-parse', '--abbrev-ref', 'HEAD']);\n  const status = run(['status', '--porcelain']);\n  return {\n    // A failed `git status` (null) must not block SWS → treat as clean.\n    gitClean: status === null ? true : status.trim() === '',\n    worktreePath,\n    branch: branch === null || branch === '' ? null : branch,\n  };\n}\n\n/**\n * The worktree HEAD commit hash (`git rev-parse HEAD`), or `null` when not inside a\n * git worktree or the repo has no commit yet. The MCP-local reads this on\n * `complete_work_session` and binds it as `WorkSession.commitSha` — the per-session\n * commit proof the CWS git-evidence gate requires to finalize (M23.2). The deployed\n * Lambda has no worktree, so only this CLI can observe it.\n */\nexport function readHeadCommitSha(run: GitRunner = defaultGitRunner): string | null {\n  const sha = run(['rev-parse', 'HEAD']);\n  return sha === null || sha === '' ? null : sha;\n}\n\n/** One injected file-change action (a subset of the AWS `record_file_change` payload). */\nexport interface LocalFileChangeAction {\n  action: 'record_file_change';\n  workSessionId: string;\n  ticketId: string;\n  expectedPath: string;\n  expectedAction: 'create' | 'modify' | 'delete';\n  actualAction: 'created' | 'modified' | 'deleted';\n  status: 'matched';\n}\n\ninterface DeriveCtx {\n  workSessionId: string;\n  ticketId: string;\n}\n\n/**\n * Parse `git status --porcelain` into the `record_file_change` set the MCP-local\n * injects in `validateFiles: 'local'` mode — one action per created/modified/\n * deleted path (the agent reports the `referenced` files itself). A rename (`R`)\n * surfaces as a create of the new path.\n */\nexport function deriveLocalFileChanges(\n  statusPorcelain: string | null,\n  ctx: DeriveCtx,\n): LocalFileChangeAction[] {\n  if (!statusPorcelain) return [];\n  const actions: LocalFileChangeAction[] = [];\n  for (const raw of statusPorcelain.split('\\n')) {\n    const line = raw.replace(/\\r$/, '');\n    if (line.trim() === '') continue;\n    // porcelain v1: `XY<space>path` — XY is the 2-char status, path starts at col 3.\n    const xy = line.slice(0, 2);\n    let path = line.slice(3).trim();\n    // Rename/copy renders as `old -> new`; record the new path.\n    const arrow = path.indexOf(' -> ');\n    if (arrow >= 0) path = path.slice(arrow + 4).trim();\n    // git quotes paths with special chars.\n    if (path.startsWith('\"') && path.endsWith('\"')) path = path.slice(1, -1);\n    if (path === '') continue;\n    const kind = classifyPorcelain(xy);\n    if (!kind) continue;\n    actions.push({\n      action: 'record_file_change',\n      workSessionId: ctx.workSessionId,\n      ticketId: ctx.ticketId,\n      expectedPath: path,\n      expectedAction: kind.expected,\n      actualAction: kind.actual,\n      status: 'matched',\n    });\n  }\n  return actions;\n}\n\n/**\n * Read the worktree's changed-file set (`git status --porcelain`) and map it to\n * the `record_file_change` actions the MCP-local injects (AWS `validateFiles:\n * 'local'`). Empty when not inside a git worktree.\n */\nexport function readLocalFileChanges(ctx: DeriveCtx, run: GitRunner = defaultGitRunner): LocalFileChangeAction[] {\n  return deriveLocalFileChanges(run(['status', '--porcelain']), ctx);\n}\n\nfunction classifyPorcelain(\n  xy: string,\n): { expected: 'create' | 'modify' | 'delete'; actual: 'created' | 'modified' | 'deleted' } | null {\n  const s = xy.trim();\n  if (s === '') return null;\n  // Untracked / added / renamed / copied → a new (created) file.\n  if (s === '??' || s.includes('A') || s.includes('R') || s.includes('C')) {\n    return { expected: 'create', actual: 'created' };\n  }\n  if (s.includes('D')) return { expected: 'delete', actual: 'deleted' };\n  if (s.includes('M') || s.includes('T') || s.includes('U')) {\n    return { expected: 'modify', actual: 'modified' };\n  }\n  return null;\n}\n"],"mappings":"AAyBA,SAAS,oBAAoB;AAMtB,MAAM,mBAA8B,CAAC,SAAS;AACnD,MAAI;AACF,UAAM,MAAM,aAAa,OAAO,MAAM;AAAA,MACpC,UAAU;AAAA,MACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACpC,CAAC;AACD,WAAO,IAAI,KAAK;AAAA,EAClB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmBO,SAAS,wBAAwB,MAAiB,kBAAuC;AAC9F,QAAM,eAAe,IAAI,CAAC,aAAa,iBAAiB,CAAC;AACzD,MAAI,iBAAiB,QAAQ,iBAAiB,IAAI;AAEhD,WAAO,EAAE,UAAU,MAAM,cAAc,MAAM,QAAQ,KAAK;AAAA,EAC5D;AACA,QAAM,SAAS,IAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAM,SAAS,IAAI,CAAC,UAAU,aAAa,CAAC;AAC5C,SAAO;AAAA;AAAA,IAEL,UAAU,WAAW,OAAO,OAAO,OAAO,KAAK,MAAM;AAAA,IACrD;AAAA,IACA,QAAQ,WAAW,QAAQ,WAAW,KAAK,OAAO;AAAA,EACpD;AACF;AASO,SAAS,kBAAkB,MAAiB,kBAAiC;AAClF,QAAM,MAAM,IAAI,CAAC,aAAa,MAAM,CAAC;AACrC,SAAO,QAAQ,QAAQ,QAAQ,KAAK,OAAO;AAC7C;AAwBO,SAAS,uBACd,iBACA,KACyB;AACzB,MAAI,CAAC,gBAAiB,QAAO,CAAC;AAC9B,QAAM,UAAmC,CAAC;AAC1C,aAAW,OAAO,gBAAgB,MAAM,IAAI,GAAG;AAC7C,UAAM,OAAO,IAAI,QAAQ,OAAO,EAAE;AAClC,QAAI,KAAK,KAAK,MAAM,GAAI;AAExB,UAAM,KAAK,KAAK,MAAM,GAAG,CAAC;AAC1B,QAAI,OAAO,KAAK,MAAM,CAAC,EAAE,KAAK;AAE9B,UAAM,QAAQ,KAAK,QAAQ,MAAM;AACjC,QAAI,SAAS,EAAG,QAAO,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK;AAElD,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AACvE,QAAI,SAAS,GAAI;AACjB,UAAM,OAAO,kBAAkB,EAAE;AACjC,QAAI,CAAC,KAAM;AACX,YAAQ,KAAK;AAAA,MACX,QAAQ;AAAA,MACR,eAAe,IAAI;AAAA,MACnB,UAAU,IAAI;AAAA,MACd,cAAc;AAAA,MACd,gBAAgB,KAAK;AAAA,MACrB,cAAc,KAAK;AAAA,MACnB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOO,SAAS,qBAAqB,KAAgB,MAAiB,kBAA2C;AAC/G,SAAO,uBAAuB,IAAI,CAAC,UAAU,aAAa,CAAC,GAAG,GAAG;AACnE;AAEA,SAAS,kBACP,IACiG;AACjG,QAAM,IAAI,GAAG,KAAK;AAClB,MAAI,MAAM,GAAI,QAAO;AAErB,MAAI,MAAM,QAAQ,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG;AACvE,WAAO,EAAE,UAAU,UAAU,QAAQ,UAAU;AAAA,EACjD;AACA,MAAI,EAAE,SAAS,GAAG,EAAG,QAAO,EAAE,UAAU,UAAU,QAAQ,UAAU;AACpE,MAAI,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,SAAS,GAAG,GAAG;AACzD,WAAO,EAAE,UAAU,UAAU,QAAQ,WAAW;AAAA,EAClD;AACA,SAAO;AACT;","names":[]}

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAML,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAUhC;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,IAAI,IAAI,EAAE,CA4nCjC;AAED;;GAEG;AACH,KAAK,WAAW,GAAG,CACjB,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;AA6EtB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,GACnB,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAoT7B;AAiBD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,GAAE,OAAe,GACrB,OAAO,CAAC,OAAO,CAAC,CA4DlB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,GAAE,OAAe,GACrB,OAAO,CAAC,OAAO,GAAG,gBAAgB,CAAC,CAOrC;AAGD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAML,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAUhC;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,IAAI,IAAI,EAAE,CA4nCjC;AAED;;GAEG;AACH,KAAK,WAAW,GAAG,CACjB,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;AA6EtB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,GACnB,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAyU7B;AAiBD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,GAAE,OAAe,GACrB,OAAO,CAAC,OAAO,CAAC,CA4DlB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,KAAK,GAAE,OAAe,GACrB,OAAO,CAAC,OAAO,GAAG,gBAAgB,CAAC,CAOrC;AAGD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/tools/index.js

@@ -1,3 +1,4 @@
+import { appendFileSync } from "node:fs";
 import {
   ValidationError,
   ApiError,
@@ -7,7 +8,7 @@ import {
 } from "../validation/index.js";
 import { injectContext, injectContextRequired } from "./core/context-helper.js";
 import { probeExistingFiles } from "./core/file-existence-injection.js";
-import { readWorktreeGitEvidence } from "./core/git-injection.js";
+import { readWorktreeGitEvidence, readHeadCommitSha } from "./core/git-injection.js";
 import { tryLoadProjectConfig, saveProjectConfig } from "../cli/config/index.js";
 import {
   appendPlanningSessionRegistry,
@@ -1194,7 +1195,22 @@ async function withRetry(fn, toolName, debug) {
 }
 function createToolHandlers(apiClient) {
   const callLocal = async (op, args) => {
+    const debug = process.env.SPECFORGE_DEBUG === "true";
+    const debugFile = process.env.SPECFORGE_DEBUG_FILE;
+    const trace = (line) => {
+      if (!debug) return;
+      if (debugFile) {
+        try {
+          appendFileSync(debugFile, line + "\n");
+          return;
+        } catch {
+        }
+      }
+      process.stderr.write(line + "\n");
+    };
+    trace(`[cli:wire \u2192] ${op} ${JSON.stringify(args)}`);
     const body = await apiClient.getTransport().execute(op, args);
+    trace(`[cli:wire \u2190] ${op} ${JSON.stringify(body).slice(0, 800)}`);
     if (body && typeof body === "object") {
       if (body.kind === "standard_error") {
         const guidance = body.guidance;
@@ -1354,6 +1370,7 @@ function createToolHandlers(apiClient) {
     },
     complete_work_session: async (_client, args) => {
       validateRequired(args, "ticketId", "summary");
+      const commitSha = readHeadCommitSha();
       return await callLocal("complete_work_session", {
         ticketId: args.ticketId,
         summary: args.summary,
@@ -1361,7 +1378,8 @@ function createToolHandlers(apiClient) {
         filesCreated: args.filesCreated,
         filesDeleted: args.filesDeleted,
         actualHours: args.actualHours,
-        validation: args.validation
+        validation: args.validation,
+        ...commitSha !== null && { commitSha }
       });
     },
     start_review_session: async (_client, args) => {