@synergenius/flow-weaver-pack-weaver 0.8.3 → 0.9.3

package/src/node-types/build-context.ts

@@ -4,9 +4,9 @@ import * as path from 'node:path';
 import type { WeaverContext } from '../bot/types.js';
 
 /**
- * Builds the knowledge bundle the AI needs for planning. Calls
- * flow-weaver context authoring for the base knowledge, and
- * appends target file sources for modify tasks.
+ * Builds the knowledge bundle the AI needs for planning.
+ * Adaptive: for modify tasks, includes only grammar + referenced node types.
+ * For create tasks, includes full authoring context + templates.
  *
  * @flowWeaver nodeType
  * @expression
@@ -21,31 +21,81 @@ export function weaverBuildContext(ctx: string): { ctx: string } {
   const task = JSON.parse(context.taskJson!) as { mode?: string; targets?: string[] };
   const sections: string[] = [];
 
+  if (task.mode === 'modify' && task.targets?.length) {
+    // Adaptive context: minimal grammar + target files + referenced node types
+    sections.push(...buildModifyContext(projectDir, task.targets));
+  } else {
+    // Full context for create tasks or unknown modes
+    sections.push(...buildFullContext(projectDir, task.mode));
+  }
+
+  const bundle = sections.join('\n\n---\n\n');
+  // Output handled by session renderer; keep a dim line for debugging
+  if (process.env.WEAVER_VERBOSE) process.stderr.write(`\x1b[2m  Context: ${bundle.length} chars\x1b[0m\n`);
+
+  context.contextBundle = bundle;
+  return { ctx: JSON.stringify(context) };
+}
+
+/** Minimal context for modify tasks: grammar + annotations + target sources + referenced node types. */
+function buildModifyContext(projectDir: string, targets: string[]): string[] {
+  const sections: string[] = [];
+
+  // Minimal grammar (jsdoc-grammar + advanced-annotations only — skip concepts/scaffold/patterns)
   try {
-    const ctxOutput = execFileSync('flow-weaver', ['context', 'authoring', '--profile', 'assistant'], {
-      encoding: 'utf-8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-      timeout: 30_000,
-      cwd: projectDir,
-    }).trim();
+    const ctxOutput = execFileSync(
+      'flow-weaver',
+      ['context', '--topics', 'jsdoc-grammar,advanced-annotations', '--profile', 'assistant'],
+      { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 30_000, cwd: projectDir },
+    ).trim();
     if (ctxOutput) sections.push(ctxOutput);
-  } catch {
+  } catch (err) {
+    if (process.env.WEAVER_VERBOSE) console.error('[build-context] modify context unavailable:', err);
     sections.push('(flow-weaver context not available)');
   }
 
-  if (task.mode === 'modify' && task.targets) {
-    for (const target of task.targets) {
-      const filePath = path.isAbsolute(target) ? target : path.resolve(projectDir, target);
-      try {
-        if (fs.existsSync(filePath)) {
-          const source = fs.readFileSync(filePath, 'utf-8');
-          sections.push(`## Current Source: ${target}\n\n\`\`\`typescript\n${source}\n\`\`\``);
+  // Target file sources + referenced node type sources
+  const includedFiles = new Set<string>();
+  for (const target of targets) {
+    const filePath = path.isAbsolute(target) ? target : path.resolve(projectDir, target);
+    try {
+      if (!fs.existsSync(filePath)) continue;
+      const source = fs.readFileSync(filePath, 'utf-8');
+      sections.push(`## Target: ${target}\n\n\`\`\`typescript\n${source}\n\`\`\``);
+      includedFiles.add(filePath);
+
+      // Extract import paths to find referenced node type files
+      const nodeTypeSources = extractReferencedNodeTypes(filePath, source, projectDir);
+      for (const [relPath, ntSource] of nodeTypeSources) {
+        const absPath = path.resolve(projectDir, relPath);
+        if (!includedFiles.has(absPath)) {
+          includedFiles.add(absPath);
+          sections.push(`## Node Type: ${relPath}\n\n\`\`\`typescript\n${ntSource}\n\`\`\``);
         }
-      } catch { /* skip unreadable files */ }
-    }
+      }
+    } catch (err) { if (process.env.WEAVER_VERBOSE) console.error('[build-context] unreadable file:', err); }
+  }
+
+  return sections;
+}
+
+/** Full context for create tasks: full authoring preset + templates. */
+function buildFullContext(projectDir: string, mode?: string): string[] {
+  const sections: string[] = [];
+
+  try {
+    const ctxOutput = execFileSync(
+      'flow-weaver',
+      ['context', 'authoring', '--profile', 'assistant'],
+      { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 30_000, cwd: projectDir },
+    ).trim();
+    if (ctxOutput) sections.push(ctxOutput);
+  } catch (err) {
+    if (process.env.WEAVER_VERBOSE) console.error('[build-context] full context unavailable:', err);
+    sections.push('(flow-weaver context not available)');
   }
 
-  if (task.mode === 'create') {
+  if (mode === 'create') {
     try {
       const templates = execFileSync('flow-weaver', ['list', 'templates'], {
         encoding: 'utf-8',
@@ -54,12 +104,49 @@ export function weaverBuildContext(ctx: string): { ctx: string } {
         cwd: projectDir,
       }).trim();
       if (templates) sections.push(`## Available Templates\n\n${templates}`);
-    } catch { /* templates not available */ }
+    } catch (err) { if (process.env.WEAVER_VERBOSE) console.error('[build-context] templates not available:', err); }
   }
 
-  const bundle = sections.join('\n\n---\n\n');
-  console.log(`\x1b[36m→ Context bundle: ${bundle.length} chars\x1b[0m`);
+  return sections;
+}
 
-  context.contextBundle = bundle;
-  return { ctx: JSON.stringify(context) };
+/**
+ * Extract node type file sources referenced by a workflow file's imports.
+ * Parses import statements to find relative imports from node-types directories.
+ */
+function extractReferencedNodeTypes(
+  filePath: string,
+  source: string,
+  projectDir: string,
+): Array<[relPath: string, source: string]> {
+  const results: Array<[string, string]> = [];
+  const dir = path.dirname(filePath);
+
+  // Match: import { ... } from '../node-types/foo.js' or './node-types/bar'
+  const importRegex = /import\s+(?:type\s+)?{[^}]+}\s+from\s+['"]([^'"]+)['"]/g;
+  let match: RegExpExecArray | null;
+
+  while ((match = importRegex.exec(source)) !== null) {
+    const importPath = match[1];
+    // Only include relative imports that look like node type files
+    if (!importPath.startsWith('.') && !importPath.startsWith('/')) continue;
+    if (!importPath.includes('node-type') && !importPath.includes('node_type')) continue;
+
+    // Resolve the import to an absolute path
+    let resolved = path.resolve(dir, importPath);
+    // Try with .ts extension if no extension
+    if (!fs.existsSync(resolved)) {
+      if (fs.existsSync(resolved + '.ts')) resolved = resolved + '.ts';
+      else if (fs.existsSync(resolved.replace(/\.js$/, '.ts'))) resolved = resolved.replace(/\.js$/, '.ts');
+      else continue;
+    }
+
+    try {
+      const ntSource = fs.readFileSync(resolved, 'utf-8');
+      const relPath = path.relative(projectDir, resolved);
+      results.push([relPath, ntSource]);
+    } catch (err) { if (process.env.WEAVER_VERBOSE) console.error('[build-context] unreadable node type:', err); }
+  }
+
+  return results;
 }

package/src/node-types/detect-provider.ts

@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process';
-import type { WeaverConfig, WeaverEnv, ProviderInfo } from '../bot/types.js';
+import type { BotConfig, WeaverEnv, ProviderInfo } from '../bot/types.js';
 
 const WHICH_CMD = process.platform === 'win32' ? 'where' : 'which';
 
@@ -23,7 +23,7 @@ function whichSafe(cmd: string, cwd: string): string {
  * @output env [order:0] - Weaver environment bundle
  * @output onFailure [hidden]
  */
-export function weaverDetectProvider(projectDir: string, config: WeaverConfig): {
+export function weaverDetectProvider(projectDir: string, config: BotConfig): {
   env: WeaverEnv;
 } {
   const providerSetting = config.provider ?? 'auto';
@@ -69,7 +69,8 @@ export function weaverDetectProvider(projectDir: string, config: WeaverConfig):
   }
 
   const label = providerInfo.model ? `${type} (${providerInfo.model})` : type;
-  console.log(`\x1b[36m→ Provider: ${label}\x1b[0m`);
+  // Provider info now shown by session renderer; keep for verbose/debug
+  if (process.env.WEAVER_VERBOSE) process.stderr.write(`\x1b[2m  Provider: ${label}\x1b[0m\n`);
 
   return {
     env: { projectDir, config, providerType: type, providerInfo },

package/src/node-types/exec-validate-retry.ts

@@ -1,8 +1,8 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import type { WeaverContext } from '../bot/types.js';
-import { callAI, parseJsonResponse } from '../bot/ai-client.js';
+import type { WeaverContext, StepLogEntry } from '../bot/types.js';
+import { callAI, parseJsonResponse, normalizePlan } from '../bot/ai-client.js';
 import { executeStep } from '../bot/step-executor.js';
 import { validateFiles } from '../bot/file-validator.js';
 import { auditEmit } from '../bot/audit-logger.js';
@@ -38,19 +38,29 @@ export async function weaverExecValidateRetry(
 
   const { providerInfo: pInfo, projectDir } = env;
   const maxAttempts = 3;
+  const taskDeadline = Date.now() + 180_000; // 3 minute max per task
   let currentPlan = JSON.parse(context.planJson!);
   let allFilesModified: string[] = [];
+  let allStepLog: StepLogEntry[] = [];
   let lastExecResult: Record<string, unknown> = {};
   let lastValidation: Array<{ file: string; valid: boolean; errors: string[] }> = [];
   let allValid = false;
+  let prevErrorCount = Infinity;
 
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    // Task timeout — stop if we've exceeded the deadline
+    if (Date.now() > taskDeadline) {
+      console.error('\x1b[33m→ Task timeout (3 min), moving on\x1b[0m');
+      break;
+    }
+
     console.log(`\x1b[36m→ Attempt ${attempt}/${maxAttempts}\x1b[0m`);
     auditEmit('step-start', { attempt, stepCount: currentPlan.steps?.length });
 
     const execResult = await executePlanSteps(currentPlan, projectDir);
     lastExecResult = execResult;
     allFilesModified = [...new Set([...allFilesModified, ...execResult.filesModified])];
+    allStepLog.push(...execResult.stepLog);
     auditEmit('step-complete', { attempt, filesModified: execResult.filesModified, errors: execResult.errors });
 
     const validation = await validateFiles(execResult.filesModified, projectDir);
@@ -59,6 +69,13 @@ export async function weaverExecValidateRetry(
     const errorCount = validation.filter(v => !v.valid).length;
     auditEmit('validation-run', { attempt, allValid, errorCount });
 
+    // Stop retrying if errors didn't decrease — AI is stuck
+    if (attempt > 1 && errorCount >= prevErrorCount) {
+      console.error(`\x1b[33m→ Errors not decreasing (${errorCount} >= ${prevErrorCount}), stopping retry\x1b[0m`);
+      break;
+    }
+    prevErrorCount = errorCount;
+
     // Collect design warnings from valid files
     const designWarnings = validation
       .filter(v => v.valid && v.warnings.length > 0)
@@ -97,16 +114,23 @@ export async function weaverExecValidateRetry(
         try {
           const mod = await import('../bot/system-prompt.js');
           systemPrompt = await mod.buildSystemPrompt();
-        } catch {
+        } catch (err) {
+          if (process.env.WEAVER_VERBOSE) console.error('[exec-validate-retry] system prompt build failed:', err);
           systemPrompt = 'You are Weaver. Return ONLY valid JSON.';
         }
 
-        const fixPrompt = `The following validation errors occurred:\n${errors}\n\nProvide a fix plan as JSON with steps and summary.`;
+        // Include step outputs so the AI has context from discovery steps
+        const outputContext = Object.entries(execResult.stepOutputs)
+          .map(([id, out]) => `--- Output of ${id} ---\n${out}`)
+          .join('\n\n');
+
+        const fixPrompt = `The following validation errors occurred:\n${errors}\n\n${outputContext ? `Discovery step outputs:\n${outputContext}\n\n` : ''}Provide a CONCRETE fix plan. Every patch-file step MUST include "file" (absolute path from the outputs above) and "patches" array with exact "find"/"replace" strings. Do NOT use placeholders.`;
 
         const text = await callAI(pInfo, systemPrompt, fixPrompt, 8192);
 
-        currentPlan = parseJsonResponse(text);
-        console.log(`\x1b[36m→ Fix plan: ${(currentPlan as { summary?: string }).summary ?? 'generated'}\x1b[0m`);
+        const parsed = parseJsonResponse(text);
+        currentPlan = normalizePlan(parsed);
+        console.log(`\x1b[36m→ Fix plan: ${currentPlan.summary} (${currentPlan.steps.length} steps)\x1b[0m`);
       } catch (err: unknown) {
         const msg = err instanceof Error ? err.message : String(err);
         console.error(`\x1b[31m→ Fix planning failed: ${msg}\x1b[0m`);
@@ -118,6 +142,7 @@ export async function weaverExecValidateRetry(
   context.resultJson = JSON.stringify(lastExecResult);
   context.validationResultJson = JSON.stringify(lastValidation);
   context.filesModified = JSON.stringify(allFilesModified);
+  context.stepLogJson = JSON.stringify(allStepLog);
   context.allValid = allValid;
 
   return { onSuccess: allValid, onFailure: !allValid, ctx: JSON.stringify(context) };
@@ -126,9 +151,11 @@ export async function weaverExecValidateRetry(
 async function executePlanSteps(
   plan: { steps: Array<{ id: string; operation: string; description: string; args: Record<string, unknown> }> },
   projectDir: string,
-): Promise<{ success: boolean; filesModified: string[]; errors: string[]; stepsCompleted: number; stepsTotal: number }> {
+): Promise<{ success: boolean; filesModified: string[]; errors: string[]; stepsCompleted: number; stepsTotal: number; stepLog: StepLogEntry[]; stepOutputs: Record<string, string> }> {
   const filesModified: string[] = [];
   const errors: string[] = [];
+  const stepLog: StepLogEntry[] = [];
+  const stepOutputs: Record<string, string> = {};
   let completed = 0;
   const steps = plan.steps ?? [];
 
@@ -136,23 +163,35 @@ async function executePlanSteps(
     const steering = checkSteeringSignal();
     if (steering === 'cancel') {
       errors.push(`Cancelled at step ${step.id}`);
+      stepLog.push({ step: step.id, status: 'error', detail: 'Cancelled by steering signal' });
       break;
     }
 
     try {
       const result = await executeStep(step, projectDir);
+      if (result.blocked) {
+        console.error(`\x1b[33m  ⚠ ${step.id}: ${result.blockReason}\x1b[0m`);
+        stepLog.push({ step: step.id, status: 'blocked', detail: result.blockReason });
+        continue;
+      }
       if (result.file) filesModified.push(result.file);
       if (result.files) filesModified.push(...result.files);
+      // Capture step output for feeding into fix prompts
+      if (result.output) {
+        stepOutputs[step.id] = result.output.slice(0, 4000); // cap at 4k to fit in prompt
+      }
       completed++;
       console.log(`\x1b[32m  + ${step.id}: ${step.description}\x1b[0m`);
+      stepLog.push({ step: step.id, status: 'ok', detail: step.description });
     } catch (err: unknown) {
       const msg = err instanceof Error ? err.message : String(err);
       errors.push(`${step.id}: ${msg}`);
       console.error(`\x1b[31m  x ${step.id}: ${msg}\x1b[0m`);
+      stepLog.push({ step: step.id, status: 'error', detail: msg });
     }
   }
 
-  return { success: errors.length === 0, filesModified: [...new Set(filesModified)], errors, stepsCompleted: completed, stepsTotal: steps.length };
+  return { success: errors.length === 0, filesModified: [...new Set(filesModified)], errors, stepsCompleted: completed, stepsTotal: steps.length, stepLog, stepOutputs };
 }
 
 function checkSteeringSignal(): 'cancel' | null {

package/src/node-types/execute-plan.ts

@@ -2,7 +2,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import type { WeaverEnv } from '../bot/types.js';
-import { executeStep } from '../bot/step-executor.js';
+import { executeStep, resetPlanFileCounter } from '../bot/step-executor.js';
 
 /**
  * Executes plan steps via the flow-weaver CLI. Checks steering
@@ -39,6 +39,7 @@ export async function weaverExecutePlan(
   }
 
   const { projectDir } = env;
+  resetPlanFileCounter(); // Reset per-plan write counter for safety guards
   const plan = JSON.parse(planJson) as { steps: Array<{ id: string; operation: string; description: string; args: Record<string, unknown> }> };
   const filesModified: string[] = [];
   const filesCreated: string[] = [];
@@ -55,10 +56,27 @@ export async function weaverExecutePlan(
     };
   }
 
-  for (const step of plan.steps) {
+  for (let i = 0; i < plan.steps.length; i++) {
+    const step = plan.steps[i];
+    // Defensive: ensure step has required fields
+    if (!step || typeof step !== 'object') {
+      errors.push(`step-${i + 1}: Malformed step (not an object)`);
+      continue;
+    }
+    const stepId = step.id ?? `step-${i + 1}`;
+    const stepDesc = step.description ?? step.operation ?? 'unknown';
+    if (!step.operation) {
+      errors.push(`${stepId}: Missing "operation" field`);
+      console.error(`\x1b[31m  x ${stepId}: Missing operation\x1b[0m`);
+      continue;
+    }
+    if (!step.args) {
+      step.args = {};
+    }
+
     const steering = checkSteering();
     if (steering === 'cancel') {
-      output.push(`Cancelled at step ${step.id}`);
+      output.push(`Cancelled at ${stepId}`);
       break;
     }
     if (steering === 'pause') {
@@ -68,18 +86,24 @@ export async function weaverExecutePlan(
 
     try {
       const result = await executeStep(step, projectDir);
+      if (result.blocked) {
+        errors.push(`${stepId}: BLOCKED - ${result.blockReason}`);
+        output.push(`${stepId}: BLOCKED - ${result.blockReason}`);
+        console.error(`\x1b[33m  ⚠ ${stepId}: ${result.blockReason}\x1b[0m`);
+        continue;
+      }
       if (result.file) {
         if (result.created) filesCreated.push(result.file);
         else filesModified.push(result.file);
       }
       completed++;
-      output.push(`${step.id}: ${step.description} - done`);
-      console.log(`\x1b[32m  + ${step.id}: ${step.description}\x1b[0m`);
+      output.push(`${stepId}: ${stepDesc} - done`);
+      console.log(`\x1b[32m  + ${stepId}: ${stepDesc}\x1b[0m`);
     } catch (err: unknown) {
       const msg = err instanceof Error ? err.message : String(err);
-      errors.push(`${step.id}: ${msg}`);
-      output.push(`${step.id}: FAILED - ${msg}`);
-      console.error(`\x1b[31m  x ${step.id}: ${msg}\x1b[0m`);
+      errors.push(`${stepId}: ${msg}`);
+      output.push(`${stepId}: FAILED - ${msg}`);
+      console.error(`\x1b[31m  x ${stepId}: ${msg}\x1b[0m`);
     }
   }
 

package/src/node-types/execute-target.ts

@@ -137,7 +137,8 @@ When stabilize mode is active, only fix-up operations are allowed: removeNode, r
 ## Response Format
 
 Return ONLY valid JSON. No markdown, no code fences, no explanation outside the JSON structure.`;
-  } catch {
+  } catch (err) {
+    if (process.env.WEAVER_VERBOSE) console.error('[execute-target] prompt build failed:', err);
     return FALLBACK;
   }
 }

package/src/node-types/fix-errors.ts

@@ -1,5 +1,5 @@
 import type { WeaverEnv } from '../bot/types.js';
-import { callAI, parseJsonResponse } from '../bot/ai-client.js';
+import { callAI, parseJsonResponse, normalizePlan } from '../bot/ai-client.js';
 
 /**
  * When validation fails, sends errors + context to the AI and
@@ -42,18 +42,33 @@ export async function weaverFixErrors(
   try {
     const mod = await import('../bot/system-prompt.js');
     systemPrompt = await mod.buildSystemPrompt();
-  } catch {
+  } catch (err) {
+    if (process.env.WEAVER_VERBOSE) console.error('[fix-errors] system prompt build failed:', err);
     systemPrompt = 'You are Weaver. Return ONLY valid JSON.';
   }
 
   const errorSummary = errors.map(e => `${e.file}: ${e.errors.join(', ')}`).join('\n');
-  const userPrompt = `The following validation errors occurred:\n${errorSummary}\n\nProvide a fix plan as JSON with "steps" and "summary". Each step needs "id", "operation", "description", and "args".`;
+  const userPrompt = `The following validation errors occurred:
+${errorSummary}
+
+Provide a fix plan as JSON: {"steps": [...], "summary": "..."}
+
+Each step MUST have: "id" (string), "operation" (string), "description" (string), "args" (object).
+
+Available operations for fixes:
+- patch-file: Surgical find-and-replace. args: { "file": "path", "patches": [{ "find": "old text", "replace": "new text" }] }
+  PREFERRED for fixing @input annotations. Example: { "find": "@input portName", "replace": "@input [portName]" }
+- run-shell: Execute a command. args: { "command": "..." }
+- read-file: Read file content. args: { "file": "path" }
+
+Return ONLY valid JSON. No explanation outside the JSON.`;
 
   try {
     const text = await callAI(pInfo, systemPrompt, userPrompt, 8192);
 
-    const plan = parseJsonResponse(text);
-    console.log(`\x1b[36m→ Fix plan: ${(plan as { summary?: string }).summary ?? 'generated'}\x1b[0m`);
+    const parsed = parseJsonResponse(text);
+    const plan = normalizePlan(parsed);
+    console.log(`\x1b[36m→ Fix plan: ${plan.summary} (${plan.steps.length} steps)\x1b[0m`);
     return { onSuccess: true, onFailure: false, env, taskJson, fixPlanJson: JSON.stringify(plan) };
   } catch (err: unknown) {
     const msg = err instanceof Error ? err.message : String(err);

package/src/node-types/genesis-observe.ts

@@ -77,8 +77,9 @@ export async function genesisObserve(
       gitCommit = execFileSync('git', ['rev-parse', 'HEAD'], {
         cwd: projectDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
       }).trim();
-    } catch {
+    } catch (err) {
       // Not a git repo or git unavailable
+      if (process.env.WEAVER_VERBOSE) console.error('[genesis-observe] git unavailable:', err);
     }
 
     const existingWorkflows: string[] = [];

package/src/node-types/genesis-report.ts

@@ -34,7 +34,7 @@ export function genesisReport(successCtx?: string, failCtx?: string, proposeFail
       try {
         const result = JSON.parse(context.applyResultJson) as { applied: number; failed: number };
         summary += ` (applied: ${result.applied}, failed: ${result.failed})`;
-      } catch { /* ignore */ }
+      } catch (err) { if (process.env.WEAVER_VERBOSE) console.error('[genesis-report] applyResultJson parse failed:', err); }
     }
     summary += elapsed ? ` [${elapsed}]` : '';
     console.log(`\n\x1b[31m${summary}\x1b[0m\n`);

package/src/node-types/git-ops.ts

@@ -1,7 +1,62 @@
 import { execFileSync } from 'node:child_process';
+import * as path from 'node:path';
 import type { WeaverContext } from '../bot/types.js';
 import { auditEmit } from '../bot/audit-logger.js';
 
+/**
+ * Review staged diff for suspicious changes before committing.
+ * Returns an array of issues found (empty = safe to commit).
+ */
+function reviewStagedDiff(cwd: string): string[] {
+  const issues: string[] = [];
+
+  try {
+    const diff = execFileSync('git', ['diff', '--cached', '--stat'], { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+    if (!diff) return issues;
+
+    // Check for large deletions (file became empty or nearly empty)
+    const numstat = execFileSync('git', ['diff', '--cached', '--numstat'], { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+    for (const line of numstat.split('\n').filter(Boolean)) {
+      const [added, deleted, file] = line.split('\t');
+      if (!file || !added || !deleted) continue;
+      const addedN = parseInt(added, 10) || 0;
+      const deletedN = parseInt(deleted, 10) || 0;
+
+      // Flag: file lost >80% of its content with minimal additions
+      if (deletedN > 50 && addedN < 5 && deletedN > addedN * 10) {
+        issues.push(`${file}: deleted ${deletedN} lines, added only ${addedN} (possible truncation)`);
+      }
+
+      // Flag: file became empty (0 additions, all deletions)
+      if (addedN === 0 && deletedN > 10) {
+        issues.push(`${file}: file emptied (${deletedN} lines deleted, 0 added)`);
+      }
+    }
+
+    // Check for sensitive patterns in added lines
+    const patchDiff = execFileSync('git', ['diff', '--cached', '-U0'], { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+    const sensitivePatterns = [
+      /api[_-]?key\s*[:=]\s*["'][^"']{20,}/i,
+      /secret\s*[:=]\s*["'][^"']{10,}/i,
+      /password\s*[:=]\s*["'][^"']{5,}/i,
+    ];
+    for (const line of patchDiff.split('\n')) {
+      if (!line.startsWith('+') || line.startsWith('+++')) continue;
+      for (const pattern of sensitivePatterns) {
+        if (pattern.test(line)) {
+          issues.push('Possible credential/secret in staged changes');
+          return issues; // One is enough to block
+        }
+      }
+    }
+  } catch (err) {
+    // If diff commands fail, don't block — let commit proceed
+    if (process.env.WEAVER_VERBOSE) console.error('[git-ops] diff review failed:', err);
+  }
+
+  return issues;
+}
+
 /**
  * Git operations on created/modified files: stage, commit, branch.
  * Runs in parallel with notifications after execution.
@@ -48,25 +103,59 @@ export function weaverGitOps(ctx: string): { ctx: string } {
     }
   }
 
-  // Stage files
+  // Get actually-changed files from git (avoids phantom commits)
+  let changedFiles: Set<string>;
+  try {
+    const diff = execFileSync('git', ['diff', '--name-only'], { cwd: projectDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+    const untracked = execFileSync('git', ['ls-files', '--others', '--exclude-standard'], { cwd: projectDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+    changedFiles = new Set([...diff.split('\n'), ...untracked.split('\n')].filter(Boolean));
+  } catch (err) {
+    if (process.env.WEAVER_VERBOSE) console.error('[git-ops] git diff failed, using filesModified fallback:', err);
+    changedFiles = new Set(files); // fallback: trust filesModified
+  }
+
+  // Stage only files that are both in filesModified AND actually changed
+  let staged = 0;
   for (const file of files) {
+    // Resolve to relative path for comparison
+    const relative = path.relative(projectDir, path.resolve(projectDir, file));
+    if (!changedFiles.has(relative) && !changedFiles.has(file)) continue;
     try {
       execFileSync('git', ['add', file], { cwd: projectDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+      staged++;
     } catch { /* ignore unstaged files */ }
   }
 
+  if (staged === 0) {
+    results.push('No actual changes to commit');
+    auditEmit('git-operation', { branch: gitConfig.branch, filesCount: 0, results });
+    context.gitResultJson = JSON.stringify({ skipped: true, reason: 'no actual changes', results });
+    return { ctx: JSON.stringify(context) };
+  }
+
+  // Diff review: check for suspicious changes before committing
+  const diffIssues = reviewStagedDiff(projectDir);
+  if (diffIssues.length > 0) {
+    // Unstage and skip commit — something looks wrong
+    try { execFileSync('git', ['reset', 'HEAD'], { cwd: projectDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }); } catch (err) { if (process.env.WEAVER_VERBOSE) console.error('[git-ops] reset failed:', err); }
+    results.push(`Commit blocked: ${diffIssues.join('; ')}`);
+    auditEmit('git-operation', { branch: gitConfig.branch, filesCount: 0, results, blocked: true });
+    context.gitResultJson = JSON.stringify({ skipped: true, reason: 'diff review failed', issues: diffIssues, results });
+    return { ctx: JSON.stringify(context) };
+  }
+
   // Commit
   const prefix = gitConfig.commitPrefix ?? 'weaver:';
-  const commitMsg = `${prefix} bot task (${files.length} file${files.length === 1 ? '' : 's'})`;
+  const commitMsg = `${prefix} bot task (${staged} file${staged === 1 ? '' : 's'})`;
   try {
     execFileSync('git', ['commit', '-m', commitMsg], { cwd: projectDir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
     results.push(`Committed: ${commitMsg}`);
-    console.log(`\x1b[36m→ Git: ${commitMsg}\x1b[0m`);
+    if (process.env.WEAVER_VERBOSE) process.stderr.write(`\x1b[2m  Git: ${commitMsg}\x1b[0m\n`);
   } catch {
     results.push('Nothing to commit');
   }
 
-  auditEmit('git-operation', { branch: gitConfig.branch, filesCount: files.length, results });
+  auditEmit('git-operation', { branch: gitConfig.branch, filesCount: staged, results });
   context.gitResultJson = JSON.stringify({ skipped: false, results });
   return { ctx: JSON.stringify(context) };
 }

package/src/node-types/index.ts

@@ -17,6 +17,8 @@ export { weaverValidateResult } from './validate-result.js';
 export { weaverFixErrors } from './fix-errors.js';
 export { weaverGitOps } from './git-ops.js';
 export { weaverBotReport } from './bot-report.js';
+export { weaverAgentExecute } from './agent-execute.js';
+export { weaverValidateGate } from './validate-gate.js';
 export { genesisLoadConfig } from './genesis-load-config.js';
 export { genesisObserve } from './genesis-observe.js';
 export { genesisDiffFingerprint } from './genesis-diff-fingerprint.js';

package/src/node-types/load-config.ts

@@ -1,6 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import type { WeaverConfig } from '../bot/types.js';
+import type { BotConfig } from '../bot/types.js';
 
 /**
  * Read .weaver.json, merge with defaults, and output the config object.
@@ -13,10 +13,10 @@ import type { WeaverConfig } from '../bot/types.js';
  * @output config [order:1] - Weaver configuration
  * @output onFailure [hidden]
  */
-export function weaverLoadConfig(projectDir?: string): { projectDir: string; config: WeaverConfig } {
+export function weaverLoadConfig(projectDir?: string): { projectDir: string; config: BotConfig } {
   const dir = projectDir || process.cwd();
   const configPath = path.join(dir, '.weaver.json');
-  let config: WeaverConfig = { provider: 'auto' };
+  let config: BotConfig = { provider: 'auto' };
   if (fs.existsSync(configPath)) {
     config = { ...config, ...JSON.parse(fs.readFileSync(configPath, 'utf-8')) };
     console.log(`\x1b[36m→ Loaded config from ${configPath}\x1b[0m`);