@tech-leads-club/harness-toolkit 0.12.0 → 0.12.1

package/docs/log.md

@@ -16,6 +16,7 @@ newest first. For what landed in which npm release, see `CHANGELOG.md` at the re
 ## 2026-09-09
 
 - **AD-128** — pr-open and push recognize their gh api equivalent, and pr-merge exists ([/decisions/ad-128.md](/decisions/ad-128.md))
+- **AD-129** — Turn-scope git diffing runs at the event's own working directory, not the project root ([/decisions/ad-129.md](/decisions/ad-129.md))
 
 ## 2026-09-08
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tech-leads-club/harness-toolkit",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "type": "module",
   "description": "Multi-provider agent steering: gates, follow-up, handoff, policy",
   "keywords": [

package/src/entrypoints/ship-gate.ts

@@ -49,13 +49,13 @@ export async function shipGateVerdict(event: HarnessEvent, ctx: HandlerContext):
   }
   const { policy } = ctx;
   const root = event.projectDir;
+  const shaRoot = shaScopeRoot(event);
   const provider = event.provider;
   const sessionKey = event.sessionKey;
   const session = sessionIdFromKey(event);
-  const scope = await computeTurnScope(root, provider, sessionKey, policy);
-  const shaRoot = shaScopeRoot(event);
+  const scope = await computeTurnScope(root, shaRoot, provider, sessionKey, policy);
 
-  const commentHits = await pendingCommentViolations(root, provider, sessionKey, policy);
+  const commentHits = await pendingCommentViolations(root, shaRoot, provider, sessionKey, policy);
   if (commentHits.length > 0) {
     return {
       kind: "deny",
@@ -143,13 +143,13 @@ export async function shipGateVerdict(event: HarnessEvent, ctx: HandlerContext):
   }
 
   if (policy.duplication.enabled && scope.codeTargets.length > 0) {
-    const added = await listAddedLines(root, scope.codeTargets, scope.turnBase);
-    const tracked = await listTrackedFiles(root);
+    const added = await listAddedLines(shaRoot, scope.codeTargets, scope.turnBase);
+    const tracked = await listTrackedFiles(shaRoot);
     const scan = coreFacade.duplication.scanProject(
       tracked,
       (relativePath) => {
         try {
-          return readFileSync(`${root}/${relativePath}`, "utf8");
+          return readFileSync(`${shaRoot}/${relativePath}`, "utf8");
         } catch {
           return null;
         }

package/src/entrypoints/stop.ts

@@ -490,7 +490,7 @@ export const stopHandler: Handler = async (event: HarnessEvent, ctx: HandlerCont
    * says so once at the end instead of three times ([/decisions/ad-073.md](/decisions/ad-073.md)).
    */
   const deferred: string[] = [];
-  const changedFiles = await listChangedRepoFiles(root, turnBase);
+  const changedFiles = await listChangedRepoFiles(shaRoot, turnBase);
   const codeTargets = filterCodeTargets(changedFiles, policy.codePaths);
   const testTargets = filterTestTargets(changedFiles);
   // why: the comment rail scopes by the syntax catalog (40+ languages), not `codeTargets`'s nine-extension
@@ -653,7 +653,7 @@ export const stopHandler: Handler = async (event: HarnessEvent, ctx: HandlerCont
     coreFacade.observe.shouldObserve(policy.observe, "comments", policy.comments.enabled)
   ) {
     const hits = await coreFacade.commentPolicy.scanAddedComments(
-      root,
+      shaRoot,
       commentTargets,
       policy.comments.mode,
       turnBase,
@@ -680,7 +680,7 @@ export const stopHandler: Handler = async (event: HarnessEvent, ctx: HandlerCont
 
   if (policy.comments.enabled && policy.comments.onViolation === "followup" && commentTargets.length > 0) {
     const hits = await coreFacade.commentPolicy.scanAddedComments(
-      root,
+      shaRoot,
       commentTargets,
       policy.comments.mode,
       turnBase,
@@ -708,13 +708,13 @@ export const stopHandler: Handler = async (event: HarnessEvent, ctx: HandlerCont
   if (policy.supplyChain.enabled && changedFiles.length > 0) {
     const manifests = changedFiles.filter((path) => coreFacade.supplyChain.isManifest(path));
     if (manifests.length > 0) {
-      const added = await listAddedLines(root, manifests, turnBase);
+      const added = await listAddedLines(shaRoot, manifests, turnBase);
       const outcome = coreFacade.supplyChain.inspectSupplyChain({
         changedFiles,
         added,
         readManifest: (relativePath) => {
           try {
-            return readFileSync(join(root, relativePath), "utf8");
+            return readFileSync(join(shaRoot, relativePath), "utf8");
           } catch {
             return null;
           }
@@ -742,13 +742,13 @@ export const stopHandler: Handler = async (event: HarnessEvent, ctx: HandlerCont
    * ([/decisions/ad-071.md](/decisions/ad-071.md)).
    */
   if (policy.duplication.enabled && codeTargets.length > 0) {
-    const added = await listAddedLines(root, codeTargets, turnBase);
-    const tracked = await listTrackedFiles(root);
+    const added = await listAddedLines(shaRoot, codeTargets, turnBase);
+    const tracked = await listTrackedFiles(shaRoot);
     const scan = coreFacade.duplication.scanProject(
       tracked,
       (relativePath) => {
         try {
-          return readFileSync(join(root, relativePath), "utf8");
+          return readFileSync(join(shaRoot, relativePath), "utf8");
         } catch {
           return null;
         }

package/src/entrypoints/support.ts

@@ -94,9 +94,13 @@ export type TurnScope = {
  *
  * invariant: `turn_base_sha` falls back to `HEAD` when the handoff is absent or its seal diverged —
  * identical to `stop.ts`'s own fallback.
+ * why: `root` is state (worktree-stable, AD-114); `gitRoot` is where the turn's files actually are
+ * (`shaScopeRoot(event)`) — diffing a worktree-valid sha from the wrong directory read a whole unrelated
+ * branch as added ([/decisions/ad-129.md](/decisions/ad-129.md)).
  */
 export async function computeTurnScope(
   root: string,
+  gitRoot: string,
   provider: string,
   sessionKey: string,
   policy: Pick<Policy, "codePaths">,
@@ -104,7 +108,7 @@ export async function computeTurnScope(
   const seal = coreFacade.handoff.handoffInjectable(root, sessionKey);
   const handoff = seal.ok ? coreFacade.handoff.readHandoff(root, provider, sessionKey) : undefined;
   const turnBase = handoff?.turn_base_sha ?? "HEAD";
-  const changedFiles = await listChangedRepoFiles(root, turnBase);
+  const changedFiles = await listChangedRepoFiles(gitRoot, turnBase);
   const codeTargets = filterCodeTargets(changedFiles, policy.codePaths);
   const testTargets = filterTestTargets(changedFiles);
   const commentScope = changedFiles.filter((file) =>
@@ -128,6 +132,7 @@ export async function computeTurnScope(
  */
 export async function pendingCommentViolations(
   root: string,
+  gitRoot: string,
   provider: string,
   sessionKey: string,
   policy: Pick<Policy, "comments" | "codePaths">,
@@ -135,12 +140,12 @@ export async function pendingCommentViolations(
   if (!policy.comments.enabled || policy.comments.onViolation !== "followup") {
     return [];
   }
-  const scope = await computeTurnScope(root, provider, sessionKey, policy);
+  const scope = await computeTurnScope(root, gitRoot, provider, sessionKey, policy);
   if (scope.commentTargets.length === 0) {
     return [];
   }
   return coreFacade.commentPolicy.scanAddedComments(
-    root,
+    gitRoot,
     scope.commentTargets,
     policy.comments.mode,
     scope.turnBase,

package/src/entrypoints/tool-before.ts

@@ -26,7 +26,13 @@ async function commentGateBeforeCommit(event: HarnessEvent, ctx: HandlerContext)
   if (!coreFacade.rules.triggerMatches({ kind: "commit" }, context)) {
     return { kind: "abstain" };
   }
-  const hits = await pendingCommentViolations(event.projectDir, event.provider, event.sessionKey, ctx.policy);
+  const hits = await pendingCommentViolations(
+    event.projectDir,
+    shaScopeRoot(event),
+    event.provider,
+    event.sessionKey,
+    ctx.policy,
+  );
   if (hits.length === 0) {
     return { kind: "abstain" };
   }