@webpresso/agent-kit 3.1.28 → 3.1.30

package/dist/esm/hooks/pretool-guard/validators/worktree-discipline.js

@@ -25,13 +25,15 @@ const VALIDATOR_NAME = "worktree-discipline";
  *  effective cwd elsewhere (e.g. CI)        → ALLOW (rule scoped to local ~/repos primaries)
  * ```
  *
- * The "effective cwd" is the tool's ambient `input.cwd`, lowered only by a
- * success-gated cwd chain that directly governs the forbidden git op, e.g.
- * `cd <worktree> && git commit` or `(cd <worktree> && git commit)`, then by
- * EVERY `git -C <dir>` flag on the matched invocation (git applies them
- * cumulatively). Unsupported cwd-changing control flow, option-bearing `cd`,
- * `cd -`, or unresolvable `cd`/`-C` targets fail closed because they could hide
- * a primary-checkout mutation. Prefer `git -C <worktree> ...` or running the
+ * The "effective cwd" is the tool's ambient `input.cwd`, lowered by a
+ * success-gated `&&` chain that governs the forbidden git op, e.g.
+ * `cd <worktree> && git commit`, `cd <worktree> && ./bin/wp … && git commit`,
+ * or `(cd <worktree> && git commit)`, then by EVERY `git -C <dir>` flag on the
+ * matched invocation (git applies them cumulatively). Intermediate non-cwd
+ * commands after a proven `cd` leave the chain cwd unchanged. Unsupported
+ * control flow (`;` / `|` / braces), option-bearing `cd`, `cd -`, or
+ * unresolvable `cd`/`-C` targets fail closed because they could hide a
+ * primary-checkout mutation. Prefer `git -C <worktree> ...` or running the
  * command with the tool cwd already set to the worktree.
  *
  * Known best-effort limits (acceptable for an agent guard with a documented
@@ -634,12 +636,13 @@ const DIR_TOKEN = String.raw `(?:"[^"]+"|'[^']+'|[^\s;&|(){}]+)`;
 const QUOTED_ARG = String.raw `(?:"[^"]+"|'[^']+'|\S+)`;
 const CD_TARGET = String.raw `(?:--\s+)?(${DIR_TOKEN}|-)`;
 const CD_LEADER = String.raw `(?:[A-Za-z_]\w*=\S*\s+)*(?:command\s+|builtin\s+)?(?:cd|pushd)\s+`;
-// A success-gated cwd chain that directly governs the forbidden git op. We only
-// trust cwd changes in this shape; `;`, `||`, skipped/failed `cd`, quoted spoof
-// text, and other unsupported shell control flow fail closed instead.
+// Pure cd/pushd segment that updates the success-gated cwd (optional leading env /
+// command|builtin wrapper). Trailing whitespace is allowed; nothing else.
+const PURE_CD_SEGMENT = new RegExp(String.raw `^\s*${CD_LEADER}${CD_TARGET}\s*$`, "u");
+// Legacy pure trailing-cd chain (also used for subshell-local `(cd X && git …)`).
 const CD_CHAIN = new RegExp(String.raw `(?:^|[;&|(){}]\s*)?((?:\s*${CD_LEADER}${CD_TARGET}\s*&&)+)\s*$`, "u");
 const CD_IN_CHAIN = new RegExp(String.raw `(?:^|&&)\s*${CD_LEADER}${CD_TARGET}\s*(?=&&)`, "gu");
-const CWD_WORD = new RegExp(String.raw `(?:^|[;{}()&|]\s*|\s+)(?:[A-Za-z_]\w*=\S*\s+)*(?:command\s+|builtin\s+)?(?:cd|pushd)\b`, "gu");
+const CWD_WORD = new RegExp(String.raw `(?:^|[;{}()&|]\s*|\s+)(?:[A-Za-z_]\w*=\S*\s+)*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)\b`, "gu");
 const DASH_C = new RegExp(String.raw `-C\s+(${DIR_TOKEN})`, "gu");
 function isInsideSingleOrDoubleQuotes(command, index) {
     let quote = null;
@@ -667,6 +670,27 @@ function hasUnquotedCwdCommand(command) {
     }
     return false;
 }
+/** True when unquoted `;` `|` `{` `}` appear (breaks a pure `&&` agent chain). */
+function hasUnquotedUnsafeAndChainControl(command) {
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (ch !== ";" && ch !== "|" && ch !== "{" && ch !== "}" && ch !== "\n")
+            continue;
+        if (!isInsideSingleOrDoubleQuotes(command, i))
+            return true;
+    }
+    return false;
+}
+function hasUnquotedParen(command) {
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (ch !== "(" && ch !== ")")
+            continue;
+        if (!isInsideSingleOrDoubleQuotes(command, i))
+            return true;
+    }
+    return false;
+}
 /** Apply one dir token to `cwd`, or signal ambiguity if it cannot be statically resolved. */
 function applyDir(token, cwd) {
     if (!token)
@@ -683,11 +707,85 @@ function isTrustedCwdChainStart(commandPrefix, chainStart) {
     const before = commandPrefix.slice(0, chainStart).trimEnd();
     return before.endsWith("&&") || before.endsWith("(") || before.endsWith("{");
 }
-function applySuccessGatedCwdChain(commandPrefix, baseCwd) {
+/**
+ * Split a pure `&&` command prefix into segments. Returns null when the prefix
+ * uses `;` / `|` / braces / newlines we refuse to model.
+ */
+function splitSuccessGatedAndSegments(commandPrefix) {
+    if (!commandPrefix.trim())
+        return [];
+    if (hasUnquotedUnsafeAndChainControl(commandPrefix))
+        return null;
+    const segments = [];
+    let current = "";
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < commandPrefix.length; i += 1) {
+        const ch = commandPrefix[i] ?? "";
+        if (escaped) {
+            current += ch;
+            escaped = false;
+            continue;
+        }
+        if (quote !== "'" && ch === "\\") {
+            escaped = true;
+            current += ch;
+            continue;
+        }
+        if ((ch === '"' || ch === "'") && (quote === null || quote === ch)) {
+            quote = quote === ch ? null : ch;
+            current += ch;
+            continue;
+        }
+        if (!quote && ch === "&" && commandPrefix[i + 1] === "&") {
+            if (current.trim())
+                segments.push(current);
+            current = "";
+            i += 1;
+            continue;
+        }
+        current += ch;
+    }
+    if (quote || escaped)
+        return null;
+    if (current.trim())
+        segments.push(current);
+    return segments;
+}
+/**
+ * Walk pure `&&` segments: resolvable cd/pushd updates cwd; other segments must
+ * not smuggle unquoted cwd changes. Enables
+ * `cd <managed-worktree> && ./bin/wp … && git commit`.
+ */
+function applyAndSegmentCwdChain(commandPrefix, baseCwd) {
+    const segments = splitSuccessGatedAndSegments(commandPrefix);
+    if (segments === null)
+        return { ambiguous: true };
+    if (segments.length === 0)
+        return { ambiguous: false, cwd: baseCwd };
+    let cwd = baseCwd;
+    for (const segment of segments) {
+        const pureCd = PURE_CD_SEGMENT.exec(segment);
+        if (pureCd) {
+            const next = applyDir(pureCd[1], cwd);
+            if (next === "ambiguous")
+                return { ambiguous: true };
+            cwd = next.cwd;
+            continue;
+        }
+        if (hasUnquotedCwdCommand(segment))
+            return { ambiguous: true };
+    }
+    return { ambiguous: false, cwd };
+}
+/**
+ * Legacy trailing pure-cd chain (and subshell-local `(cd X && git …)` forms).
+ * Kept for paren-scoped ops; intermediate non-cd commands are handled by
+ * {@link applyAndSegmentCwdChain} when no unquoted parens are present.
+ */
+function applyLegacyTrailingCdChain(commandPrefix, baseCwd) {
     const chain = CD_CHAIN.exec(commandPrefix);
     const chainStart = chain?.index ?? commandPrefix.length;
-    // If there is any other unquoted cwd-changing syntax before this simple chain,
-    // we cannot prove the chain governs the op. Fail closed.
     if (hasUnquotedCwdCommand(commandPrefix.slice(0, chainStart)))
         return { ambiguous: true };
     if (!chain)
@@ -703,6 +801,20 @@ function applySuccessGatedCwdChain(commandPrefix, baseCwd) {
     }
     return { ambiguous: false, cwd };
 }
+/**
+ * Success-gated cwd chain for a forbidden git op's command prefix.
+ *
+ * Prefer the `&&`-segment walk when the prefix has no unquoted parentheses so
+ * agents can run tools between a managed `cd` and a mutation. When parentheses
+ * appear (subshell-local ops), fall back to the legacy trailing-cd chain so
+ * non-persistent `(cd …) && git …` stays fail-closed.
+ */
+function applySuccessGatedCwdChain(commandPrefix, baseCwd) {
+    if (!hasUnquotedParen(commandPrefix)) {
+        return applyAndSegmentCwdChain(commandPrefix, baseCwd);
+    }
+    return applyLegacyTrailingCdChain(commandPrefix, baseCwd);
+}
 /**
  * The directory the git op actually runs in: `baseCwd` lowered by the
  * success-gated cwd chain that directly governs this op, then through EVERY

package/dist/esm/mcp/tools/_shared/audit-kinds.d.ts

@@ -1,3 +1,3 @@
-export declare const MCP_AUDIT_KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "session-memory-hardcut", "worktree-main-ownership", "sast"];
+export declare const MCP_AUDIT_KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "sast"];
 export type MCPAuditKind = (typeof MCP_AUDIT_KINDS)[number];
 export declare function isMCPAuditKind(value: string): value is MCPAuditKind;

package/dist/esm/mcp/tools/audit.d.ts

@@ -15,7 +15,7 @@
  */
 import { z } from "zod";
 import type { ToolDescriptor } from "#mcp/auto-discover";
-export declare const KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "session-memory-hardcut", "worktree-main-ownership", "sast"];
+export declare const KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "sast"];
 export declare const inputSchema: z.ZodObject<{
     kind: z.ZodEnum<{
         "absolute-path-policy": "absolute-path-policy";
@@ -54,6 +54,7 @@ export declare const inputSchema: z.ZodObject<{
         "session-memory-hardcut": "session-memory-hardcut";
         "supported-agent-clis": "supported-agent-clis";
         "tech-debt": "tech-debt";
+        "test-scan-perf": "test-scan-perf";
         "test-smells": "test-smells";
         "toolchain-isolation": "toolchain-isolation";
         "tph-e2e": "tph-e2e";

package/dist/esm/mcp/tools/audit.js

@@ -464,6 +464,16 @@ export async function dispatchAudit(input) {
                 details: auditResult,
             };
         }
+        case "test-scan-perf": {
+            const { auditTestScanPerf } = await import("#audit/test-scan-perf");
+            const auditResult = auditTestScanPerf(input.cwd ?? input.directory ?? process.cwd());
+            return {
+                passed: auditResult.ok,
+                summary: summarizeRepoAudit(kind, auditResult),
+                kind,
+                details: auditResult,
+            };
+        }
         case "hook-surface": {
             const { auditHookSurface } = await import("#audit/hook-surface");
             const auditResult = auditHookSurface(input.cwd ?? input.directory);

package/dist/esm/mcp/tools/audits.d.ts

@@ -50,6 +50,7 @@ declare const inputSchema: z.ZodObject<{
         "session-memory-hardcut": "session-memory-hardcut";
         "supported-agent-clis": "supported-agent-clis";
         "tech-debt": "tech-debt";
+        "test-scan-perf": "test-scan-perf";
         "test-smells": "test-smells";
         "toolchain-isolation": "toolchain-isolation";
         "tph-e2e": "tph-e2e";

package/dist/esm/mcp/tools/ci-act.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { DEFAULT_CI_ACT_TIMEOUT_MS, MAX_CI_ACT_TIMEOUT_MS } from "#cli/commands/ci";
-import { buildPublicCiActCommand, preparePublicCiActExecution, resolveCiActExecutionMode, resolveCiActSecretEnvProfile, sanitizePublicCiActArgv, } from "#ci/act-runner.js";
+import { DEFAULT_CI_ACT_TIMEOUT_MS, MAX_CI_ACT_TIMEOUT_MS, SMOKE_CI_ACT_TIMEOUT_MS, } from "#cli/commands/ci";
+import { buildPublicCiActCommand, preparePublicCiActExecution, resolveCiActExecutionMode, resolveCiActSecretEnvProfile, sanitizePublicCiActArgv, shouldForceCiActSecretGate, } from "#ci/act-runner.js";
 import { isSecretGateRuntimeProfile, runSecretGateCommand } from "#secret-gate/runner.js";
 import { clipRawOutput, createSummaryOutputSchema, createSummaryResult } from "./_shared/result.js";
 import { resolveProjectRoot } from "./_shared/project-root.js";
@@ -10,6 +10,7 @@ const inputSchema = z
     cwd: z.string().optional(),
     workflowPath: z.string(),
     job: z.string().optional(),
+    matrix: z.array(z.string()).optional().default([]),
     eventName: z
         .enum(["pull_request", "push", "workflow_dispatch"])
         .optional()
@@ -24,13 +25,8 @@ const inputSchema = z
     }),
     secretProfile: z.string().optional(),
     mode: z.enum(["direct", "replay"]).optional().default("direct"),
-    timeoutMs: z
-        .number()
-        .int()
-        .positive()
-        .max(MAX_CI_ACT_TIMEOUT_MS)
-        .optional()
-        .default(DEFAULT_CI_ACT_TIMEOUT_MS),
+    smoke: z.boolean().optional().default(false),
+    timeoutMs: z.number().int().positive().max(MAX_CI_ACT_TIMEOUT_MS).optional(),
     containerArchitecture: z.string().optional(),
     platformImage: z.string().optional().default("ghcr.io/catthehacker/ubuntu:full-latest"),
     execute: z.boolean().optional().default(false),
@@ -96,6 +92,7 @@ const tool = {
     handler: async (raw, extra) => {
         const input = inputSchema.parse(raw ?? {});
         const cwd = resolveProjectRoot(input.cwd ? { cwd: input.cwd } : {});
+        const timeoutMs = input.timeoutMs ?? (input.smoke ? SMOKE_CI_ACT_TIMEOUT_MS : DEFAULT_CI_ACT_TIMEOUT_MS);
         if (!input.execute) {
             return createSummaryResult({
                 passed: true,
@@ -108,13 +105,14 @@ const tool = {
             const secretProfile = resolveCiActSecretEnvProfile({ ...input, cwd }) ?? "preview";
             const result = await runSecretGateCommand({
                 cwd,
+                commandCwd: prepared.cwd,
                 sink: "act",
                 profile: secretProfile,
                 envProfile: input.envProfile,
-                forceSecretGate: true,
+                forceSecretGate: shouldForceCiActSecretGate(input.envProfile),
                 command: "act",
                 args: prepared.command.actArgs,
-                timeoutMs: input.timeoutMs,
+                timeoutMs,
                 signal: extra?.signal,
             });
             const merged = [result.stdout, result.stderr].filter(Boolean).join("\n");

package/dist/esm/paths/state-root.js

@@ -247,6 +247,9 @@ export async function getSurfacePathAsync(name, scope, cwd = resolveCwd()) {
 export async function withLock(scope, fn, cwd) {
     const lockTarget = await getSurfacePathAsync(".lock", scope, cwd);
     mkdirSync(dirname(lockTarget), { recursive: true });
+    // Keep retries short so lock-contention probes (review gate contender tests)
+    // still fail closed in a few seconds. Dual-writer create loops retry at the
+    // call site when they need longer budgets under CI load.
     const release = await lockfile.lock(lockTarget, {
         realpath: false,
         retries: { retries: 5, minTimeout: 50, maxTimeout: 500, factor: 2 },

package/dist/esm/review/authority.js

@@ -9,7 +9,7 @@ import { createHash } from "node:crypto";
 import { existsSync, lstatSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { evaluateReviewEvents, parseReviewEventLog } from "./events.js";
-import { createDeliverySubjectAtRef, createPlanSubjectAtRef, resolveReviewCommit, } from "./subject.js";
+import { createDeliverySubjectAtRef, createLegacyPlanSubjectAtRef, createPlanSubjectAtRef, resolveReviewCommit, } from "./subject.js";
 const GIT_TIMEOUT_MS = 5_000;
 const GIT_MAX_BUFFER_BYTES = 128 * 1024 * 1024;
 const REGULAR_MODE_PATTERN = /^100(?:644|755)$/u;
@@ -126,12 +126,27 @@ export function readReviewAuthorityAtRef(cwd, ref, stableSlug, purpose) {
     const subject = purpose === "plan"
         ? createPlanSubjectAtRef(cwd, commit, stableSlug, overview.path)
         : createDeliverySubjectAtRef(cwd, commit, stableSlug, overview.path);
-    const evaluation = evaluateReviewEvents(events, {
+    let evaluation = evaluateReviewEvents(events, {
         purpose,
         blueprintSlug: stableSlug,
         subjectScheme: subject.scheme,
         subjectDigest: subject.digest,
     }, compromisedIds);
+    if (purpose === "plan" && evaluation.approvals.length === 0) {
+        // Digest-compatibility fallback: events recorded before the lifecycle
+        // stripped-key extension bound their subjectDigest to the legacy
+        // normalization. Accept those for the same tracked content; new events
+        // always record the current digest (see legacyNormalizePlanSubjectContent).
+        const legacySubject = createLegacyPlanSubjectAtRef(cwd, commit, stableSlug, overview.path);
+        if (legacySubject.digest !== subject.digest) {
+            evaluation = evaluateReviewEvents(events, {
+                purpose,
+                blueprintSlug: stableSlug,
+                subjectScheme: legacySubject.scheme,
+                subjectDigest: legacySubject.digest,
+            }, compromisedIds);
+        }
+    }
     return {
         commit,
         blueprintPath: overview.path,

package/dist/esm/review/availability.js

@@ -3,11 +3,7 @@ import path from "node:path";
 import { NotInGitRepoError, withLock } from "#paths/state-root.js";
 import { writeJsonFileAtomic } from "#shared-utils/write-json-file.js";
 export const REVIEW_AVAILABILITY_SCHEMA_VERSION = 1;
-const FAILURE_CLASSIFICATIONS = new Set([
-    "provider-limit-reached",
-    "provider-unavailable",
-    "provider-failed",
-]);
+const FAILURE_CLASSIFICATIONS = new Set(["provider-limit-reached", "provider-unavailable"]);
 const SUCCESS_CLASSIFICATIONS = new Set([
     "complete",
     "approved",
@@ -117,6 +113,10 @@ export function saveReviewAvailability(projectRoot, state) {
 function shouldSuppress(event) {
     return FAILURE_CLASSIFICATIONS.has(event.terminalClassification);
 }
+function suppressedRecordStillApplies(record) {
+    return (record.terminalClassification !== undefined &&
+        FAILURE_CLASSIFICATIONS.has(record.terminalClassification));
+}
 function isAvailabilitySuccess(event) {
     return SUCCESS_CLASSIFICATIONS.has(event.terminalClassification);
 }
@@ -155,6 +155,15 @@ function nextRecord(previous, event, input) {
     const success = isAvailabilitySuccess(event);
     if (!input.suppress) {
         const preserveSuppression = !success && previous?.suppressed === true;
+        if (preserveSuppression) {
+            return {
+                ...previous,
+                ...(event.model ? { lastModel: event.model } : {}),
+                ...(event.effort ? { lastEffort: event.effort } : {}),
+                ...(event.stage ? { lastStage: event.stage } : {}),
+                suppressed: true,
+            };
+        }
         return {
             ...common,
             ...(success
@@ -244,6 +253,10 @@ export function suppressedReviewers(state) {
 export function pruneExpiredAvailabilitySuppressions(state, nowMs = Date.now()) {
     const pruned = [];
     const pruneMap = (records) => Object.fromEntries(Object.entries(records).map(([key, record]) => {
+        if (record.suppressed && !suppressedRecordStillApplies(record)) {
+            pruned.push(key);
+            return [key, { ...record, suppressed: false }];
+        }
         if (record.suppressed &&
             record.retryAfterMs !== undefined &&
             record.lastFailureAt !== undefined) {

package/dist/esm/review/subject.d.ts

@@ -18,7 +18,22 @@ declare function updateField(hash: Hash, value: Buffer | string): void;
 export declare function createDeliverySubjectAtRef(cwd: string, ref: string, blueprintSlug: string, blueprintPath?: string): ReviewSubject;
 export declare function createSourceSubjectAtRef(cwd: string, ref: string): ReviewSubject;
 export declare function normalizePlanSubjectContent(content: Buffer | string): Buffer;
+/**
+ * Plan-subject digest for in-memory (working-tree) blueprint content. Used to
+ * accept working-ledger review events that digest-bind the exact bytes being
+ * committed (pre-commit runs before those events reach any git ref).
+ */
+export declare function createPlanSubjectDigestForContent(blueprintSlug: string, content: Buffer | string): string;
+/**
+ * Digest-compatibility variant for review events recorded before the
+ * stripped-key extension of `neutralizeLifecycleFrontmatter`. Verification
+ * accepts a match against either normalization; new digests always use
+ * `normalizePlanSubjectContent`.
+ */
+export declare function legacyNormalizePlanSubjectContent(content: Buffer | string): Buffer;
 export declare function createPlanSubjectAtRef(cwd: string, ref: string, blueprintSlug: string, blueprintPath?: string): ReviewSubject;
+/** Plan subject digested with the pre-extension normalization (see above). */
+export declare function createLegacyPlanSubjectAtRef(cwd: string, ref: string, blueprintSlug: string, blueprintPath?: string): ReviewSubject;
 export declare const reviewSubjectInternals: {
     isExcludedReviewEnvelope: typeof isExcludedReviewEnvelope;
     isReviewEvidencePath: typeof isReviewEvidencePath;

package/dist/esm/review/subject.js

@@ -255,12 +255,39 @@ function neutralizePromotionGateResults(text) {
     }
     return lines.join("\n");
 }
-// Neutralize the lifecycle-owned frontmatter fields (`status:` value and the
-// `completed_at:` line) INSIDE the leading frontmatter block only. A body line
+// Frontmatter keys removed wholesale by the normalizer (value + folded
+// continuation lines). Each mirrors exactly one lifecycle writer:
+// `completed_at` (upsertCompletedAt) and the `wp blueprint start` /
+// progress-stamp fields (setBlueprintFrontmatterFields lifecycle intents).
+const PLAN_LIFECYCLE_STRIPPED_KEYS = [
+    "completed_at",
+    "last_updated",
+    "progress",
+    "worktree_owner_id",
+    "worktree_owner_branch",
+];
+// Neutralize the lifecycle-owned frontmatter fields (`status:` value plus the
+// stripped keys above) INSIDE the leading frontmatter block only. A body line
 // that merely looks like one of these (e.g. task text reading
 // "completed_at: must remain unset until release") is plan substance and must
-// keep affecting the digest.
+// keep affecting the digest. Stripping removes the key line and any indented
+// continuation lines so folded (`>-`) values normalize away too.
 function neutralizeLifecycleFrontmatter(text) {
+    const match = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/u.exec(text);
+    if (!match)
+        return text;
+    let frontmatter = match[0];
+    frontmatter = frontmatter.replace(/^(status:\s*)(['"]?)[^'"\r\n]+?(['"]?)(\s*)$/m, `$1${PLAN_STATUS_PLACEHOLDER}$4`);
+    for (const key of PLAN_LIFECYCLE_STRIPPED_KEYS) {
+        frontmatter = frontmatter.replace(new RegExp(String.raw `^${key}:[^\n]*\n?(?:[ \t]+[^\n]*\n?)*`, "gmu"), "");
+    }
+    return `${frontmatter}${text.slice(match[0].length)}`;
+}
+// The pre-extension normalizer (status + completed_at only). Review events
+// recorded before the stripped-key extension bound their subjectDigest to this
+// normalization; verification accepts either digest so committed approvals are
+// not stranded by the rollout. New events always record the current digest.
+function legacyNeutralizeLifecycleFrontmatter(text) {
     const match = /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/u.exec(text);
     if (!match)
         return text;
@@ -305,21 +332,85 @@ function neutralizeReadinessStamps(text) {
 // NO_CODE_CHANGE / GitLab patch-id semantics: approvals are re-derivable from
 // substance-only digests, not carried). Each rule mirrors exactly one
 // lifecycle writer, scoped to the location that writer owns:
-// - frontmatter `status:` value       (updateFrontmatterStatus, blueprint mutations)
-// - frontmatter `completed_at:` line  (upsertCompletedAt)
+// - frontmatter status/progress/owner fields (blueprint lifecycle mutations)
+// - frontmatter `completed_at:` line       (upsertCompletedAt)
 // - Readiness Verdict `- verified-at:`/`- verified-head:` items (upsertReadinessValue)
 // - Promotion Gates "Last result" cells (updateGateLastResult)
 // Any other byte change — task text, acceptance criteria, scope, lookalike
 // lines outside the owned locations — still changes the digest and dismisses
 // prior plan approvals.
+const PLAN_TASK_STATUS_PLACEHOLDER = "__wp-task-status__";
+// Neutralize the task-execution state the lifecycle engine writes
+// (updateTaskStatus, applyVerification): `**Status:** <status>` lines,
+// acceptance checkbox marks, and `**Verification:**` +
+// ```webpresso-evidence-v1 fenced evidence blocks. Task execution is lifecycle
+// state, not plan substance — without this, the engine's own task_verify /
+// finalize writes dismiss the plan approval and no completion commit can ever
+// carry authority. Acceptance-criteria TEXT stays substance; only the check
+// mark is neutralized.
+function neutralizeTaskExecutionState(text) {
+    const lines = text.split("\n");
+    const out = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index];
+        if (/^\*\*Verification:\*\*\s*$/u.test(line)) {
+            // Skip the writer-owned block: "**Verification:**", blank(s), the
+            // evidence fence, and one trailing blank line.
+            let cursor = index + 1;
+            while (cursor < lines.length && lines[cursor].trim() === "")
+                cursor += 1;
+            if (/^```webpresso-evidence-v1\s*$/u.test(lines[cursor] ?? "")) {
+                cursor += 1;
+                while (cursor < lines.length && !/^```\s*$/u.test(lines[cursor]))
+                    cursor += 1;
+                cursor += 1; // closing fence
+                if ((lines[cursor] ?? "").trim() === "")
+                    cursor += 1;
+                index = cursor - 1;
+                continue;
+            }
+        }
+        if (/^\*\*Status:\*\* (?:todo|in-progress|blocked|done|dropped)\s*$/u.test(line)) {
+            out.push(`**Status:** ${PLAN_TASK_STATUS_PLACEHOLDER}`);
+            continue;
+        }
+        out.push(line.replace(/^(\s*)- \[[xX ]\] /u, "$1- [_] "));
+    }
+    return out.join("\n");
+}
 export function normalizePlanSubjectContent(content) {
     let text = typeof content === "string" ? content : content.toString("utf8");
     text = neutralizeLifecycleFrontmatter(text);
     text = neutralizeReadinessStamps(text);
     text = neutralizePromotionGateResults(text);
+    text = neutralizeTaskExecutionState(text);
     return Buffer.from(text, "utf8");
 }
-export function createPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
+/**
+ * Plan-subject digest for in-memory (working-tree) blueprint content. Used to
+ * accept working-ledger review events that digest-bind the exact bytes being
+ * committed (pre-commit runs before those events reach any git ref).
+ */
+export function createPlanSubjectDigestForContent(blueprintSlug, content) {
+    const hash = createHash("sha256").update(PLAN_DOMAIN);
+    updateField(hash, blueprintSlug);
+    updateField(hash, normalizePlanSubjectContent(content));
+    return hash.digest("hex");
+}
+/**
+ * Digest-compatibility variant for review events recorded before the
+ * stripped-key extension of `neutralizeLifecycleFrontmatter`. Verification
+ * accepts a match against either normalization; new digests always use
+ * `normalizePlanSubjectContent`.
+ */
+export function legacyNormalizePlanSubjectContent(content) {
+    let text = typeof content === "string" ? content : content.toString("utf8");
+    text = legacyNeutralizeLifecycleFrontmatter(text);
+    text = neutralizeReadinessStamps(text);
+    text = neutralizePromotionGateResults(text);
+    return Buffer.from(text, "utf8");
+}
+function planSubjectAtRef(cwd, ref, blueprintSlug, normalize, blueprintPath) {
     const commit = resolveReviewCommit(cwd, ref);
     const entries = parseTree(cwd, commit);
     const blueprintRoot = findBlueprintRoot(entries, blueprintSlug, blueprintPath);
@@ -333,10 +424,7 @@ export function createPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
         throw new Error("Tracked blueprint overview content is unavailable.");
     const hash = createHash("sha256").update(PLAN_DOMAIN);
     updateField(hash, blueprintSlug);
-    // Hash normalized content. This redefines wp-blueprint-v1 in place, which is
-    // safe pre-merge: no committed review-events.jsonl exists anywhere, so no
-    // recorded plan digest can break.
-    updateField(hash, normalizePlanSubjectContent(content));
+    updateField(hash, normalize(content));
     return {
         scheme: "wp-blueprint-v1",
         digest: hash.digest("hex"),
@@ -344,6 +432,13 @@ export function createPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
         files: [overviewPath.toString("utf8")],
     };
 }
+export function createPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
+    return planSubjectAtRef(cwd, ref, blueprintSlug, normalizePlanSubjectContent, blueprintPath);
+}
+/** Plan subject digested with the pre-extension normalization (see above). */
+export function createLegacyPlanSubjectAtRef(cwd, ref, blueprintSlug, blueprintPath) {
+    return planSubjectAtRef(cwd, ref, blueprintSlug, legacyNormalizePlanSubjectContent, blueprintPath);
+}
 export const reviewSubjectInternals = {
     isExcludedReviewEnvelope,
     isReviewEvidencePath,

package/dist/esm/runtime/executor.d.ts

@@ -14,6 +14,7 @@ export interface ResolveRuntimeEnvironmentOptions {
 }
 export interface RuntimeSpawnOptions {
     readonly cwd?: string;
+    readonly envCwd?: string;
     readonly profile?: RuntimeSelector;
     readonly secretProfile?: string;
     readonly environment?: string;

package/dist/esm/runtime/executor.js

@@ -82,9 +82,10 @@ export function resolveRuntimeEnvironment(options = {}) {
 }
 export function buildRuntimeSpawnOptions(options = {}) {
     const cwd = options.cwd ?? process.cwd();
+    const envCwd = options.envCwd ?? cwd;
     const cache = options.cache ?? createRuntimeEnvCache();
     const resolvedEnv = resolveRuntimeEnvironment({
-        cwd,
+        cwd: envCwd,
         profile: options.profile,
         secretProfile: options.secretProfile,
         environment: options.environment,

package/dist/esm/secret-gate/runner.d.ts

@@ -11,6 +11,7 @@ export interface SecretGateCommandOptions {
     readonly command: string;
     readonly args?: readonly string[];
     readonly cwd?: string;
+    readonly commandCwd?: string;
     readonly timeoutMs?: number;
     readonly signal?: AbortSignal;
     readonly forceSecretGate?: boolean;

package/dist/esm/secret-gate/runner.js

@@ -35,6 +35,7 @@ export function buildSecretGateCommand(options) {
         sink,
         "--profile",
         profile,
+        ...(options.commandCwd ? ["--command-cwd", options.commandCwd] : []),
         "--",
         options.command,
         ...(options.args ?? []),
@@ -45,9 +46,11 @@ export function runSecretGateCommand(options) {
     const timeoutMs = options.timeoutMs ?? 30_000;
     const maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
     const command = buildSecretGateCommand(options);
+    const runsInnerCommandDirectly = command.command === options.command;
+    const spawnCwd = runsInnerCommandDirectly && options.commandCwd ? options.commandCwd : options.cwd;
     return new Promise((resolve) => {
         const child = spawn(command.command, [...command.args], {
-            cwd: options.cwd,
+            cwd: spawnCwd,
             env: buildRuntimeProcessEnv(options.cwd, process.env),
             detached: process.platform !== "win32",
         });

package/dist/esm/worktrees/current.d.ts

@@ -1,5 +1,6 @@
 import { type WorktreeDependencyResult } from "./dependencies.js";
 export interface ManagedWorktreeContext {
+    readonly kind: "owner" | "scratch";
     readonly repoRoot: string;
     readonly worktreePath: string;
 }

package/dist/esm/worktrees/current.js

@@ -20,6 +20,7 @@ export function resolveCurrentManagedWorktreeContext(cwd) {
     if (!candidate)
         return null;
     return {
+        kind: candidate.entry.kind,
         repoRoot: candidate.entry.repoRoot,
         worktreePath,
     };