@webpresso/agent-kit 3.2.0 → 3.3.0

package/dist/esm/hooks/pretool-guard/validators/worktree-discipline.js

@@ -95,7 +95,12 @@ export function validateWorktreeDiscipline(input) {
     return { validator: VALIDATOR_NAME, passed: true };
 }
 function normalizedToolName(input) {
-    return (input.tool_name ?? "").toLowerCase().replaceAll(/[^a-z]/gu, "");
+    // tool_name is typed string but malformed host envelopes can deliver non-strings;
+    // never call string methods without a typeof guard (same class as isBashInput).
+    const raw = input.tool_name;
+    if (typeof raw !== "string")
+        return "";
+    return raw.toLowerCase().replaceAll(/[^a-z]/gu, "");
 }
 function applyPatchTargets(input) {
     if (!normalizedToolName(input).endsWith("applypatch"))

package/dist/esm/hooks/shared/types.js

@@ -78,7 +78,33 @@ export function resolveHookSessionId(input, env = process.env) {
     return undefined;
 }
 export function isBashInput(input) {
-    return "command" in (input.tool_input || {});
+    // A bare `command` field is NOT sufficient: Codex delivers `apply_patch` patch
+    // text inside `tool_input.command`, the same field a shell command uses.
+    // Discriminate on the tool name instead. Absent / non-string tool name ⇒
+    // unknown/legacy host ⇒ classify as shell so command guards still fire (a
+    // guard must fail toward inspecting, never toward silently skipping). Malformed
+    // non-string tool_name must not throw (optional chaining only guards nullish).
+    if (!("command" in (input.tool_input || {})))
+        return false;
+    const rawToolName = input.tool_name;
+    const toolName = typeof rawToolName === "string" ? rawToolName.trim().toLowerCase() : undefined;
+    if (!toolName)
+        return true;
+    return (toolName === "bash" ||
+        toolName === "shell" ||
+        toolName === "exec" ||
+        toolName === "exec_command" ||
+        // Codex names its sandboxed shell tool `local_shell` (see
+        // session-memory/provider-readers `local_shell_call`); without it a real
+        // shell command bypasses the danger/forbidden/worktree guards.
+        toolName === "local_shell" ||
+        // Grok's shell tool: `run_terminal_command` (envelope name) and the internal
+        // `run_terminal_cmd` its Bash-mapping surfaces (docs.x.ai/build/features/hooks).
+        toolName === "run_terminal_command" ||
+        toolName === "run_terminal_cmd" ||
+        toolName.endsWith(".exec_command") ||
+        toolName.endsWith("_exec_command") ||
+        toolName.endsWith("__exec_command"));
 }
 export function isFileEditInput(input) {
     const toolInput = input.tool_input || {};

package/dist/esm/hooks/stop/qa-changed-files.js

@@ -98,6 +98,24 @@ const CROSS_CUTTING_TEST_DEPENDENTS = [
         when: /^(README\.md|docs\/guides\/session-memory\.md)$/u,
         tests: ["src/mcp/tools/session-docs.test.ts", "src/build/package-manifest.test.ts"],
     },
+    {
+        // blueprint-server.ts owns the MCP architecture contract (tool naming,
+        // handler wiring, transport shape). Its architecture test is not colocated
+        // under the same basename, so --affected would otherwise skip it.
+        when: /^src\/mcp\/blueprint-server\./u,
+        tests: ["src/mcp/blueprint-server.test-architecture.test.ts"],
+    },
+    {
+        // Package surface / publishability contracts live in the audit package,
+        // not next to package.json or the manifest builder.
+        when: /^(package\.json|src\/build\/package-manifest\.ts)$/u,
+        tests: ["src/audit/package-surface.test.ts"],
+    },
+    {
+        // Marketplace and plugin.json validation is a build-side contract test.
+        when: /^\.claude-plugin\/(marketplace|plugin)\.json$/u,
+        tests: ["src/build/validate-marketplace.test.ts"],
+    },
 ];
 /**
  * Every test path the cross-cutting map can yield.

package/dist/esm/mcp/blueprint/handlers/document-mutations.d.ts

@@ -194,6 +194,11 @@ export declare const putInputJsonSchema: {
                                     last_result: {
                                         type: string;
                                     };
+                                    defer: {
+                                        type: string;
+                                        const: string;
+                                        description: string;
+                                    };
                                 };
                                 required: string[];
                                 additionalProperties: boolean;

package/dist/esm/mcp/blueprint/handlers/document-mutations.js

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import matter from "gray-matter";
 import { parseBlueprint } from "#core/parser";
+import { taskIdSchema } from "#core/schema";
 import { evaluateApprovalGate, formatApprovalGateRequirement } from "#lifecycle/audit";
 import { canonicalizeBlueprint } from "#lifecycle/canonicalize.js";
 import { BlueprintCreationService } from "#service/BlueprintCreationService";
@@ -40,7 +41,7 @@ const createSchema = MutationTarget.extend({
     head_at_ingest: z.string().nullable().optional(),
 });
 const putTaskSchema = z.object({
-    id: z.string().min(1),
+    id: taskIdSchema,
     title: z.string().min(1),
     status: z.enum(["todo", "in-progress", "blocked", "done", "dropped"]).default("todo"),
     wave: z.string().optional(),
@@ -72,6 +73,12 @@ const putPromotionGateSchema = z.object({
     command: z.string().min(1),
     expected_outcome: z.string().min(1),
     last_result: z.string().min(1),
+    // Explicit per-gate pre-implementation deferral. When set, `wp blueprint
+    // promote` skips executing/existence-checking this gate's command entirely
+    // and records a `deferred: ...` Last result instead. See
+    // src/blueprint/trust/promotion.ts and catalog/agent/rules
+    // /pre-implementation.md's Promotion gate section.
+    defer: z.literal("pre-implementation").optional(),
 });
 const putTrustDossierSchema = z.object({
     readiness: putTrustReadinessSchema,
@@ -180,6 +187,11 @@ const putTrustDossierJsonSchema = {
                     command: { type: "string", description: "wp or ./bin/wp facade command" },
                     expected_outcome: { type: "string" },
                     last_result: { type: "string" },
+                    defer: {
+                        type: "string",
+                        const: "pre-implementation",
+                        description: "Explicit opt-in: skip executing/existence-checking this gate at promote time",
+                    },
                 },
                 required: ["gate", "command", "expected_outcome", "last_result"],
                 additionalProperties: false,
@@ -323,12 +335,7 @@ function renderTrustDossierMarkdown(dossier) {
         "",
         "### Promotion Gates",
         "",
-        ...renderMarkdownTable(["Gate", "Command", "Expected outcome", "Last result"], dossier.promotion_gates.map((gate) => [
-            gate.gate,
-            gate.command,
-            gate.expected_outcome,
-            gate.last_result,
-        ])),
+        ...renderPromotionGatesTable(dossier.promotion_gates),
         "",
         "### Residual Unknowns",
         "",
@@ -336,6 +343,23 @@ function renderTrustDossierMarkdown(dossier) {
         "",
     ];
 }
+// Only emits the (opt-in) Defer column when at least one gate uses it, so
+// the common no-defer case keeps rendering the legacy 4-column table exactly
+// as before -- matching src/blueprint/trust/dossier.ts's parser, which
+// accepts either width.
+function renderPromotionGatesTable(gates) {
+    const hasDefer = gates.some((gate) => gate.defer !== undefined);
+    if (!hasDefer) {
+        return renderMarkdownTable(["Gate", "Command", "Expected outcome", "Last result"], gates.map((gate) => [gate.gate, gate.command, gate.expected_outcome, gate.last_result]));
+    }
+    return renderMarkdownTable(["Gate", "Command", "Expected outcome", "Last result", "Defer"], gates.map((gate) => [
+        gate.gate,
+        gate.command,
+        gate.expected_outcome,
+        gate.last_result,
+        gate.defer ?? "",
+    ]));
+}
 function normalizeResidualUnknowns(value) {
     if (value === undefined)
         return "None.";

package/dist/esm/mcp/tools/_shared/audit-kinds.d.ts

@@ -1,3 +1,3 @@
-export declare const MCP_AUDIT_KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "host-substitution-risk", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "typescript-version", "ci-guardrails-wiring", "sast"];
+export declare const MCP_AUDIT_KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "host-substitution-risk", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "typescript-version", "ci-guardrails-wiring", "sast", "changeset-required"];
 export type MCPAuditKind = (typeof MCP_AUDIT_KINDS)[number];
 export declare function isMCPAuditKind(value: string): value is MCPAuditKind;

package/dist/esm/mcp/tools/audit.d.ts

@@ -15,7 +15,7 @@
  */
 import { z } from "zod";
 import type { ToolDescriptor } from "#mcp/auto-discover";
-export declare const KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "host-substitution-risk", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "typescript-version", "ci-guardrails-wiring", "sast"];
+export declare const KINDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "host-substitution-risk", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "typescript-version", "ci-guardrails-wiring", "sast", "changeset-required"];
 export declare const inputSchema: z.ZodObject<{
     kind: z.ZodEnum<{
         "absolute-path-policy": "absolute-path-policy";
@@ -29,6 +29,7 @@ export declare const inputSchema: z.ZodObject<{
         "blueprint-trust": "blueprint-trust";
         "bundle-budget": "bundle-budget";
         "catalog-drift": "catalog-drift";
+        "changeset-required": "changeset-required";
         "ci-guardrails-wiring": "ci-guardrails-wiring";
         "ci-test-perf": "ci-test-perf";
         "cloudflare-deploy-contract": "cloudflare-deploy-contract";

package/dist/esm/mcp/tools/audit.js

@@ -569,6 +569,18 @@ export async function dispatchAudit(input) {
                 details: auditResult,
             };
         }
+        case "changeset-required": {
+            const { auditChangesetRequired } = await import("#audit/changeset-required");
+            const auditResult = auditChangesetRequired(input.cwd ?? input.directory ?? process.cwd(), {
+                baseRef: input.baseRef,
+            });
+            return {
+                passed: auditResult.ok,
+                summary: summarizeRepoAudit(kind, auditResult),
+                kind,
+                details: auditResult,
+            };
+        }
         default: {
             // Exhaustiveness check — z.enum should make this unreachable.
             const _exhaustive = kind;

package/dist/esm/mcp/tools/audits.d.ts

@@ -25,6 +25,7 @@ declare const inputSchema: z.ZodObject<{
         "blueprint-trust": "blueprint-trust";
         "bundle-budget": "bundle-budget";
         "catalog-drift": "catalog-drift";
+        "changeset-required": "changeset-required";
         "ci-guardrails-wiring": "ci-guardrails-wiring";
         "ci-test-perf": "ci-test-perf";
         "cloudflare-deploy-contract": "cloudflare-deploy-contract";

package/dist/esm/mcp/tools/session-fetch-and-index.d.ts

@@ -1,6 +1,6 @@
 import type { ToolDescriptor, ToolHandlerExtra, ToolHandlerResult } from "#mcp/auto-discover";
 export interface SessionFetchAndIndexDeps {
-    readonly fetchImpl?: typeof fetch;
+    readonly fetchImpl?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 }
 export declare function handleSessionFetchAndIndex(raw: unknown, extra?: ToolHandlerExtra, deps?: SessionFetchAndIndexDeps): Promise<ToolHandlerResult>;
 declare const tool: ToolDescriptor;

package/dist/esm/package.json

@@ -89,6 +89,8 @@
     "#compiler/*": "./compiler/*.js",
     "#review/*.js": "./review/*.js",
     "#review/*": "./review/*.js",
+    "#rust/*.js": "./rust/*.js",
+    "#rust/*": "./rust/*.js",
     "#telemetry/*.js": "./telemetry/*.js",
     "#telemetry/*": "./telemetry/*.js",
     "#codex/app-server/client": "./codex/app-server/client.js",

package/dist/esm/platform/client.d.ts

@@ -44,8 +44,14 @@ export interface PlatformResponse<T = unknown> {
     readonly status: number;
     readonly data: T;
 }
+/**
+ * Injectable fetch call-signature used by platform transport and tests.
+ * Narrower than `typeof fetch` (which requires Bun/DOM statics like
+ * `preconnect`) so vitest mocks remain assignable without casts.
+ */
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 export interface PlatformClientOptions {
-    readonly fetchFn?: typeof globalThis.fetch;
+    readonly fetchFn?: FetchLike;
     readonly maxAttempts?: number;
     readonly baseRetryDelayMs?: number;
     readonly maxRetryDelayMs?: number;

package/dist/esm/platform/github-contract-source.d.ts

@@ -1,9 +1,10 @@
 import { type AuthenticatedPlatformContractSnapshot, type PlatformContractAuthority, type PlatformContractAuthorityProbeResult, type PlatformContractSourceAdapter } from "./contract-provenance.js";
+import { type FetchLike } from "./client.js";
 export interface GitHubContractSourceAdapterOptions {
     readonly token: string;
     readonly authority?: string;
     readonly apiUrl?: string;
-    readonly fetchFn?: typeof globalThis.fetch;
+    readonly fetchFn?: FetchLike;
     readonly sleep?: (delayMs: number) => Promise<void>;
 }
 export declare class GitHubContractSourceAdapter implements PlatformContractSourceAdapter {

package/dist/esm/pr-description/contract.js

@@ -31,13 +31,33 @@ const SESSION_SKIP_PREFIX = /^Session-skip:/im;
 function trim(value) {
     return value?.trim() ?? "";
 }
+/**
+ * Finds the value of a "<label>: <value>" list item at the head of a line,
+ * tolerating a leading "- " bullet and markdown emphasis wrapping the label
+ * (`**bold**`, `__bold__`, `*italic*`, `_italic_`) on either side of the
+ * colon — e.g. both "- Execution model(s): x" and
+ * "- **Execution model(s):** x" match. Still anchored to the start of the
+ * line (after stripping the bullet/emphasis decoration): a mention of the
+ * label mid-sentence never matches. Mirrors the CI `require_field` awk
+ * matcher in `.github/workflows/ci.agent-kit.yml` — keep the two in lockstep.
+ */
 function fieldValue(body, label) {
     const expected = label.toLowerCase();
     for (const line of body.split(/\r?\n/u)) {
-        const normalized = line.toLowerCase();
-        if (normalized.startsWith(`- ${expected}:`) || normalized.startsWith(`${expected}:`)) {
-            return line.slice(line.indexOf(":") + 1).trim();
-        }
+        const colonIndex = line.indexOf(":");
+        if (colonIndex === -1)
+            continue;
+        const before = line
+            .slice(0, colonIndex)
+            .replace(/^\s+/u, "")
+            .replace(/^-\s+/u, "")
+            .replace(/[*_]+/gu, "");
+        if (before.toLowerCase() !== expected)
+            continue;
+        return line
+            .slice(colonIndex + 1)
+            .replace(/^[*_]+/u, "")
+            .trim();
     }
     return undefined;
 }

package/dist/esm/review/authority.js

@@ -9,7 +9,7 @@ import { createHash } from "node:crypto";
 import { existsSync, lstatSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { evaluateReviewEvents, parseReviewEventLog } from "./events.js";
-import { createDeliverySubjectAtRef, createLegacyPlanSubjectAtRef, createPlanSubjectAtRef, resolveReviewCommit, } from "./subject.js";
+import { createDeliverySubjectAtRef, createLegacyPlanSubjectAtRef, createPlanSubjectAtRef, createPreTagsStripPlanSubjectAtRef, resolveReviewCommit, } from "./subject.js";
 const GIT_TIMEOUT_MS = 5_000;
 const GIT_MAX_BUFFER_BYTES = 128 * 1024 * 1024;
 const REGULAR_MODE_PATTERN = /^100(?:644|755)$/u;
@@ -138,18 +138,23 @@ export function readReviewAuthorityAtRef(cwd, ref, stableSlug, purpose) {
         subjectDigest: subject.digest,
     }, compromisedIds);
     if (purpose === "plan" && evaluation.approvals.length === 0) {
-        // Digest-compatibility fallback: events recorded before the lifecycle
-        // stripped-key extension bound their subjectDigest to the legacy
-        // normalization. Accept those for the same tracked content; new events
-        // always record the current digest (see legacyNormalizePlanSubjectContent).
-        const legacySubject = createLegacyPlanSubjectAtRef(cwd, commit, stableSlug, overview.path);
-        if (legacySubject.digest !== subject.digest) {
+        // Digest-compatibility fallbacks (newest-first after current):
+        // 1) pre-tags-strip: lifecycle strip without advisory `tags` (approvals recorded
+        //    after the stripped-key extension but before the tags strip)
+        // 2) legacy: status + completed_at only (pre-extension)
+        // New events always record the current digest (with tags strip).
+        for (const make of [createPreTagsStripPlanSubjectAtRef, createLegacyPlanSubjectAtRef]) {
+            const alt = make(cwd, commit, stableSlug, overview.path);
+            if (alt.digest === subject.digest)
+                continue;
             evaluation = evaluateReviewEvents(events, {
                 purpose,
                 blueprintSlug: stableSlug,
-                subjectScheme: legacySubject.scheme,
-                subjectDigest: legacySubject.digest,
+                subjectScheme: alt.scheme,
+                subjectDigest: alt.digest,
             }, compromisedIds);
+            if (evaluation.approvals.length > 0)
+                break;
         }
     }
     return {

package/dist/esm/review/availability.d.ts

@@ -45,6 +45,17 @@ export declare function recordReviewAvailability(projectRoot: string, event: Rev
 export declare function recordReviewAvailabilityWithLock(projectRoot: string, event: ReviewAvailabilityEvent): Promise<ReviewAvailabilityState>;
 export declare function isProviderSuppressed(state: ReviewAvailabilityState, provider: ReviewProvider): boolean;
 export declare function suppressedReviewers(state: ReviewAvailabilityState): Set<string>;
+/**
+ * Backstop age for suppressions recorded without a parseable retry window.
+ *
+ * Without this, a provider/account failure that never set `retryAfterMs`
+ * (unparsable limit text, incomplete event payload) stays suppressed forever
+ * and permanently removes that surface from rotation. 24h is long enough that
+ * a real multi-hour/day window still wins when present, and short enough that
+ * a sticky unknown-limit entry self-heals on the next calendar day instead of
+ * requiring a manual availability reset.
+ */
+export declare const MAX_SUPPRESSION_AGE_MS: number;
 export declare function pruneExpiredAvailabilitySuppressions(state: ReviewAvailabilityState, nowMs?: number): {
     state: ReviewAvailabilityState;
     pruned: string[];

package/dist/esm/review/availability.js

@@ -247,21 +247,36 @@ export function suppressedReviewers(state) {
         .filter((record) => record.suppressed)
         .map((record) => record.canonicalId));
 }
+/**
+ * Backstop age for suppressions recorded without a parseable retry window.
+ *
+ * Without this, a provider/account failure that never set `retryAfterMs`
+ * (unparsable limit text, incomplete event payload) stays suppressed forever
+ * and permanently removes that surface from rotation. 24h is long enough that
+ * a real multi-hour/day window still wins when present, and short enough that
+ * a sticky unknown-limit entry self-heals on the next calendar day instead of
+ * requiring a manual availability reset.
+ */
+export const MAX_SUPPRESSION_AGE_MS = 24 * 60 * 60 * 1000;
 /**
  * Shared expiry predicate for a suppressed availability record: applies to
  * both the reviewer/provider store and the opencode-go account store below.
  * A record clears when its terminal classification is no longer a failure
- * classification, or when its retry window has elapsed.
+ * classification, or when its retry window (or the max-age backstop) has
+ * elapsed.
  */
 function suppressionExpired(record, nowMs) {
     if (!record.suppressed)
         return false;
     if (!suppressedRecordStillApplies(record))
         return true;
-    if (record.retryAfterMs === undefined || record.lastFailureAt === undefined)
+    if (record.lastFailureAt === undefined)
         return false;
     const failureAt = Date.parse(record.lastFailureAt);
-    return Number.isFinite(failureAt) && failureAt + record.retryAfterMs <= nowMs;
+    if (!Number.isFinite(failureAt))
+        return false;
+    const windowMs = record.retryAfterMs === undefined ? MAX_SUPPRESSION_AGE_MS : record.retryAfterMs;
+    return failureAt + windowMs <= nowMs;
 }
 function pruneRecordMap(records, nowMs, pruned) {
     return Object.fromEntries(Object.entries(records).map(([key, record]) => {

package/dist/esm/review/execution/adapters.d.ts

@@ -1,4 +1,14 @@
-import type { ReviewRunInput, ReviewStreamAdapter } from "./types.js";
+import type { ReviewAdapterEvent, ReviewRunInput, ReviewStreamAdapter } from "./types.js";
+/**
+ * Classify an OpenCode Go usage-limit message and derive its real reset window.
+ *
+ * Exported because the `wp opencode` launch-time health probe
+ * (`#cli/commands/opencode-probe.js`) runs the same provider text through the
+ * same classifier. A second copy of this wording/duration math would drift the
+ * moment the provider changes a phrase, and the two consumers would then
+ * disagree about whether an account is capped.
+ */
+export declare function opencodeUsageLimit(message: string): ReviewAdapterEvent | null;
 export declare const claudeReviewAdapter: ReviewStreamAdapter;
 export declare const codexReviewAdapter: ReviewStreamAdapter;
 export declare const opencodeReviewAdapter: ReviewStreamAdapter;

package/dist/esm/review/execution/adapters.js

@@ -92,7 +92,16 @@ function parseResetDurationMs(message) {
     }
     return duration > 0 ? duration : undefined;
 }
-function opencodeUsageLimit(message) {
+/**
+ * Classify an OpenCode Go usage-limit message and derive its real reset window.
+ *
+ * Exported because the `wp opencode` launch-time health probe
+ * (`#cli/commands/opencode-probe.js`) runs the same provider text through the
+ * same classifier. A second copy of this wording/duration math would drift the
+ * moment the provider changes a phrase, and the two consumers would then
+ * disagree about whether an account is capped.
+ */
+export function opencodeUsageLimit(message) {
     if (!/\busage limit reached\b/iu.test(message))
         return null;
     const limitWindow = /\bweekly usage limit reached\b/iu.test(message)

package/dist/esm/review/execution/artifacts.d.ts

@@ -14,4 +14,4 @@ export interface ReviewArtifactWriter {
 export declare function reviewRunStatePath(root: string, runId: string): string;
 export type ReviewRunStateCleanupResult = "missing" | "not-running" | "removed" | "refused";
 export declare function removeOwnedRunningReviewState(root: string, runId: string, reservationToken: string): ReviewRunStateCleanupResult;
-export declare function createReviewArtifactWriter(root: string, runId: string, startedAt: string, reservationToken?: `${string}-${string}-${string}-${string}-${string}`): ReviewArtifactWriter;
+export declare function createReviewArtifactWriter(root: string, runId: string, startedAt: string, reservationToken?: string): ReviewArtifactWriter;

package/dist/esm/review/execution/review-checkout.js

@@ -23,24 +23,34 @@ function frame(hash, label, value) {
     hash.update(`${label}\0${bytes.byteLength}\0`, "utf8");
     hash.update(bytes);
 }
-function worktreeFingerprint(cwd) {
+// Fingerprint over the filtered line set `status()` produces below, minus
+// pure gitignored (`!!`) entries, so the two contamination checks
+// (`changes()`'s status() diff and the caller worktree fingerprint) cannot
+// drift apart on what counts as "source" content while still tolerating
+// expected runtime bookkeeping.
+//
+// Before the status()-alignment fix, the fingerprint hashed the raw
+// unfiltered `git status` output (without `--ignored`), so anything status()
+// already tolerates (the self-hosting bootstrap's idempotent `package.json`
+// trailing-whitespace normalization, and non-source ignored paths under
+// dist/.tshy/node_modules) could still flip the fingerprint and false-flag a
+// clean caller worktree as contaminated.
+//
+// Reusing status() alone re-introduces a different false positive: the
+// supervisor writes process records under gitignored `.webpresso/` (and similar
+// runtime roots) during the run. Those appear as `!!` lines only when
+// `--ignored` is on. Dropping `!!` here restores the prior fingerprint
+// contract for ignored paths while keeping the package.json / non-`!!` filters
+// shared with status(). Checkout-side status() still reports non-derived
+// gitignored writes (e.g. a stray `.env`) on the disposable review tree.
+function worktreeFingerprint(cwd, ignoredPaths = new Set()) {
     const hash = createHash("sha256");
-    const porcelain = git(cwd, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
-    frame(hash, "porcelain", porcelain);
+    const lines = status(cwd, ignoredPaths).filter((line) => !line.startsWith("!!"));
+    frame(hash, "status-lines", lines.join("\n"));
     frame(hash, "staged", gitBytes(cwd, ["diff", "--cached", "--binary", "--no-ext-diff", "HEAD", "--"]));
-    const records = porcelain.split("\0").filter(Boolean);
     const dirtyPaths = new Set();
-    for (let index = 0; index < records.length; index += 1) {
-        const record = records[index] ?? "";
-        dirtyPaths.add(record.slice(3));
-        if (record.slice(0, 2).match(/[RC]/u)) {
-            const pairedPath = records[index + 1];
-            if (pairedPath) {
-                dirtyPaths.add(pairedPath);
-                index += 1;
-            }
-        }
-    }
+    for (const line of lines)
+        dirtyPaths.add(statusEntryPath(line));
     for (const relativePath of [...dirtyPaths].filter(Boolean).toSorted()) {
         const absolutePath = join(cwd, relativePath);
         frame(hash, "dirty-path", relativePath);
@@ -108,13 +118,22 @@ function isNormalizedPackageJsonModification(cwd, line) {
         return false;
     }
 }
+// Single source of truth for turning a `git status --porcelain=v1` line into
+// its relative path, shared by status()'s filter predicate and
+// worktreeFingerprint()'s dirty-path hashing so both stay aligned by
+// construction. Does not special-case the rename arrow (`old -> new`); a
+// rename line's raw tail is used as-is, matching this function's prior
+// (pre-refactor) inline behavior.
+function statusEntryPath(line) {
+    return line.slice(3).replace(/\/$/u, "");
+}
 function status(cwd, ignoredPaths = new Set()) {
     const output = git(cwd, ["status", "--porcelain=v1", "--untracked-files=all", "--ignored"]);
     return output
         .split(/\r?\n/u)
         .filter((line) => line.length > 0)
         .filter((line) => {
-        const relativePath = line.slice(3).replace(/\/$/u, "");
+        const relativePath = statusEntryPath(line);
         if (ignoredPaths.has(relativePath))
             return false;
         if (line.startsWith("!!") && isNonSourceIgnoredPath(relativePath))

package/dist/esm/review/execution/supervisor.js

@@ -123,6 +123,10 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
     let fallbackSelectionTimer;
     let pendingFallback;
     const seenFrontiers = new Set();
+    const droppedEventWarnings = [];
+    const recordDroppedProviderEvent = (reason) => {
+        droppedEventWarnings.push(reason);
+    };
     const decoder = new StringDecoder("utf8");
     const diagnosticDecoder = new StringDecoder("utf8");
     let buffered = "";
@@ -230,19 +234,41 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
     const processLine = (line) => {
         if (line.trim().length === 0 || status !== null)
             return;
-        if (Buffer.byteLength(line, "utf8") > MAX_PROVIDER_EVENT_BYTES) {
-            fail("protocol-unsupported", "provider-event-too-large");
-            return;
-        }
+        const oversized = Buffer.byteLength(line, "utf8") > MAX_PROVIDER_EVENT_BYTES;
         let value;
         try {
             value = JSON.parse(line);
         }
         catch {
+            // An oversized frame that also fails to parse carries no recoverable
+            // signal (a genuinely truncated/malformed line looks the same either
+            // way) -- drop it with a warning instead of failing a run that may
+            // still receive a complete, well-formed terminal verdict later. A
+            // normal-sized malformed line is still a protocol violation.
+            if (oversized) {
+                recordDroppedProviderEvent("provider-event-too-large-unparseable");
+                return;
+            }
             fail("protocol-unsupported", "invalid-json-event");
             return;
         }
         const event = adapter.parseEvent(value);
+        if (oversized && (event.kind === "terminal" || event.kind === "failure")) {
+            // Terminal/verdict and failure frames are load-bearing: an oversized
+            // one is treated as a protocol violation, same as before this fix.
+            fail("protocol-unsupported", "provider-event-too-large");
+            return;
+        }
+        if (oversized) {
+            // Non-terminal (progress/neutral/unsupported) oversized frames are
+            // dropped rather than failing the whole run -- a provider that echoes
+            // e.g. a large lockfile read in a progress frame must not discard an
+            // otherwise-complete review verdict. See catalog/agent/rules
+            // /no-timeout-as-fix.md: the byte bound stays in place, we just stop
+            // treating "one big frame" as fatal to the whole run.
+            recordDroppedProviderEvent(`provider-event-too-large-${event.kind}`);
+            return;
+        }
         if (event.kind === "unsupported") {
             fail("protocol-unsupported", "unknown-provider-event");
             return;
@@ -433,6 +459,7 @@ export async function superviseReviewExecution(input, adapter, deps = {}) {
             ...(limitWindow === undefined ? {} : { limitWindow }),
             ...(retryAfterMs === undefined ? {} : { retryAfterMs }),
             summaryPath: artifacts.summaryPath,
+            ...(droppedEventWarnings.length > 0 ? { warnings: [...droppedEventWarnings] } : {}),
         };
     }
     function recordReviewProcessStart(reviewChild, processGroupId) {

package/dist/esm/review/execution/types.d.ts

@@ -81,4 +81,5 @@ export interface ReviewRunSummary {
     readonly limitWindow?: ReviewLimitWindow;
     readonly retryAfterMs?: number;
     readonly summaryPath: string;
+    readonly warnings?: readonly string[];
 }

package/dist/esm/review/subject.d.ts

@@ -43,9 +43,22 @@ export declare function createPlanSubjectDigestForContent(blueprintSlug: string,
  * `normalizePlanSubjectContent`.
  */
 export declare function legacyNormalizePlanSubjectContent(content: Buffer | string): Buffer;
+/**
+ * Digest-compatibility variant for review events recorded after the lifecycle
+ * stripped-key extension but before the advisory `tags` strip. Verification
+ * accepts a match against this tier so existing plan approvals on tagged
+ * blueprints are not stranded by the tags-strip rollout.
+ */
+export declare function preTagsStripNormalizePlanSubjectContent(content: Buffer | string): Buffer;
 export declare function createPlanSubjectAtRef(cwd: string, ref: string, blueprintSlug: string, blueprintPath?: string): ReviewSubject;
 /** Plan subject digested with the pre-extension normalization (see above). */
 export declare function createLegacyPlanSubjectAtRef(cwd: string, ref: string, blueprintSlug: string, blueprintPath?: string): ReviewSubject;
+/** Plan subject digested without the advisory `tags` strip (pre-tags-strip tier). */
+export declare function createPreTagsStripPlanSubjectAtRef(cwd: string, ref: string, blueprintSlug: string, blueprintPath?: string): ReviewSubject;
+/** Working-ledger digest for the pre-tags-strip compatibility tier. */
+export declare function createPreTagsStripPlanSubjectDigestForContent(blueprintSlug: string, content: Buffer | string): string;
+/** Working-ledger digest for the pre-extension legacy compatibility tier. */
+export declare function createLegacyPlanSubjectDigestForContent(blueprintSlug: string, content: Buffer | string): string;
 export declare const reviewSubjectInternals: {
     isExcludedReviewEnvelope: typeof isExcludedReviewEnvelope;
     isReviewEvidencePath: typeof isReviewEvidencePath;