agentplane 0.1.7 → 0.1.9

package/dist/commands/upgrade.js

@@ -9,12 +9,13 @@ import { extractArchive } from "../cli/archive.js";
 import { invalidFieldMessage, invalidValueMessage, missingValueMessage, requiredFieldMessage, usageMessage, } from "../cli/output.js";
 import { exitCodeForError } from "../cli/exit-codes.js";
 import { CliError } from "../shared/errors.js";
+import { ensureNetworkApproved } from "./shared/network-approval.js";
 const DEFAULT_UPGRADE_ASSET = "agentplane-upgrade.tar.gz";
 const DEFAULT_UPGRADE_CHECKSUM_ASSET = "agentplane-upgrade.tar.gz.sha256";
-const UPGRADE_USAGE = "Usage: agentplane upgrade [--tag <tag>] [--dry-run] [--no-backup] [--source <repo-url>] [--bundle <path|url>] [--checksum <path|url>]";
+const UPGRADE_USAGE = "Usage: agentplane upgrade [--tag <tag>] [--dry-run] [--no-backup] [--source <repo-url>] [--bundle <path|url>] [--checksum <path|url>] [--yes]";
 const UPGRADE_USAGE_EXAMPLE = "agentplane upgrade --tag v0.1.4 --dry-run";
 function parseUpgradeFlags(args) {
-    const out = { dryRun: false, backup: true };
+    const out = { dryRun: false, backup: true, yes: false };
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         if (!arg)
@@ -34,6 +35,10 @@ function parseUpgradeFlags(args) {
             out.backup = false;
             continue;
         }
+        if (arg === "--yes") {
+            out.yes = true;
+            continue;
+        }
         const next = args[i + 1];
         if (!next) {
             throw new CliError({ exitCode: 2, code: "E_USAGE", message: missingValueMessage(arg) });
@@ -136,6 +141,13 @@ export async function cmdUpgrade(opts) {
     });
     const loaded = await loadConfig(resolved.agentplaneDir);
     const source = flags.source ?? loaded.config.framework.source;
+    let networkApproved = false;
+    const ensureApproved = async (reason) => {
+        if (networkApproved)
+            return;
+        await ensureNetworkApproved({ config: loaded.config, yes: flags.yes, reason });
+        networkApproved = true;
+    };
     let tempRoot = null;
     let extractRoot = null;
     try {
@@ -146,6 +158,7 @@ export async function cmdUpgrade(opts) {
             const isUrl = flags.bundle.startsWith("http://") || flags.bundle.startsWith("https://");
             bundlePath = isUrl ? path.join(tempRoot, "bundle.tar.gz") : path.resolve(flags.bundle);
             if (isUrl) {
+                await ensureApproved("upgrade downloads the bundle/checksum from the network");
                 await downloadToFile(flags.bundle, bundlePath);
             }
             const checksumValue = flags.checksum ?? "";
@@ -154,6 +167,7 @@ export async function cmdUpgrade(opts) {
                 ? path.join(tempRoot, "bundle.tar.gz.sha256")
                 : path.resolve(checksumValue);
             if (checksumIsUrl) {
+                await ensureApproved("upgrade downloads the bundle/checksum from the network");
                 await downloadToFile(checksumValue, checksumPath);
             }
         }
@@ -162,6 +176,7 @@ export async function cmdUpgrade(opts) {
             const releaseUrl = flags.tag
                 ? `https://api.github.com/repos/${owner}/${repo}/releases/tags/${flags.tag}`
                 : `https://api.github.com/repos/${owner}/${repo}/releases/latest`;
+            await ensureApproved("upgrade fetches release metadata and downloads assets from the network");
             const release = (await fetchJson(releaseUrl));
             const assets = Array.isArray(release.assets) ? release.assets : [];
             const assetName = flags.asset ?? DEFAULT_UPGRADE_ASSET;

package/dist/commands/workflow.d.ts

@@ -1,6 +1,6 @@
 export declare const IDE_SYNC_USAGE = "Usage: agentplane ide sync";
 export declare const IDE_SYNC_USAGE_EXAMPLE = "agentplane ide sync";
-export { TASK_NEW_USAGE, TASK_NEW_USAGE_EXAMPLE, TASK_ADD_USAGE, TASK_ADD_USAGE_EXAMPLE, TASK_SCRUB_USAGE, TASK_SCRUB_USAGE_EXAMPLE, TASK_UPDATE_USAGE, TASK_UPDATE_USAGE_EXAMPLE, TASK_SCAFFOLD_USAGE, TASK_SCAFFOLD_USAGE_EXAMPLE, TASK_DOC_SET_USAGE, TASK_DOC_SET_USAGE_EXAMPLE, TASK_DOC_SHOW_USAGE, TASK_DOC_SHOW_USAGE_EXAMPLE, START_USAGE, START_USAGE_EXAMPLE, BLOCK_USAGE, BLOCK_USAGE_EXAMPLE, FINISH_USAGE, FINISH_USAGE_EXAMPLE, VERIFY_USAGE, VERIFY_USAGE_EXAMPLE, dedupeStrings, cmdTaskNew, cmdTaskAdd, cmdTaskUpdate, cmdTaskScrub, cmdTaskListWithFilters, cmdTaskNext, cmdReady, cmdTaskSearch, cmdTaskScaffold, cmdTaskNormalize, cmdTaskMigrate, cmdTaskComment, cmdTaskSetStatus, cmdTaskShow, cmdTaskList, cmdTaskExport, cmdTaskLint, cmdTaskDocSet, cmdTaskDocShow, cmdStart, cmdBlock, cmdFinish, cmdVerify, } from "./task/index.js";
+export { TASK_NEW_USAGE, TASK_NEW_USAGE_EXAMPLE, TASK_ADD_USAGE, TASK_ADD_USAGE_EXAMPLE, TASK_SCRUB_USAGE, TASK_SCRUB_USAGE_EXAMPLE, TASK_UPDATE_USAGE, TASK_UPDATE_USAGE_EXAMPLE, TASK_SCAFFOLD_USAGE, TASK_SCAFFOLD_USAGE_EXAMPLE, TASK_MIGRATE_DOC_USAGE, TASK_MIGRATE_DOC_USAGE_EXAMPLE, TASK_DOC_SET_USAGE, TASK_DOC_SET_USAGE_EXAMPLE, TASK_DOC_SHOW_USAGE, TASK_DOC_SHOW_USAGE_EXAMPLE, TASK_PLAN_USAGE, TASK_PLAN_USAGE_EXAMPLE, TASK_PLAN_SET_USAGE, TASK_PLAN_SET_USAGE_EXAMPLE, TASK_PLAN_APPROVE_USAGE, TASK_PLAN_APPROVE_USAGE_EXAMPLE, TASK_PLAN_REJECT_USAGE, TASK_PLAN_REJECT_USAGE_EXAMPLE, START_USAGE, START_USAGE_EXAMPLE, BLOCK_USAGE, BLOCK_USAGE_EXAMPLE, FINISH_USAGE, FINISH_USAGE_EXAMPLE, VERIFY_USAGE, VERIFY_USAGE_EXAMPLE, TASK_VERIFY_USAGE, TASK_VERIFY_USAGE_EXAMPLE, dedupeStrings, cmdTaskNew, cmdTaskAdd, cmdTaskUpdate, cmdTaskScrub, cmdTaskListWithFilters, cmdTaskNext, cmdReady, cmdTaskSearch, cmdTaskScaffold, cmdTaskNormalize, cmdTaskMigrate, cmdTaskMigrateDoc, cmdTaskPlan, cmdTaskComment, cmdTaskSetStatus, cmdTaskShow, cmdTaskList, cmdTaskExport, cmdTaskLint, cmdTaskDocSet, cmdTaskDocShow, cmdStart, cmdBlock, cmdFinish, cmdVerify, cmdTaskVerify, } from "./task/index.js";
 export { BRANCH_BASE_USAGE, BRANCH_BASE_USAGE_EXAMPLE, BRANCH_STATUS_USAGE, BRANCH_STATUS_USAGE_EXAMPLE, BRANCH_REMOVE_USAGE, BRANCH_REMOVE_USAGE_EXAMPLE, WORK_START_USAGE, WORK_START_USAGE_EXAMPLE, CLEANUP_MERGED_USAGE, CLEANUP_MERGED_USAGE_EXAMPLE, gitInitRepo, resolveInitBaseBranch, promptInitBaseBranch, ensureInitCommit, cmdWorkStart, cmdCleanupMerged, cmdBranchBaseGet, cmdBranchBaseSet, cmdBranchBaseClear, cmdBranchBaseExplain, cmdBranchStatus, cmdBranchRemove, } from "./branch/index.js";
 export { PR_OPEN_USAGE, PR_OPEN_USAGE_EXAMPLE, PR_UPDATE_USAGE, PR_UPDATE_USAGE_EXAMPLE, PR_CHECK_USAGE, PR_CHECK_USAGE_EXAMPLE, PR_NOTE_USAGE, PR_NOTE_USAGE_EXAMPLE, INTEGRATE_USAGE, INTEGRATE_USAGE_EXAMPLE, cmdPrOpen, cmdPrUpdate, cmdPrCheck, cmdPrNote, cmdIntegrate, } from "./pr/index.js";
 export { GUARD_COMMIT_USAGE, GUARD_COMMIT_USAGE_EXAMPLE, COMMIT_USAGE, COMMIT_USAGE_EXAMPLE, suggestAllowPrefixes, cmdGuardClean, cmdGuardSuggestAllow, cmdGuardCommit, cmdCommit, } from "./guard/index.js";

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,cAAc,+BAA+B,CAAC;AAC3D,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,2BAA2B,EAC3B,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,SAAS,GACV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,2BAA2B,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,SAAS,EACT,WAAW,EACX,UAAU,EACV,SAAS,EACT,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,cAAc,+BAA+B,CAAC;AAC3D,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,8BAA8B,EAC9B,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,2BAA2B,EAC3B,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,+BAA+B,EAC/B,sBAAsB,EACtB,8BAA8B,EAC9B,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,UAAU,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,sBAAsB,EACtB,WAAW,EACX,QAAQ,EACR,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,SAAS,EACT,aAAa,GACd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,2BAA2B,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,WAAW,EACX,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,SAAS,EACT,WAAW,EACX,UAAU,EACV,SAAS,EACT,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/commands/workflow.js

@@ -1,7 +1,7 @@
 // Thin public re-export layer: keep CLI imports stable while command implementations live by domain.
 export const IDE_SYNC_USAGE = "Usage: agentplane ide sync";
 export const IDE_SYNC_USAGE_EXAMPLE = "agentplane ide sync";
-export { TASK_NEW_USAGE, TASK_NEW_USAGE_EXAMPLE, TASK_ADD_USAGE, TASK_ADD_USAGE_EXAMPLE, TASK_SCRUB_USAGE, TASK_SCRUB_USAGE_EXAMPLE, TASK_UPDATE_USAGE, TASK_UPDATE_USAGE_EXAMPLE, TASK_SCAFFOLD_USAGE, TASK_SCAFFOLD_USAGE_EXAMPLE, TASK_DOC_SET_USAGE, TASK_DOC_SET_USAGE_EXAMPLE, TASK_DOC_SHOW_USAGE, TASK_DOC_SHOW_USAGE_EXAMPLE, START_USAGE, START_USAGE_EXAMPLE, BLOCK_USAGE, BLOCK_USAGE_EXAMPLE, FINISH_USAGE, FINISH_USAGE_EXAMPLE, VERIFY_USAGE, VERIFY_USAGE_EXAMPLE, dedupeStrings, cmdTaskNew, cmdTaskAdd, cmdTaskUpdate, cmdTaskScrub, cmdTaskListWithFilters, cmdTaskNext, cmdReady, cmdTaskSearch, cmdTaskScaffold, cmdTaskNormalize, cmdTaskMigrate, cmdTaskComment, cmdTaskSetStatus, cmdTaskShow, cmdTaskList, cmdTaskExport, cmdTaskLint, cmdTaskDocSet, cmdTaskDocShow, cmdStart, cmdBlock, cmdFinish, cmdVerify, } from "./task/index.js";
+export { TASK_NEW_USAGE, TASK_NEW_USAGE_EXAMPLE, TASK_ADD_USAGE, TASK_ADD_USAGE_EXAMPLE, TASK_SCRUB_USAGE, TASK_SCRUB_USAGE_EXAMPLE, TASK_UPDATE_USAGE, TASK_UPDATE_USAGE_EXAMPLE, TASK_SCAFFOLD_USAGE, TASK_SCAFFOLD_USAGE_EXAMPLE, TASK_MIGRATE_DOC_USAGE, TASK_MIGRATE_DOC_USAGE_EXAMPLE, TASK_DOC_SET_USAGE, TASK_DOC_SET_USAGE_EXAMPLE, TASK_DOC_SHOW_USAGE, TASK_DOC_SHOW_USAGE_EXAMPLE, TASK_PLAN_USAGE, TASK_PLAN_USAGE_EXAMPLE, TASK_PLAN_SET_USAGE, TASK_PLAN_SET_USAGE_EXAMPLE, TASK_PLAN_APPROVE_USAGE, TASK_PLAN_APPROVE_USAGE_EXAMPLE, TASK_PLAN_REJECT_USAGE, TASK_PLAN_REJECT_USAGE_EXAMPLE, START_USAGE, START_USAGE_EXAMPLE, BLOCK_USAGE, BLOCK_USAGE_EXAMPLE, FINISH_USAGE, FINISH_USAGE_EXAMPLE, VERIFY_USAGE, VERIFY_USAGE_EXAMPLE, TASK_VERIFY_USAGE, TASK_VERIFY_USAGE_EXAMPLE, dedupeStrings, cmdTaskNew, cmdTaskAdd, cmdTaskUpdate, cmdTaskScrub, cmdTaskListWithFilters, cmdTaskNext, cmdReady, cmdTaskSearch, cmdTaskScaffold, cmdTaskNormalize, cmdTaskMigrate, cmdTaskMigrateDoc, cmdTaskPlan, cmdTaskComment, cmdTaskSetStatus, cmdTaskShow, cmdTaskList, cmdTaskExport, cmdTaskLint, cmdTaskDocSet, cmdTaskDocShow, cmdStart, cmdBlock, cmdFinish, cmdVerify, cmdTaskVerify, } from "./task/index.js";
 export { BRANCH_BASE_USAGE, BRANCH_BASE_USAGE_EXAMPLE, BRANCH_STATUS_USAGE, BRANCH_STATUS_USAGE_EXAMPLE, BRANCH_REMOVE_USAGE, BRANCH_REMOVE_USAGE_EXAMPLE, WORK_START_USAGE, WORK_START_USAGE_EXAMPLE, CLEANUP_MERGED_USAGE, CLEANUP_MERGED_USAGE_EXAMPLE, gitInitRepo, resolveInitBaseBranch, promptInitBaseBranch, ensureInitCommit, cmdWorkStart, cmdCleanupMerged, cmdBranchBaseGet, cmdBranchBaseSet, cmdBranchBaseClear, cmdBranchBaseExplain, cmdBranchStatus, cmdBranchRemove, } from "./branch/index.js";
 export { PR_OPEN_USAGE, PR_OPEN_USAGE_EXAMPLE, PR_UPDATE_USAGE, PR_UPDATE_USAGE_EXAMPLE, PR_CHECK_USAGE, PR_CHECK_USAGE_EXAMPLE, PR_NOTE_USAGE, PR_NOTE_USAGE_EXAMPLE, INTEGRATE_USAGE, INTEGRATE_USAGE_EXAMPLE, cmdPrOpen, cmdPrUpdate, cmdPrCheck, cmdPrNote, cmdIntegrate, } from "./pr/index.js";
 export { GUARD_COMMIT_USAGE, GUARD_COMMIT_USAGE_EXAMPLE, COMMIT_USAGE, COMMIT_USAGE_EXAMPLE, suggestAllowPrefixes, cmdGuardClean, cmdGuardSuggestAllow, cmdGuardCommit, cmdCommit, } from "./guard/index.js";

package/dist/shared/git-log.d.ts

@@ -0,0 +1,5 @@
+export declare function parseGitLogHashSubject(stdout: string): {
+    hash: string;
+    subject: string;
+};
+//# sourceMappingURL=git-log.d.ts.map

package/dist/shared/git-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-log.d.ts","sourceRoot":"","sources":["../../src/shared/git-log.ts"],"names":[],"mappings":"AAAA,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAYxF"}

package/dist/shared/git-log.js

@@ -0,0 +1,14 @@
+export function parseGitLogHashSubject(stdout) {
+    const trimmed = stdout.trimEnd();
+    const idx = trimmed.indexOf("\0");
+    if (idx === -1) {
+        throw new Error("Unexpected git log output (missing NUL separator)");
+    }
+    const hash = trimmed.slice(0, idx).trim();
+    const subject = trimmed.slice(idx + 1);
+    if (!hash)
+        throw new Error("Unexpected git log output (missing hash)");
+    if (!subject)
+        throw new Error("Unexpected git log output (missing subject)");
+    return { hash, subject };
+}

package/dist/shared/git-path.d.ts

@@ -0,0 +1,3 @@
+export declare function normalizeGitPathPrefix(prefix: string): string;
+export declare function gitPathIsUnderPrefix(candidate: string, prefix: string): boolean;
+//# sourceMappingURL=git-path.d.ts.map

package/dist/shared/git-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-path.d.ts","sourceRoot":"","sources":["../../src/shared/git-path.ts"],"names":[],"mappings":"AAgBA,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAS/E"}

package/dist/shared/git-path.js

@@ -0,0 +1,30 @@
+import path from "node:path";
+function normalizeGitPath(raw) {
+    let p = (raw ?? "").trim();
+    if (!p)
+        return "";
+    // Git reports repo-relative POSIX paths. Allow user-provided prefixes to be Windows-y.
+    p = p.replaceAll("\\", "/");
+    while (p.startsWith("./"))
+        p = p.slice(2);
+    p = p.replaceAll(/\/{2,}/g, "/");
+    p = p.replaceAll(/\/+$/g, "");
+    p = p.replaceAll(/^\/+/g, "");
+    return p;
+}
+export function normalizeGitPathPrefix(prefix) {
+    const raw = (prefix ?? "").trim();
+    if (raw === "." || raw === "./" || raw === ".\\")
+        return ".";
+    return normalizeGitPath(raw);
+}
+export function gitPathIsUnderPrefix(candidate, prefix) {
+    const c = normalizeGitPath(candidate);
+    const p = normalizeGitPathPrefix(prefix);
+    if (p === "." || p === "")
+        return true;
+    if (c === p)
+        return true;
+    const rel = path.posix.relative(p, c);
+    return rel === "" || (!rel.startsWith("..") && !path.posix.isAbsolute(rel));
+}

package/dist/shared/guards.d.ts

@@ -0,0 +1,2 @@
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=guards.d.ts.map

package/dist/shared/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/shared/guards.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}

package/dist/shared/guards.js

@@ -0,0 +1,3 @@
+export function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

package/dist/shared/protected-paths.d.ts

@@ -0,0 +1,12 @@
+export type ProtectedPathKind = "tasks" | "policy" | "config" | "hooks" | "ci";
+export type ProtectedPathOverride = {
+    kind: ProtectedPathKind;
+    cliFlag: string;
+    envVar: string;
+};
+export declare function getProtectedPathOverride(kind: ProtectedPathKind): ProtectedPathOverride;
+export declare function protectedPathKindForFile(opts: {
+    filePath: string;
+    tasksPath: string;
+}): ProtectedPathKind | null;
+//# sourceMappingURL=protected-paths.d.ts.map

package/dist/shared/protected-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-paths.d.ts","sourceRoot":"","sources":["../../src/shared/protected-paths.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;AAE/E,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAQF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAkBvF;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,iBAAiB,GAAG,IAAI,CA6B3B"}

package/dist/shared/protected-paths.js

@@ -0,0 +1,51 @@
+function pathIsUnder(candidate, prefix) {
+    if (prefix === "." || prefix === "")
+        return true;
+    if (candidate === prefix)
+        return true;
+    return candidate.startsWith(`${prefix}/`);
+}
+export function getProtectedPathOverride(kind) {
+    switch (kind) {
+        case "tasks": {
+            return { kind, cliFlag: "--allow-tasks", envVar: "AGENTPLANE_ALLOW_TASKS" };
+        }
+        case "policy": {
+            return { kind, cliFlag: "--allow-policy", envVar: "AGENTPLANE_ALLOW_POLICY" };
+        }
+        case "config": {
+            return { kind, cliFlag: "--allow-config", envVar: "AGENTPLANE_ALLOW_CONFIG" };
+        }
+        case "hooks": {
+            return { kind, cliFlag: "--allow-hooks", envVar: "AGENTPLANE_ALLOW_HOOKS" };
+        }
+        case "ci": {
+            return { kind, cliFlag: "--allow-ci", envVar: "AGENTPLANE_ALLOW_CI" };
+        }
+    }
+}
+export function protectedPathKindForFile(opts) {
+    const p = opts.filePath;
+    if (!p)
+        return null;
+    if (p === opts.tasksPath)
+        return "tasks";
+    // "Rules of the game": authoring/agent policies and registry.
+    if (p === "AGENTS.md" ||
+        p === "packages/agentplane/assets/AGENTS.md" ||
+        pathIsUnder(p, ".agentplane/agents")) {
+        return "policy";
+    }
+    // Framework config and task backend config determine enforcement behavior.
+    if (p === ".agentplane/config.json" || pathIsUnder(p, ".agentplane/backends")) {
+        return "config";
+    }
+    // Local hook orchestrator is a quality gate for commits.
+    if (p === "lefthook.yml")
+        return "hooks";
+    // CI workflows are "remote hooks" for quality gates.
+    if (pathIsUnder(p, ".github/workflows") || pathIsUnder(p, ".github/actions")) {
+        return "ci";
+    }
+    return null;
+}

package/dist/shared/strings.d.ts

@@ -0,0 +1,2 @@
+export declare function dedupeStrings(items: string[]): string[];
+//# sourceMappingURL=strings.d.ts.map

package/dist/shared/strings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strings.d.ts","sourceRoot":"","sources":["../../src/shared/strings.ts"],"names":[],"mappings":"AAAA,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAWvD"}

package/dist/shared/strings.js

@@ -0,0 +1,14 @@
+export function dedupeStrings(items) {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        const trimmed = item.trim();
+        if (!trimmed)
+            continue;
+        if (seen.has(trimmed))
+            continue;
+        seen.add(trimmed);
+        out.push(trimmed);
+    }
+    return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentplane",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Agent Plane CLI for task workflows, recipes, and project automation.",
   "keywords": [
     "agentplane",
@@ -54,7 +54,7 @@
     "prepublishOnly": "npm run prepack"
   },
   "dependencies": {
-    "@agentplaneorg/core": "0.1.7",
+    "@agentplaneorg/core": "0.1.9",
     "yauzl": "^2.10.0"
   },
   "devDependencies": {