agentplane 0.2.23 → 0.2.25

package/dist/commands/block.spec.js

@@ -1,4 +1,5 @@
 import { usageError } from "../cli/spec/errors.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 import { toStringList } from "../cli/spec/parse-utils.js";
 export const blockSpec = {
     id: ["block"],
@@ -44,13 +45,14 @@ export const blockSpec = {
             name: "commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --commit-from-comment).",
+            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --commit-from-comment). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --commit-from-comment).",
+            description: "Deprecated. Disabled for safety; pass explicit --commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -99,10 +101,29 @@ export const blockSpec = {
     validateRaw: (raw) => {
         const author = typeof raw.opts.author === "string" ? raw.opts.author.trim() : "";
         const body = typeof raw.opts.body === "string" ? raw.opts.body.trim() : "";
+        const commitAllow = toStringList(raw.opts["commit-allow"]);
         if (!author)
             throw usageError({ spec: blockSpec, message: "Invalid value for --author: empty." });
         if (!body)
             throw usageError({ spec: blockSpec, message: "Invalid value for --body: empty." });
+        if (findRepoWideAllowPrefixes(commitAllow).length > 0) {
+            throw usageError({
+                spec: blockSpec,
+                message: repoWideAllowPrefixMessage("--commit-allow"),
+            });
+        }
+        if (raw.opts["commit-auto-allow"] === true) {
+            throw usageError({
+                spec: blockSpec,
+                message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
+            });
+        }
+        if (raw.opts["commit-from-comment"] === true && commitAllow.length === 0) {
+            throw usageError({
+                spec: blockSpec,
+                message: "--commit-from-comment requires --commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: typeof raw.args["task-id"] === "string" ? raw.args["task-id"] : "",

package/dist/commands/commit.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.spec.d.ts","sourceRoot":"","sources":["../../src/commands/commit.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAmJhD,CAAC"}
+{"version":3,"file":"commit.spec.d.ts","sourceRoot":"","sources":["../../src/commands/commit.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CA8JhD,CAAC"}

package/dist/commands/commit.spec.js

@@ -1,4 +1,5 @@
 import { usageError } from "../cli/spec/errors.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 export const commitSpec = {
     id: ["commit"],
     group: "Guard",
@@ -35,13 +36,14 @@ export const commitSpec = {
             name: "allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowed path prefix (git-path).",
+            description: "Repeatable. Allowed path prefix (git-path). Use minimal prefixes; repo-wide '.' is rejected (tip: `agentplane guard suggest-allow --format args`).",
         },
         {
             kind: "boolean",
             name: "auto-allow",
             default: false,
-            description: "Infer --allow prefixes from staged paths (only when no explicit --allow is provided).",
+            description: "Deprecated. Disabled for safety; pass explicit --allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -77,10 +79,6 @@ export const commitSpec = {
             cmd: 'agentplane commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --allow packages/agentplane',
             why: "Create a commit after validating allowlist and subject policy.",
         },
-        {
-            cmd: 'agentplane commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --auto-allow',
-            why: "Infer allowlist prefixes from staged paths.",
-        },
         {
             cmd: "agentplane commit 202602030608-F1Q8AB --close",
             why: "Create a close commit for the task README using a deterministic message builder.",
@@ -120,6 +118,20 @@ export const commitSpec = {
         if (Array.isArray(allow) && allow.some((s) => typeof s === "string" && s.trim() === "")) {
             throw usageError({ spec: commitSpec, message: "Invalid value for --allow: empty." });
         }
+        const allowList = Array.isArray(allow)
+            ? allow
+            : typeof allow === "string"
+                ? [allow]
+                : [];
+        if (findRepoWideAllowPrefixes(allowList).length > 0) {
+            throw usageError({ spec: commitSpec, message: repoWideAllowPrefixMessage("--allow") });
+        }
+        if (raw.opts["auto-allow"] === true) {
+            throw usageError({
+                spec: commitSpec,
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: String(raw.args["task-id"]),

package/dist/commands/finish.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finish.spec.d.ts","sourceRoot":"","sources":["../../src/commands/finish.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKvD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAqPhD,CAAC"}
+{"version":3,"file":"finish.spec.d.ts","sourceRoot":"","sources":["../../src/commands/finish.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAsShD,CAAC"}

package/dist/commands/finish.spec.js

@@ -1,5 +1,6 @@
 import { usageError } from "../cli/spec/errors.js";
 import { toStringList } from "../cli/spec/parse-utils.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 export const finishSpec = {
     id: ["finish"],
     group: "Lifecycle",
@@ -77,13 +78,14 @@ export const finishSpec = {
             name: "commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the commit (used with --commit-from-comment).",
+            description: "Repeatable. Allowlist path prefixes to stage for the commit (used with --commit-from-comment). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --commit-from-comment).",
+            description: "Deprecated. Disabled for safety; pass explicit --commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -116,13 +118,14 @@ export const finishSpec = {
             name: "status-commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --status-commit).",
+            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --status-commit). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "status-commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --status-commit).",
+            description: "Deprecated. Disabled for safety; pass explicit --status-commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -165,6 +168,38 @@ export const finishSpec = {
         const taskIds = Array.isArray(ids) ? ids : [];
         const commitFromComment = raw.opts["commit-from-comment"] === true;
         const statusCommit = raw.opts["status-commit"] === true;
+        const commitAllow = toStringList(raw.opts["commit-allow"]);
+        const statusCommitAllow = toStringList(raw.opts["status-commit-allow"]);
+        const commitAutoAllow = raw.opts["commit-auto-allow"] === true;
+        const statusCommitAutoAllow = raw.opts["status-commit-auto-allow"] === true;
+        if (findRepoWideAllowPrefixes(commitAllow).length > 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: repoWideAllowPrefixMessage("--commit-allow"),
+            });
+        }
+        if (findRepoWideAllowPrefixes(statusCommitAllow).length > 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: repoWideAllowPrefixMessage("--status-commit-allow"),
+            });
+        }
+        if (commitAutoAllow) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
+            });
+        }
+        if (statusCommitAutoAllow) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--status-commit-auto-allow is disabled; pass explicit --status-commit-allow <path-prefix>.",
+            });
+        }
         if ((commitFromComment || statusCommit) && taskIds.length !== 1) {
             throw usageError({
                 spec: finishSpec,
@@ -172,6 +207,20 @@ export const finishSpec = {
                 message: "--commit-from-comment/--status-commit requires exactly one task id",
             });
         }
+        if (commitFromComment && commitAllow.length === 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--commit-from-comment requires --commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
+        if (statusCommit && statusCommitAllow.length === 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--status-commit requires --status-commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
         if (raw.opts["close-commit"] === true && taskIds.length !== 1) {
             throw usageError({
                 spec: finishSpec,

package/dist/commands/guard/commit.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CA+F1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CAkCtE"}
+{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CA0G1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CA2BtE"}

package/dist/commands/guard/commit.command.js

@@ -1,6 +1,7 @@
 import { usageError } from "../../cli/spec/errors.js";
 import { CliError } from "../../shared/errors.js";
-import { cmdGuardCommit, suggestAllowPrefixes } from "./index.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../../shared/allow-prefix-policy.js";
+import { cmdGuardCommit } from "./index.js";
 export const guardCommitSpec = {
     id: ["guard", "commit"],
     group: "Guard",
@@ -20,13 +21,14 @@ export const guardCommitSpec = {
             name: "allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowed path prefix (git-path).",
+            description: "Repeatable. Allowed path prefix (git-path). Use minimal prefixes; repo-wide '.' is rejected (tip: `agentplane guard suggest-allow --format args`).",
         },
         {
             kind: "boolean",
             name: "auto-allow",
             default: false,
-            description: "Infer --allow prefixes from staged paths (only when no explicit --allow is provided).",
+            description: "Deprecated. Disabled for safety; pass explicit --allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -62,10 +64,6 @@ export const guardCommitSpec = {
             cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --allow packages/agentplane',
             why: "Validate staged changes are covered by allowlist and policy.",
         },
-        {
-            cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --auto-allow',
-            why: "Infer allowlist prefixes from staged paths.",
-        },
     ],
     validateRaw: (raw) => {
         const msg = typeof raw.opts.message === "string" ? raw.opts.message.trim() : "";
@@ -76,6 +74,20 @@ export const guardCommitSpec = {
         if (Array.isArray(allow) && allow.some((s) => typeof s === "string" && s.trim() === "")) {
             throw usageError({ spec: guardCommitSpec, message: "Invalid value for --allow: empty." });
         }
+        const allowList = Array.isArray(allow)
+            ? allow
+            : typeof allow === "string"
+                ? [allow]
+                : [];
+        if (findRepoWideAllowPrefixes(allowList).length > 0) {
+            throw usageError({ spec: guardCommitSpec, message: repoWideAllowPrefixMessage("--allow") });
+        }
+        if (raw.opts["auto-allow"] === true) {
+            throw usageError({
+                spec: guardCommitSpec,
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: String(raw.args["task-id"]),
@@ -99,18 +111,12 @@ export const guardCommitSpec = {
 export function makeRunGuardCommitHandler(getCtx) {
     return async (ctx, p) => {
         const cmdCtx = await getCtx("guard commit");
-        let allow = p.allow;
-        if (p.autoAllow && allow.length === 0) {
-            const staged = await cmdCtx.git.statusStagedPaths();
-            const prefixes = suggestAllowPrefixes(staged);
-            if (prefixes.length === 0) {
-                throw new CliError({
-                    exitCode: 5,
-                    code: "E_GIT",
-                    message: "No staged files (git index empty)",
-                });
-            }
-            allow = prefixes;
+        if (p.autoAllow) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
         }
         return await cmdGuardCommit({
             ctx: cmdCtx,
@@ -118,7 +124,7 @@ export function makeRunGuardCommitHandler(getCtx) {
             rootOverride: ctx.rootOverride,
             taskId: p.taskId,
             message: p.message,
-            allow,
+            allow: p.allow,
             allowBase: p.allowBase,
             allowTasks: p.allowTasks,
             allowPolicy: p.allowPolicy,

package/dist/commands/guard/impl/allow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2CpB"}
+{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkDpB"}

package/dist/commands/guard/impl/allow.js

@@ -82,6 +82,13 @@ export async function stageAllowlist(opts) {
             message: "Provide at least one allowed prefix",
         });
     }
+    if (allow.includes(".")) {
+        throw new CliError({
+            exitCode: 2,
+            code: "E_USAGE",
+            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
+        });
+    }
     const denied = new Set();
     if (!opts.allowTasks)
         denied.add(opts.tasksPath);
@@ -98,7 +105,7 @@ export async function stageAllowlist(opts) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "No changes matched allowed prefixes (use --commit-auto-allow or update --commit-allow)",
+            message: "No changes matched allowed prefixes (update --commit-allow)",
         });
     }
     // `git add <pathspec>` is not reliable for staging deletes/renames across versions/configs.

package/dist/commands/guard/impl/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyDxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJlB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyDxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgJlB"}

package/dist/commands/guard/impl/commands.js

@@ -201,20 +201,12 @@ export async function cmdCommit(opts) {
             }
             return 0;
         }
-        let allow = opts.allow;
-        if (opts.autoAllow && allow.length === 0) {
-            const ctx = opts.ctx ??
-                (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
-            const staged = await ctx.git.statusStagedPaths();
-            const prefixes = suggestAllowPrefixes(staged);
-            if (prefixes.length === 0) {
-                throw new CliError({
-                    exitCode: 5,
-                    code: "E_GIT",
-                    message: "No staged files (git index empty)",
-                });
-            }
-            allow = prefixes;
+        if (opts.autoAllow) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
         }
         await guardCommitCheck({
             ctx: opts.ctx,
@@ -222,7 +214,7 @@ export async function cmdCommit(opts) {
             rootOverride: opts.rootOverride,
             taskId: opts.taskId,
             message: opts.message,
-            allow,
+            allow: opts.allow,
             allowBase: opts.allowBase,
             allowTasks: opts.allowTasks,
             allowPolicy: opts.allowPolicy,

package/dist/commands/guard/impl/comment-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAS/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+F/D"}
+{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyF/D"}

package/dist/commands/guard/impl/comment-commit.js

@@ -2,10 +2,9 @@ import { extractTaskSuffix } from "@agentplaneorg/core";
 import { invalidValueMessage, successMessage } from "../../../cli/output.js";
 import { CliError } from "../../../shared/errors.js";
 import { formatCommentBodyForCommit, normalizeCommentBodyForCommit, } from "../../../shared/comment-format.js";
-import { protectedPathKindForFile } from "../../../shared/protected-paths.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 import { buildGitCommitEnv } from "./env.js";
-import { stageAllowlist, suggestAllowPrefixes } from "./allow.js";
+import { stageAllowlist } from "./allow.js";
 import { guardCommitCheck } from "./policy.js";
 function deriveCommitMessageFromComment(opts) {
     const prefix = opts.emoji.trim();
@@ -49,27 +48,19 @@ function deriveCommitBodyFromComment(opts) {
 export async function commitFromComment(opts) {
     const ctx = opts.ctx ??
         (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
-    let allowPrefixes = opts.allow.map((prefix) => prefix.trim()).filter(Boolean);
-    if (opts.autoAllow && allowPrefixes.length === 0) {
-        const changed = await ctx.git.statusChangedPaths();
-        const tasksPath = opts.config.paths.tasks_path;
-        // Auto-allow is for ergonomic status commits. It must never silently
-        // broaden into policy/config/CI changes (those require explicit intent).
-        const eligible = changed.filter((filePath) => {
-            const kind = protectedPathKindForFile({ filePath, tasksPath });
-            if (!kind)
-                return true;
-            if (kind === "tasks")
-                return opts.allowTasks;
-            return false;
+    if (opts.autoAllow) {
+        throw new CliError({
+            exitCode: 2,
+            code: "E_USAGE",
+            message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
         });
-        allowPrefixes = suggestAllowPrefixes(eligible);
     }
+    let allowPrefixes = opts.allow.map((prefix) => prefix.trim()).filter(Boolean);
     if (allowPrefixes.length === 0) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Provide at least one --commit-allow prefix or enable --commit-auto-allow",
+            message: "Provide at least one --commit-allow prefix",
         });
     }
     const staged = await stageAllowlist({

package/dist/commands/hooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/hooks/index.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,UAAU,mDAAoD,CAAC;AAgG5E,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmClB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BlB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8HlB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/hooks/index.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,UAAU,mDAAoD,CAAC;AA8G5E,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmClB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BlB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8HlB"}

package/dist/commands/hooks/index.js

@@ -53,9 +53,14 @@ function hookScriptText(hook) {
         "#!/usr/bin/env sh",
         `# ${HOOK_MARKER} (do not edit)`,
         "set -e",
+        'REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"',
+        'SHIM="$REPO_ROOT/.agentplane/bin/agentplane"',
+        'if [ -x "$SHIM" ]; then',
+        '  exec "$SHIM" hooks run ' + hook + ' "$@"',
+        "fi",
         "if ! command -v agentplane >/dev/null 2>&1; then",
-        '  echo "agentplane hooks: agentplane not found in PATH" >&2',
-        "  exit 1",
+        '  echo "agentplane hooks: runner not found (PATH missing and shim unavailable)." >&2',
+        "  exit 127",
         "fi",
         "exec agentplane hooks run " + hook + ' "$@"',
         "",
@@ -66,11 +71,20 @@ function shimScriptText() {
         "#!/usr/bin/env sh",
         `# ${SHIM_MARKER} (do not edit)`,
         "set -e",
-        "if ! command -v agentplane >/dev/null 2>&1; then",
-        '  echo "agentplane shim: agentplane not found in PATH" >&2',
-        "  exit 1",
+        'SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"',
+        'REPO_ROOT="$(dirname "$(dirname "$SCRIPT_DIR")")"',
+        'LOCAL_BIN="$REPO_ROOT/packages/agentplane/bin/agentplane.js"',
+        'if command -v node >/dev/null 2>&1 && [ -f "$LOCAL_BIN" ]; then',
+        '  exec node "$LOCAL_BIN" "$@"',
+        "fi",
+        "if command -v npx >/dev/null 2>&1; then",
+        '  exec npx --yes agentplane "$@"',
+        "fi",
+        "if command -v agentplane >/dev/null 2>&1; then",
+        '  exec agentplane "$@"',
         "fi",
-        'exec agentplane "$@"',
+        'echo "agentplane shim: runner not found (need node+npx or agentplane in PATH)." >&2',
+        "  exit 127",
         "",
     ].join("\n");
 }

package/dist/commands/release/apply.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.command.d.ts","sourceRoot":"","sources":["../../../src/commands/release/apply.command.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAU1E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAsVnD,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,kBAAkB,CAwE5D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,cAAc,CAAC,kBAAkB,CAuK9D,CAAC"}
+{"version":3,"file":"apply.command.d.ts","sourceRoot":"","sources":["../../../src/commands/release/apply.command.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAU1E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAsVnD,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,kBAAkB,CAiF5D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,cAAc,CAAC,kBAAkB,CA+K9D,CAAC"}

package/dist/commands/release/apply.command.js

@@ -146,11 +146,11 @@ async function validateReleaseNotes(notesPath) {
         });
     }
     const bulletCount = content.split(/\r?\n/u).filter((line) => /^\s*[-*]\s+\S+/u.test(line)).length;
-    if (bulletCount < 3) {
+    if (bulletCount < 1) {
         throw new CliError({
             exitCode: exitCodeForError("E_VALIDATION"),
             code: "E_VALIDATION",
-            message: `Release notes must include at least 3 bullet points in ${notesPath}.`,
+            message: `Release notes must include at least one bullet point in ${notesPath}.`,
         });
     }
     if (/[\u0400-\u04FF]/u.test(content)) {
@@ -301,7 +301,8 @@ export const releaseApplySpec = {
             kind: "boolean",
             name: "push",
             default: false,
-            description: "Push the release commit and tag to the remote (requires --yes).",
+            description: "Mandatory for real releases: push commit and tag so GitHub publish workflow can publish to npm " +
+                "(requires --yes). Local tests can skip with AGENTPLANE_RELEASE_DRY_RUN=1.",
         },
         {
             kind: "string",
@@ -325,6 +326,13 @@ export const releaseApplySpec = {
         };
     },
     validate: (p) => {
+        if (!p.push && process.env.AGENTPLANE_RELEASE_DRY_RUN !== "1") {
+            throw usageError({
+                spec: releaseApplySpec,
+                command: "release apply",
+                message: "Release publish is mandatory. Run `agentplane release apply --push --yes`.",
+            });
+        }
         if (p.push && p.yes !== true) {
             throw usageError({
                 spec: releaseApplySpec,
@@ -356,6 +364,13 @@ export const releaseApplySpec = {
     ],
 };
 export const runReleaseApply = async (ctx, flags) => {
+    if (!flags.push && process.env.AGENTPLANE_RELEASE_DRY_RUN !== "1") {
+        throw usageError({
+            spec: releaseApplySpec,
+            command: "release apply",
+            message: "Release publish is mandatory. Run `agentplane release apply --push --yes`.",
+        });
+    }
     const resolved = await resolveProject({ cwd: ctx.cwd, rootOverride: ctx.rootOverride ?? null });
     const gitRoot = resolved.gitRoot;
     const planDir = flags.plan ? path.resolve(gitRoot, flags.plan) : await findLatestPlanDir(gitRoot);

package/dist/commands/release/plan.command.js

@@ -104,7 +104,7 @@ function releaseInstructions(opts) {
         `Write English release notes as \`docs/releases/${opts.nextTag}.md\`.\n\n` +
         `Rules:\n` +
         `- Use human-readable bullets focused on outcomes and user-facing improvements.\n` +
-        `- Minimum: 3 bullet points.\n` +
+        `- Include as many bullets as needed; do not enforce a fixed bullet count.\n` +
         `- Do not include Cyrillic.\n` +
         `- Use \`docs/releases/TEMPLATE.md\` as the structure.\n\n` +
         `Inputs:\n` +

package/dist/commands/scenario/impl/commands.d.ts

@@ -1,4 +1,10 @@
 import { resolveProject } from "@agentplaneorg/core";
+type RecipeToolRuntime = "node" | "bash";
+type RecipeToolInvocation = {
+    command: string;
+    args: string[];
+};
+export declare function resolveRecipeToolInvocation(runtime: RecipeToolRuntime, entrypoint: string, args: string[]): RecipeToolInvocation;
 export declare function cmdScenarioListParsed(opts: {
     cwd: string;
     rootOverride?: string;
@@ -9,6 +15,17 @@ export declare function cmdScenarioInfoParsed(opts: {
     recipeId: string;
     scenarioId: string;
 }): Promise<number>;
+export declare function executeRecipeTool(opts: {
+    runtime: RecipeToolRuntime;
+    entrypoint: string;
+    args: string[];
+    cwd: string;
+    env: Record<string, string>;
+}): Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;
 export declare function cmdScenarioRunParsed(opts: {
     cwd: string;
     rootOverride?: string;
@@ -16,4 +33,5 @@ export declare function cmdScenarioRunParsed(opts: {
     scenarioId: string;
     resolved?: Awaited<ReturnType<typeof resolveProject>>;
 }): Promise<number>;
+export {};
 //# sourceMappingURL=commands.d.ts.map

package/dist/commands/scenario/impl/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/scenario/impl/commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAgCtE,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoDlB;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoElB;AAkCD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;CACvD,GAAG,OAAO,CAAC,MAAM,CAAC,CAqNlB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/scenario/impl/commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAgCtE,KAAK,iBAAiB,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzC,KAAK,oBAAoB,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EAAE,GACb,oBAAoB,CAQtB;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoDlB;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoElB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA2ChE;AAMD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;CACvD,GAAG,OAAO,CAAC,MAAM,CAAC,CAuNlB"}