agentplane 0.2.24 → 0.2.25

package/dist/commands/block.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"block.spec.d.ts","sourceRoot":"","sources":["../../src/commands/block.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKvD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,WAAW,CA0H9C,CAAC"}
+{"version":3,"file":"block.spec.d.ts","sourceRoot":"","sources":["../../src/commands/block.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,WAAW,CA8I9C,CAAC"}

package/dist/commands/block.spec.js

@@ -1,4 +1,5 @@
 import { usageError } from "../cli/spec/errors.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 import { toStringList } from "../cli/spec/parse-utils.js";
 export const blockSpec = {
     id: ["block"],
@@ -44,13 +45,14 @@ export const blockSpec = {
             name: "commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --commit-from-comment).",
+            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --commit-from-comment). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --commit-from-comment).",
+            description: "Deprecated. Disabled for safety; pass explicit --commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -99,10 +101,29 @@ export const blockSpec = {
     validateRaw: (raw) => {
         const author = typeof raw.opts.author === "string" ? raw.opts.author.trim() : "";
         const body = typeof raw.opts.body === "string" ? raw.opts.body.trim() : "";
+        const commitAllow = toStringList(raw.opts["commit-allow"]);
         if (!author)
             throw usageError({ spec: blockSpec, message: "Invalid value for --author: empty." });
         if (!body)
             throw usageError({ spec: blockSpec, message: "Invalid value for --body: empty." });
+        if (findRepoWideAllowPrefixes(commitAllow).length > 0) {
+            throw usageError({
+                spec: blockSpec,
+                message: repoWideAllowPrefixMessage("--commit-allow"),
+            });
+        }
+        if (raw.opts["commit-auto-allow"] === true) {
+            throw usageError({
+                spec: blockSpec,
+                message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
+            });
+        }
+        if (raw.opts["commit-from-comment"] === true && commitAllow.length === 0) {
+            throw usageError({
+                spec: blockSpec,
+                message: "--commit-from-comment requires --commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: typeof raw.args["task-id"] === "string" ? raw.args["task-id"] : "",

package/dist/commands/commit.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.spec.d.ts","sourceRoot":"","sources":["../../src/commands/commit.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAmJhD,CAAC"}
+{"version":3,"file":"commit.spec.d.ts","sourceRoot":"","sources":["../../src/commands/commit.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CA8JhD,CAAC"}

package/dist/commands/commit.spec.js

@@ -1,4 +1,5 @@
 import { usageError } from "../cli/spec/errors.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 export const commitSpec = {
     id: ["commit"],
     group: "Guard",
@@ -35,13 +36,14 @@ export const commitSpec = {
             name: "allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowed path prefix (git-path).",
+            description: "Repeatable. Allowed path prefix (git-path). Use minimal prefixes; repo-wide '.' is rejected (tip: `agentplane guard suggest-allow --format args`).",
         },
         {
             kind: "boolean",
             name: "auto-allow",
             default: false,
-            description: "Infer --allow prefixes from staged paths (only when no explicit --allow is provided).",
+            description: "Deprecated. Disabled for safety; pass explicit --allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -77,10 +79,6 @@ export const commitSpec = {
             cmd: 'agentplane commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --allow packages/agentplane',
             why: "Create a commit after validating allowlist and subject policy.",
         },
-        {
-            cmd: 'agentplane commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --auto-allow',
-            why: "Infer allowlist prefixes from staged paths.",
-        },
         {
             cmd: "agentplane commit 202602030608-F1Q8AB --close",
             why: "Create a close commit for the task README using a deterministic message builder.",
@@ -120,6 +118,20 @@ export const commitSpec = {
         if (Array.isArray(allow) && allow.some((s) => typeof s === "string" && s.trim() === "")) {
             throw usageError({ spec: commitSpec, message: "Invalid value for --allow: empty." });
         }
+        const allowList = Array.isArray(allow)
+            ? allow
+            : typeof allow === "string"
+                ? [allow]
+                : [];
+        if (findRepoWideAllowPrefixes(allowList).length > 0) {
+            throw usageError({ spec: commitSpec, message: repoWideAllowPrefixMessage("--allow") });
+        }
+        if (raw.opts["auto-allow"] === true) {
+            throw usageError({
+                spec: commitSpec,
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: String(raw.args["task-id"]),

package/dist/commands/finish.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finish.spec.d.ts","sourceRoot":"","sources":["../../src/commands/finish.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKvD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAqPhD,CAAC"}
+{"version":3,"file":"finish.spec.d.ts","sourceRoot":"","sources":["../../src/commands/finish.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAsShD,CAAC"}

package/dist/commands/finish.spec.js

@@ -1,5 +1,6 @@
 import { usageError } from "../cli/spec/errors.js";
 import { toStringList } from "../cli/spec/parse-utils.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 export const finishSpec = {
     id: ["finish"],
     group: "Lifecycle",
@@ -77,13 +78,14 @@ export const finishSpec = {
             name: "commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the commit (used with --commit-from-comment).",
+            description: "Repeatable. Allowlist path prefixes to stage for the commit (used with --commit-from-comment). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --commit-from-comment).",
+            description: "Deprecated. Disabled for safety; pass explicit --commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -116,13 +118,14 @@ export const finishSpec = {
             name: "status-commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --status-commit).",
+            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --status-commit). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "status-commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --status-commit).",
+            description: "Deprecated. Disabled for safety; pass explicit --status-commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -165,6 +168,38 @@ export const finishSpec = {
         const taskIds = Array.isArray(ids) ? ids : [];
         const commitFromComment = raw.opts["commit-from-comment"] === true;
         const statusCommit = raw.opts["status-commit"] === true;
+        const commitAllow = toStringList(raw.opts["commit-allow"]);
+        const statusCommitAllow = toStringList(raw.opts["status-commit-allow"]);
+        const commitAutoAllow = raw.opts["commit-auto-allow"] === true;
+        const statusCommitAutoAllow = raw.opts["status-commit-auto-allow"] === true;
+        if (findRepoWideAllowPrefixes(commitAllow).length > 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: repoWideAllowPrefixMessage("--commit-allow"),
+            });
+        }
+        if (findRepoWideAllowPrefixes(statusCommitAllow).length > 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: repoWideAllowPrefixMessage("--status-commit-allow"),
+            });
+        }
+        if (commitAutoAllow) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
+            });
+        }
+        if (statusCommitAutoAllow) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--status-commit-auto-allow is disabled; pass explicit --status-commit-allow <path-prefix>.",
+            });
+        }
         if ((commitFromComment || statusCommit) && taskIds.length !== 1) {
             throw usageError({
                 spec: finishSpec,
@@ -172,6 +207,20 @@ export const finishSpec = {
                 message: "--commit-from-comment/--status-commit requires exactly one task id",
             });
         }
+        if (commitFromComment && commitAllow.length === 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--commit-from-comment requires --commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
+        if (statusCommit && statusCommitAllow.length === 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--status-commit requires --status-commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
         if (raw.opts["close-commit"] === true && taskIds.length !== 1) {
             throw usageError({
                 spec: finishSpec,

package/dist/commands/guard/commit.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CA+F1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CAkCtE"}
+{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CA0G1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CA2BtE"}

package/dist/commands/guard/commit.command.js

@@ -1,6 +1,7 @@
 import { usageError } from "../../cli/spec/errors.js";
 import { CliError } from "../../shared/errors.js";
-import { cmdGuardCommit, suggestAllowPrefixes } from "./index.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../../shared/allow-prefix-policy.js";
+import { cmdGuardCommit } from "./index.js";
 export const guardCommitSpec = {
     id: ["guard", "commit"],
     group: "Guard",
@@ -20,13 +21,14 @@ export const guardCommitSpec = {
             name: "allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowed path prefix (git-path).",
+            description: "Repeatable. Allowed path prefix (git-path). Use minimal prefixes; repo-wide '.' is rejected (tip: `agentplane guard suggest-allow --format args`).",
         },
         {
             kind: "boolean",
             name: "auto-allow",
             default: false,
-            description: "Infer --allow prefixes from staged paths (only when no explicit --allow is provided).",
+            description: "Deprecated. Disabled for safety; pass explicit --allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -62,10 +64,6 @@ export const guardCommitSpec = {
             cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --allow packages/agentplane',
             why: "Validate staged changes are covered by allowlist and policy.",
         },
-        {
-            cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --auto-allow',
-            why: "Infer allowlist prefixes from staged paths.",
-        },
     ],
     validateRaw: (raw) => {
         const msg = typeof raw.opts.message === "string" ? raw.opts.message.trim() : "";
@@ -76,6 +74,20 @@ export const guardCommitSpec = {
         if (Array.isArray(allow) && allow.some((s) => typeof s === "string" && s.trim() === "")) {
             throw usageError({ spec: guardCommitSpec, message: "Invalid value for --allow: empty." });
         }
+        const allowList = Array.isArray(allow)
+            ? allow
+            : typeof allow === "string"
+                ? [allow]
+                : [];
+        if (findRepoWideAllowPrefixes(allowList).length > 0) {
+            throw usageError({ spec: guardCommitSpec, message: repoWideAllowPrefixMessage("--allow") });
+        }
+        if (raw.opts["auto-allow"] === true) {
+            throw usageError({
+                spec: guardCommitSpec,
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: String(raw.args["task-id"]),
@@ -99,18 +111,12 @@ export const guardCommitSpec = {
 export function makeRunGuardCommitHandler(getCtx) {
     return async (ctx, p) => {
         const cmdCtx = await getCtx("guard commit");
-        let allow = p.allow;
-        if (p.autoAllow && allow.length === 0) {
-            const staged = await cmdCtx.git.statusStagedPaths();
-            const prefixes = suggestAllowPrefixes(staged);
-            if (prefixes.length === 0) {
-                throw new CliError({
-                    exitCode: 5,
-                    code: "E_GIT",
-                    message: "No staged files (git index empty)",
-                });
-            }
-            allow = prefixes;
+        if (p.autoAllow) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
         }
         return await cmdGuardCommit({
             ctx: cmdCtx,
@@ -118,7 +124,7 @@ export function makeRunGuardCommitHandler(getCtx) {
             rootOverride: ctx.rootOverride,
             taskId: p.taskId,
             message: p.message,
-            allow,
+            allow: p.allow,
             allowBase: p.allowBase,
             allowTasks: p.allowTasks,
             allowPolicy: p.allowPolicy,

package/dist/commands/guard/impl/allow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2CpB"}
+{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkDpB"}

package/dist/commands/guard/impl/allow.js

@@ -82,6 +82,13 @@ export async function stageAllowlist(opts) {
             message: "Provide at least one allowed prefix",
         });
     }
+    if (allow.includes(".")) {
+        throw new CliError({
+            exitCode: 2,
+            code: "E_USAGE",
+            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
+        });
+    }
     const denied = new Set();
     if (!opts.allowTasks)
         denied.add(opts.tasksPath);
@@ -98,7 +105,7 @@ export async function stageAllowlist(opts) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "No changes matched allowed prefixes (use --commit-auto-allow or update --commit-allow)",
+            message: "No changes matched allowed prefixes (update --commit-allow)",
         });
     }
     // `git add <pathspec>` is not reliable for staging deletes/renames across versions/configs.

package/dist/commands/guard/impl/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyDxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJlB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyDxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgJlB"}

package/dist/commands/guard/impl/commands.js

@@ -201,20 +201,12 @@ export async function cmdCommit(opts) {
             }
             return 0;
         }
-        let allow = opts.allow;
-        if (opts.autoAllow && allow.length === 0) {
-            const ctx = opts.ctx ??
-                (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
-            const staged = await ctx.git.statusStagedPaths();
-            const prefixes = suggestAllowPrefixes(staged);
-            if (prefixes.length === 0) {
-                throw new CliError({
-                    exitCode: 5,
-                    code: "E_GIT",
-                    message: "No staged files (git index empty)",
-                });
-            }
-            allow = prefixes;
+        if (opts.autoAllow) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
         }
         await guardCommitCheck({
             ctx: opts.ctx,
@@ -222,7 +214,7 @@ export async function cmdCommit(opts) {
             rootOverride: opts.rootOverride,
             taskId: opts.taskId,
             message: opts.message,
-            allow,
+            allow: opts.allow,
             allowBase: opts.allowBase,
             allowTasks: opts.allowTasks,
             allowPolicy: opts.allowPolicy,

package/dist/commands/guard/impl/comment-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAS/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+F/D"}
+{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyF/D"}

package/dist/commands/guard/impl/comment-commit.js

@@ -2,10 +2,9 @@ import { extractTaskSuffix } from "@agentplaneorg/core";
 import { invalidValueMessage, successMessage } from "../../../cli/output.js";
 import { CliError } from "../../../shared/errors.js";
 import { formatCommentBodyForCommit, normalizeCommentBodyForCommit, } from "../../../shared/comment-format.js";
-import { protectedPathKindForFile } from "../../../shared/protected-paths.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 import { buildGitCommitEnv } from "./env.js";
-import { stageAllowlist, suggestAllowPrefixes } from "./allow.js";
+import { stageAllowlist } from "./allow.js";
 import { guardCommitCheck } from "./policy.js";
 function deriveCommitMessageFromComment(opts) {
     const prefix = opts.emoji.trim();
@@ -49,27 +48,19 @@ function deriveCommitBodyFromComment(opts) {
 export async function commitFromComment(opts) {
     const ctx = opts.ctx ??
         (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
-    let allowPrefixes = opts.allow.map((prefix) => prefix.trim()).filter(Boolean);
-    if (opts.autoAllow && allowPrefixes.length === 0) {
-        const changed = await ctx.git.statusChangedPaths();
-        const tasksPath = opts.config.paths.tasks_path;
-        // Auto-allow is for ergonomic status commits. It must never silently
-        // broaden into policy/config/CI changes (those require explicit intent).
-        const eligible = changed.filter((filePath) => {
-            const kind = protectedPathKindForFile({ filePath, tasksPath });
-            if (!kind)
-                return true;
-            if (kind === "tasks")
-                return opts.allowTasks;
-            return false;
+    if (opts.autoAllow) {
+        throw new CliError({
+            exitCode: 2,
+            code: "E_USAGE",
+            message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
         });
-        allowPrefixes = suggestAllowPrefixes(eligible);
     }
+    let allowPrefixes = opts.allow.map((prefix) => prefix.trim()).filter(Boolean);
     if (allowPrefixes.length === 0) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Provide at least one --commit-allow prefix or enable --commit-auto-allow",
+            message: "Provide at least one --commit-allow prefix",
         });
     }
     const staged = await stageAllowlist({

package/dist/commands/start.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.spec.d.ts","sourceRoot":"","sources":["../../src/commands/start.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKvD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,WAAW,CA0H9C,CAAC"}
+{"version":3,"file":"start.spec.d.ts","sourceRoot":"","sources":["../../src/commands/start.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,WAAW,CA8I9C,CAAC"}

package/dist/commands/start.spec.js

@@ -1,4 +1,5 @@
 import { usageError } from "../cli/spec/errors.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 import { toStringList } from "../cli/spec/parse-utils.js";
 export const startSpec = {
     id: ["start"],
@@ -44,13 +45,14 @@ export const startSpec = {
             name: "commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --commit-from-comment).",
+            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --commit-from-comment). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --commit-from-comment).",
+            description: "Deprecated. Disabled for safety; pass explicit --commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -99,10 +101,29 @@ export const startSpec = {
     validateRaw: (raw) => {
         const author = typeof raw.opts.author === "string" ? raw.opts.author.trim() : "";
         const body = typeof raw.opts.body === "string" ? raw.opts.body.trim() : "";
+        const commitAllow = toStringList(raw.opts["commit-allow"]);
         if (!author)
             throw usageError({ spec: startSpec, message: "Invalid value for --author: empty." });
         if (!body)
             throw usageError({ spec: startSpec, message: "Invalid value for --body: empty." });
+        if (findRepoWideAllowPrefixes(commitAllow).length > 0) {
+            throw usageError({
+                spec: startSpec,
+                message: repoWideAllowPrefixMessage("--commit-allow"),
+            });
+        }
+        if (raw.opts["commit-auto-allow"] === true) {
+            throw usageError({
+                spec: startSpec,
+                message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
+            });
+        }
+        if (raw.opts["commit-from-comment"] === true && commitAllow.length === 0) {
+            throw usageError({
+                spec: startSpec,
+                message: "--commit-from-comment requires --commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: typeof raw.args["task-id"] === "string" ? raw.args["task-id"] : "",

package/dist/commands/task/finish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finish.d.ts","sourceRoot":"","sources":["../../../src/commands/task/finish.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AAmCnC,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqUlB"}
+{"version":3,"file":"finish.d.ts","sourceRoot":"","sources":["../../../src/commands/task/finish.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AAmCnC,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2VlB"}

package/dist/commands/task/finish.js

@@ -40,13 +40,7 @@ export async function cmdFinish(opts) {
         }
         const { prefix, min_chars: minChars } = ctx.config.tasks.comments.verified;
         requireStructuredComment(opts.body, prefix, minChars);
-        const autoStatusCommit = (ctx.config.finish_auto_status_commit === true ||
-            ctx.config.commit_automation === "finish_only") &&
-            !opts.commitFromComment &&
-            !opts.statusCommit &&
-            opts.closeCommit !== true &&
-            opts.taskIds.length === 1;
-        const statusCommitRequested = opts.statusCommit || autoStatusCommit;
+        const statusCommitRequested = opts.statusCommit;
         if ((opts.commitFromComment || statusCommitRequested) && opts.taskIds.length !== 1) {
             throw new CliError({
                 exitCode: 2,
@@ -76,6 +70,34 @@ export async function cmdFinish(opts) {
                 message: "--commit-from-comment/--status-commit requires exactly one task id",
             });
         }
+        if (opts.commitAutoAllow) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
+            });
+        }
+        if (opts.statusCommitAutoAllow) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--status-commit-auto-allow is disabled; pass explicit --status-commit-allow <path-prefix>.",
+            });
+        }
+        if (opts.commitFromComment && opts.commitAllow.length === 0) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--commit-from-comment requires --commit-allow <path-prefix>",
+            });
+        }
+        if (statusCommitRequested && opts.statusCommitAllow.length === 0) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--status-commit requires --status-commit-allow <path-prefix>",
+            });
+        }
         const gitRoot = ctx.resolvedProject.gitRoot;
         const commitInfo = opts.commit
             ? await readCommitInfo(gitRoot, opts.commit)
@@ -168,7 +190,7 @@ export async function cmdFinish(opts) {
             enforceStatusCommitPolicy({
                 policy: ctx.config.status_commit_policy,
                 action: "finish",
-                confirmed: opts.confirmStatusCommit || autoStatusCommit,
+                confirmed: opts.confirmStatusCommit,
                 quiet: opts.quiet,
                 statusFrom: primaryStatusFrom ?? "UNKNOWN",
                 statusTo: "DONE",
@@ -208,7 +230,7 @@ export async function cmdFinish(opts) {
                 formattedComment: formatCommentBodyForCommit(opts.body, ctx.config),
                 emoji: opts.commitEmoji ?? defaultCommitEmojiForStatus("DONE"),
                 allow: opts.commitAllow,
-                autoAllow: opts.commitAutoAllow || opts.commitAllow.length === 0,
+                autoAllow: false,
                 allowTasks: opts.commitAllowTasks,
                 requireClean: opts.commitRequireClean,
                 quiet: opts.quiet,
@@ -269,7 +291,7 @@ export async function cmdFinish(opts) {
                 formattedComment: formatCommentBodyForCommit(opts.body, ctx.config),
                 emoji: opts.statusCommitEmoji ?? defaultCommitEmojiForStatus("DONE"),
                 allow: opts.statusCommitAllow,
-                autoAllow: opts.statusCommitAutoAllow || opts.statusCommitAllow.length === 0,
+                autoAllow: false,
                 allowTasks: true,
                 requireClean: opts.statusCommitRequireClean,
                 quiet: opts.quiet,

package/dist/commands/task/set-status.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-status.command.d.ts","sourceRoot":"","sources":["../../../src/commands/task/set-status.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,mBAAmB,CAoJ9D,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC5E,KAAK,UAAU,EAAE,GAAG,mBAAmB,KAAG,OAAO,CAAC,MAAM,CAAC,CAsBxE"}
+{"version":3,"file":"set-status.command.d.ts","sourceRoot":"","sources":["../../../src/commands/task/set-status.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,mBAAmB,CAyK9D,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC5E,KAAK,UAAU,EAAE,GAAG,mBAAmB,KAAG,OAAO,CAAC,MAAM,CAAC,CAsBxE"}

package/dist/commands/task/set-status.command.js

@@ -1,5 +1,6 @@
 import { usageError } from "../../cli/spec/errors.js";
 import { toStringList } from "../../cli/spec/parse-utils.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../../shared/allow-prefix-policy.js";
 import { cmdTaskSetStatus } from "./set-status.js";
 export const taskSetStatusSpec = {
     id: ["task", "set-status"],
@@ -57,13 +58,14 @@ export const taskSetStatusSpec = {
             name: "commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist prefix for commit-from-comment staging.",
+            description: "Repeatable. Allowlist prefix for commit-from-comment staging. Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "commit-auto-allow",
             default: false,
-            description: "Auto-derive allowlist prefixes from staged paths (commit-from-comment).",
+            description: "Deprecated. Disabled for safety; pass explicit --commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -125,6 +127,24 @@ export const taskSetStatusSpec = {
                 message: "Invalid value for --commit-allow: empty.",
             });
         }
+        if (findRepoWideAllowPrefixes(allow).length > 0) {
+            throw usageError({
+                spec: taskSetStatusSpec,
+                message: repoWideAllowPrefixMessage("--commit-allow"),
+            });
+        }
+        if (raw.opts["commit-auto-allow"] === true) {
+            throw usageError({
+                spec: taskSetStatusSpec,
+                message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
+            });
+        }
+        if (raw.opts["commit-from-comment"] === true && allow.length === 0) {
+            throw usageError({
+                spec: taskSetStatusSpec,
+                message: "--commit-from-comment requires --commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
     },
     parse: (raw) => {
         const commitAllow = toStringList(raw.opts["commit-allow"]);

package/dist/policy/rules/allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../../src/policy/rules/allowlist.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CA+B9D"}
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../../src/policy/rules/allowlist.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CA0C9D"}

package/dist/policy/rules/allowlist.js

@@ -17,6 +17,15 @@ export function allowlistRule(ctx) {
         };
     }
     const allow = allowRaw.map((p) => normalizeGitPathPrefix(p));
+    if (allow.includes(".")) {
+        return {
+            ok: false,
+            errors: [
+                gitError("Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`)."),
+            ],
+            warnings: [],
+        };
+    }
     const errors = [];
     for (const filePath of staged) {
         if (!allow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {

package/dist/shared/allow-prefix-policy.d.ts

@@ -0,0 +1,3 @@
+export declare function findRepoWideAllowPrefixes(prefixes: string[]): string[];
+export declare function repoWideAllowPrefixMessage(flagName: string): string;
+//# sourceMappingURL=allow-prefix-policy.d.ts.map

package/dist/shared/allow-prefix-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-prefix-policy.d.ts","sourceRoot":"","sources":["../../src/shared/allow-prefix-policy.ts"],"names":[],"mappings":"AAEA,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAEtE;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKnE"}

package/dist/shared/allow-prefix-policy.js

@@ -0,0 +1,8 @@
+import { normalizeGitPathPrefix } from "./git-path.js";
+export function findRepoWideAllowPrefixes(prefixes) {
+    return prefixes.filter((prefix) => normalizeGitPathPrefix(prefix) === ".");
+}
+export function repoWideAllowPrefixMessage(flagName) {
+    return (`${flagName} cannot be repo-wide ('.'). ` +
+        "Choose minimal path prefixes; tip: `agentplane guard suggest-allow --format args`.");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentplane",
-  "version": "0.2.24",
+  "version": "0.2.25",
   "description": "Agent Plane CLI for task workflows, recipes, and project automation.",
   "keywords": [
     "agentplane",
@@ -55,7 +55,7 @@
     "prepublishOnly": "node ../../scripts/enforce-github-publish.mjs && npm run prepack"
   },
   "dependencies": {
-    "@agentplaneorg/core": "0.2.24",
+    "@agentplaneorg/core": "0.2.25",
     "yauzl": "^2.10.0"
   },
   "devDependencies": {