agentplane 0.2.24 → 0.2.26

package/dist/commands/commit.spec.js

@@ -1,4 +1,5 @@
 import { usageError } from "../cli/spec/errors.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 export const commitSpec = {
     id: ["commit"],
     group: "Guard",
@@ -35,13 +36,14 @@ export const commitSpec = {
             name: "allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowed path prefix (git-path).",
+            description: "Repeatable. Allowed path prefix (git-path). Use minimal prefixes; repo-wide '.' is rejected (tip: `agentplane guard suggest-allow --format args`).",
         },
         {
             kind: "boolean",
             name: "auto-allow",
             default: false,
-            description: "Infer --allow prefixes from staged paths (only when no explicit --allow is provided).",
+            description: "Deprecated. Disabled for safety; pass explicit --allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -77,10 +79,6 @@ export const commitSpec = {
             cmd: 'agentplane commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --allow packages/agentplane',
             why: "Create a commit after validating allowlist and subject policy.",
         },
-        {
-            cmd: 'agentplane commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --auto-allow',
-            why: "Infer allowlist prefixes from staged paths.",
-        },
         {
             cmd: "agentplane commit 202602030608-F1Q8AB --close",
             why: "Create a close commit for the task README using a deterministic message builder.",
@@ -120,6 +118,20 @@ export const commitSpec = {
         if (Array.isArray(allow) && allow.some((s) => typeof s === "string" && s.trim() === "")) {
             throw usageError({ spec: commitSpec, message: "Invalid value for --allow: empty." });
         }
+        const allowList = Array.isArray(allow)
+            ? allow
+            : typeof allow === "string"
+                ? [allow]
+                : [];
+        if (findRepoWideAllowPrefixes(allowList).length > 0) {
+            throw usageError({ spec: commitSpec, message: repoWideAllowPrefixMessage("--allow") });
+        }
+        if (raw.opts["auto-allow"] === true) {
+            throw usageError({
+                spec: commitSpec,
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: String(raw.args["task-id"]),

package/dist/commands/doctor.run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.run.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.run.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAK1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsPrD,eAAO,MAAM,SAAS,EAAE,cAAc,CAAC,YAAY,CAwBlD,CAAC"}
+{"version":3,"file":"doctor.run.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.run.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAK1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAqUrD,eAAO,MAAM,SAAS,EAAE,cAAc,CAAC,YAAY,CAmDlD,CAAC"}

package/dist/commands/doctor.run.js

@@ -5,6 +5,7 @@ import { warnMessage, successMessage } from "../cli/output.js";
 import { RUNTIME_GITIGNORE_LINES } from "../shared/runtime-artifacts.js";
 import { execFileAsync, gitEnv } from "./shared/git.js";
 import { loadCommandContext } from "./shared/task-backend.js";
+import { emitWorkflowEvent, isWorkflowEnforcementDisabled, resolveWorkflowPaths, safeAutofixWorkflowText, validateWorkflowAtPath, workflowEnforcementEnvHint, } from "../workflow-runtime/index.js";
 async function listTsFiles(rootDir) {
     const out = [];
     async function walk(absDir) {
@@ -160,6 +161,75 @@ async function safeFixTaskIndex(repoRoot) {
         return { changed: false, note: "Skip: could not rebuild tasks index cache." };
     }
 }
+async function checkWorkflowContract(repoRoot) {
+    const result = await validateWorkflowAtPath(repoRoot);
+    const findings = result.diagnostics.map((d) => `[${d.severity}] ${d.code} ${d.path}: ${d.message}`);
+    emitWorkflowEvent({
+        event: "workflow_doctor_check",
+        details: { ok: result.ok, findings: result.diagnostics.length },
+    });
+    return findings;
+}
+function findingSeverity(problem) {
+    const normalized = problem.trimStart();
+    if (normalized.startsWith("[WARN]"))
+        return "WARN";
+    if (normalized.startsWith("[INFO]"))
+        return "INFO";
+    if (normalized.startsWith("[ERROR]"))
+        return "ERROR";
+    return "ERROR";
+}
+async function safeFixWorkflow(repoRoot) {
+    const paths = resolveWorkflowPaths(repoRoot);
+    let current = "";
+    let sourcePath = paths.workflowPath;
+    try {
+        current = await fs.readFile(paths.workflowPath, "utf8");
+    }
+    catch {
+        try {
+            current = await fs.readFile(paths.legacyWorkflowPath, "utf8");
+            sourcePath = paths.legacyWorkflowPath;
+        }
+        catch {
+            return { changed: false, note: "Skip: workflow contract file not found." };
+        }
+    }
+    const fixed = safeAutofixWorkflowText(current);
+    if (fixed.diagnostics.some((d) => d.code === "WF_FIX_SKIPPED_UNSAFE")) {
+        const details = fixed.diagnostics.map((d) => `${d.path}`).join(", ");
+        return {
+            changed: false,
+            note: `Skip: unsafe workflow autofix required (unknown keys). Proposed manual review: ${details}`,
+        };
+    }
+    if (!fixed.changed) {
+        if (sourcePath === paths.workflowPath) {
+            return { changed: false, note: "OK: workflow contract already normalized." };
+        }
+        await fs.mkdir(path.dirname(paths.workflowPath), { recursive: true });
+        await fs.writeFile(paths.workflowPath, current, "utf8");
+        await fs.rm(paths.legacyWorkflowPath, { force: true });
+        await fs.mkdir(paths.workflowDir, { recursive: true });
+        await fs.copyFile(paths.workflowPath, paths.lastKnownGoodPath);
+        return {
+            changed: true,
+            note: "Fixed: moved legacy WORKFLOW.md into .agentplane and refreshed last-known-good.",
+        };
+    }
+    await fs.mkdir(path.dirname(paths.workflowPath), { recursive: true });
+    await fs.writeFile(paths.workflowPath, fixed.text, "utf8");
+    if (sourcePath === paths.legacyWorkflowPath) {
+        await fs.rm(paths.legacyWorkflowPath, { force: true });
+    }
+    await fs.mkdir(paths.workflowDir, { recursive: true });
+    await fs.copyFile(paths.workflowPath, paths.lastKnownGoodPath);
+    return {
+        changed: true,
+        note: "Fixed: normalized workflow contract and refreshed last-known-good.",
+    };
+}
 async function checkDoneTaskCommitInvariants(repoRoot) {
     const tasksPath = path.join(repoRoot, ".agentplane", "tasks.json");
     let raw = "";
@@ -228,22 +298,38 @@ async function checkDoneTaskCommitInvariants(repoRoot) {
 export const runDoctor = async (ctx, p) => {
     const resolved = await resolveProject({ cwd: ctx.cwd, rootOverride: ctx.rootOverride ?? null });
     const repoRoot = resolved.gitRoot;
-    const problems = await checkWorkspace(repoRoot);
-    problems.push(...(await checkDoneTaskCommitInvariants(repoRoot)));
-    if (p.dev) {
-        problems.push(...(await checkLayering(repoRoot)));
-    }
-    if (problems.length > 0) {
-        console.error(warnMessage(`doctor found ${problems.length} problem(s):`));
-        for (const prob of problems)
-            console.error(`- ${prob}`);
-        return 1;
+    const runChecks = async () => {
+        const checks = await checkWorkspace(repoRoot);
+        checks.push(...(await checkDoneTaskCommitInvariants(repoRoot)));
+        if (!isWorkflowEnforcementDisabled()) {
+            checks.push(...(await checkWorkflowContract(repoRoot)));
+        }
+        if (p.dev) {
+            checks.push(...(await checkLayering(repoRoot)));
+        }
+        return checks;
+    };
+    if (isWorkflowEnforcementDisabled()) {
+        console.log(successMessage("doctor", undefined, `workflow contract checks disabled via ${workflowEnforcementEnvHint()}.`));
     }
     if (p.fix) {
         const fix = await safeFixGitignore(repoRoot);
         console.log(successMessage("doctor fix", undefined, fix.note));
         const idx = await safeFixTaskIndex(repoRoot);
         console.log(successMessage("doctor fix", undefined, idx.note));
+        const workflowFix = await safeFixWorkflow(repoRoot);
+        console.log(successMessage("doctor fix", undefined, workflowFix.note));
+    }
+    const problems = await runChecks();
+    const errors = problems.filter((problem) => findingSeverity(problem) === "ERROR");
+    if (problems.length > 0) {
+        const warningCount = problems.filter((problem) => findingSeverity(problem) === "WARN").length;
+        const infoCount = problems.filter((problem) => findingSeverity(problem) === "INFO").length;
+        console.error(warnMessage(`doctor findings: errors=${errors.length} warnings=${warningCount} info=${infoCount}`));
+        for (const prob of problems)
+            console.error(`- ${prob}`);
+        if (errors.length > 0)
+            return 1;
     }
     console.log(successMessage("doctor", undefined, "OK"));
     return 0;

package/dist/commands/finish.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finish.spec.d.ts","sourceRoot":"","sources":["../../src/commands/finish.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKvD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAqPhD,CAAC"}
+{"version":3,"file":"finish.spec.d.ts","sourceRoot":"","sources":["../../src/commands/finish.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAsShD,CAAC"}

package/dist/commands/finish.spec.js

@@ -1,5 +1,6 @@
 import { usageError } from "../cli/spec/errors.js";
 import { toStringList } from "../cli/spec/parse-utils.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../shared/allow-prefix-policy.js";
 export const finishSpec = {
     id: ["finish"],
     group: "Lifecycle",
@@ -77,13 +78,14 @@ export const finishSpec = {
             name: "commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the commit (used with --commit-from-comment).",
+            description: "Repeatable. Allowlist path prefixes to stage for the commit (used with --commit-from-comment). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --commit-from-comment).",
+            description: "Deprecated. Disabled for safety; pass explicit --commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -116,13 +118,14 @@ export const finishSpec = {
             name: "status-commit-allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --status-commit).",
+            description: "Repeatable. Allowlist path prefixes to stage for the status commit (used with --status-commit). Use minimal prefixes; '.' is rejected.",
         },
         {
             kind: "boolean",
             name: "status-commit-auto-allow",
             default: false,
-            description: "Auto-allow inferred allowlist paths if none are provided (used with --status-commit).",
+            description: "Deprecated. Disabled for safety; pass explicit --status-commit-allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -165,6 +168,38 @@ export const finishSpec = {
         const taskIds = Array.isArray(ids) ? ids : [];
         const commitFromComment = raw.opts["commit-from-comment"] === true;
         const statusCommit = raw.opts["status-commit"] === true;
+        const commitAllow = toStringList(raw.opts["commit-allow"]);
+        const statusCommitAllow = toStringList(raw.opts["status-commit-allow"]);
+        const commitAutoAllow = raw.opts["commit-auto-allow"] === true;
+        const statusCommitAutoAllow = raw.opts["status-commit-auto-allow"] === true;
+        if (findRepoWideAllowPrefixes(commitAllow).length > 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: repoWideAllowPrefixMessage("--commit-allow"),
+            });
+        }
+        if (findRepoWideAllowPrefixes(statusCommitAllow).length > 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: repoWideAllowPrefixMessage("--status-commit-allow"),
+            });
+        }
+        if (commitAutoAllow) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
+            });
+        }
+        if (statusCommitAutoAllow) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--status-commit-auto-allow is disabled; pass explicit --status-commit-allow <path-prefix>.",
+            });
+        }
         if ((commitFromComment || statusCommit) && taskIds.length !== 1) {
             throw usageError({
                 spec: finishSpec,
@@ -172,6 +207,20 @@ export const finishSpec = {
                 message: "--commit-from-comment/--status-commit requires exactly one task id",
             });
         }
+        if (commitFromComment && commitAllow.length === 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--commit-from-comment requires --commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
+        if (statusCommit && statusCommitAllow.length === 0) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--status-commit requires --status-commit-allow <path-prefix> (tip: `agentplane guard suggest-allow --format args`).",
+            });
+        }
         if (raw.opts["close-commit"] === true && taskIds.length !== 1) {
             throw usageError({
                 spec: finishSpec,

package/dist/commands/guard/commit.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CA+F1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CAkCtE"}
+{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CA0G1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CA2BtE"}

package/dist/commands/guard/commit.command.js

@@ -1,6 +1,7 @@
 import { usageError } from "../../cli/spec/errors.js";
 import { CliError } from "../../shared/errors.js";
-import { cmdGuardCommit, suggestAllowPrefixes } from "./index.js";
+import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../../shared/allow-prefix-policy.js";
+import { cmdGuardCommit } from "./index.js";
 export const guardCommitSpec = {
     id: ["guard", "commit"],
     group: "Guard",
@@ -20,13 +21,14 @@ export const guardCommitSpec = {
             name: "allow",
             valueHint: "<path-prefix>",
             repeatable: true,
-            description: "Repeatable. Allowed path prefix (git-path).",
+            description: "Repeatable. Allowed path prefix (git-path). Use minimal prefixes; repo-wide '.' is rejected (tip: `agentplane guard suggest-allow --format args`).",
         },
         {
             kind: "boolean",
             name: "auto-allow",
             default: false,
-            description: "Infer --allow prefixes from staged paths (only when no explicit --allow is provided).",
+            description: "Deprecated. Disabled for safety; pass explicit --allow prefixes.",
+            deprecated: "disabled",
         },
         {
             kind: "boolean",
@@ -62,10 +64,6 @@ export const guardCommitSpec = {
             cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --allow packages/agentplane',
             why: "Validate staged changes are covered by allowlist and policy.",
         },
-        {
-            cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --auto-allow',
-            why: "Infer allowlist prefixes from staged paths.",
-        },
     ],
     validateRaw: (raw) => {
         const msg = typeof raw.opts.message === "string" ? raw.opts.message.trim() : "";
@@ -76,6 +74,20 @@ export const guardCommitSpec = {
         if (Array.isArray(allow) && allow.some((s) => typeof s === "string" && s.trim() === "")) {
             throw usageError({ spec: guardCommitSpec, message: "Invalid value for --allow: empty." });
         }
+        const allowList = Array.isArray(allow)
+            ? allow
+            : typeof allow === "string"
+                ? [allow]
+                : [];
+        if (findRepoWideAllowPrefixes(allowList).length > 0) {
+            throw usageError({ spec: guardCommitSpec, message: repoWideAllowPrefixMessage("--allow") });
+        }
+        if (raw.opts["auto-allow"] === true) {
+            throw usageError({
+                spec: guardCommitSpec,
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
+        }
     },
     parse: (raw) => ({
         taskId: String(raw.args["task-id"]),
@@ -99,18 +111,12 @@ export const guardCommitSpec = {
 export function makeRunGuardCommitHandler(getCtx) {
     return async (ctx, p) => {
         const cmdCtx = await getCtx("guard commit");
-        let allow = p.allow;
-        if (p.autoAllow && allow.length === 0) {
-            const staged = await cmdCtx.git.statusStagedPaths();
-            const prefixes = suggestAllowPrefixes(staged);
-            if (prefixes.length === 0) {
-                throw new CliError({
-                    exitCode: 5,
-                    code: "E_GIT",
-                    message: "No staged files (git index empty)",
-                });
-            }
-            allow = prefixes;
+        if (p.autoAllow) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
         }
         return await cmdGuardCommit({
             ctx: cmdCtx,
@@ -118,7 +124,7 @@ export function makeRunGuardCommitHandler(getCtx) {
             rootOverride: ctx.rootOverride,
             taskId: p.taskId,
             message: p.message,
-            allow,
+            allow: p.allow,
             allowBase: p.allowBase,
             allowTasks: p.allowTasks,
             allowPolicy: p.allowPolicy,

package/dist/commands/guard/impl/allow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2CpB"}
+{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkDpB"}

package/dist/commands/guard/impl/allow.js

@@ -82,6 +82,13 @@ export async function stageAllowlist(opts) {
             message: "Provide at least one allowed prefix",
         });
     }
+    if (allow.includes(".")) {
+        throw new CliError({
+            exitCode: 2,
+            code: "E_USAGE",
+            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
+        });
+    }
     const denied = new Set();
     if (!opts.allowTasks)
         denied.add(opts.tasksPath);
@@ -98,7 +105,7 @@ export async function stageAllowlist(opts) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "No changes matched allowed prefixes (use --commit-auto-allow or update --commit-allow)",
+            message: "No changes matched allowed prefixes (update --commit-allow)",
         });
     }
     // `git add <pathspec>` is not reliable for staging deletes/renames across versions/configs.

package/dist/commands/guard/impl/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAOvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyDxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJlB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyDxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmJlB"}

package/dist/commands/guard/impl/commands.js

@@ -4,6 +4,7 @@ import { CliError } from "../../../shared/errors.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 import { loadTaskFromContext } from "../../shared/task-backend.js";
 import { execFileAsync, gitEnv } from "../../shared/git.js";
+import { ensureReconciledBeforeMutation } from "../../shared/reconcile-check.js";
 import { suggestAllowPrefixes } from "./allow.js";
 import { buildCloseCommitMessage, taskReadmePathForTask } from "./close-message.js";
 import { buildGitCommitEnv } from "./env.js";
@@ -111,7 +112,10 @@ export async function cmdGuardSuggestAllow(opts) {
 }
 export async function cmdGuardCommit(opts) {
     try {
-        await guardCommitCheck(opts);
+        const ctx = opts.ctx ??
+            (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
+        await ensureReconciledBeforeMutation({ ctx, command: "guard commit" });
+        await guardCommitCheck({ ...opts, ctx });
         if (!opts.quiet)
             process.stdout.write("OK\n");
         return 0;
@@ -124,9 +128,12 @@ export async function cmdGuardCommit(opts) {
 }
 export async function cmdCommit(opts) {
     try {
+        const ctx = opts.ctx ??
+            (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
         if (opts.close) {
-            const ctx = opts.ctx ??
-                (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
+            if (!opts.closeCheckOnly) {
+                await ensureReconciledBeforeMutation({ ctx, command: "commit" });
+            }
             // Make the close commit deterministic: start from a clean index unless --unstage-others is used.
             let staged = await ctx.git.statusStagedPaths();
             if (staged.length > 0 && opts.closeUnstageOthers) {
@@ -201,28 +208,21 @@ export async function cmdCommit(opts) {
             }
             return 0;
         }
-        let allow = opts.allow;
-        if (opts.autoAllow && allow.length === 0) {
-            const ctx = opts.ctx ??
-                (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
-            const staged = await ctx.git.statusStagedPaths();
-            const prefixes = suggestAllowPrefixes(staged);
-            if (prefixes.length === 0) {
-                throw new CliError({
-                    exitCode: 5,
-                    code: "E_GIT",
-                    message: "No staged files (git index empty)",
-                });
-            }
-            allow = prefixes;
+        if (opts.autoAllow) {
+            throw new CliError({
+                exitCode: 2,
+                code: "E_USAGE",
+                message: "--auto-allow is disabled; pass explicit --allow <path-prefix>.",
+            });
         }
+        await ensureReconciledBeforeMutation({ ctx, command: "commit" });
         await guardCommitCheck({
-            ctx: opts.ctx,
+            ctx,
             cwd: opts.cwd,
             rootOverride: opts.rootOverride,
             taskId: opts.taskId,
             message: opts.message,
-            allow,
+            allow: opts.allow,
             allowBase: opts.allowBase,
             allowTasks: opts.allowTasks,
             allowPolicy: opts.allowPolicy,
@@ -232,8 +232,6 @@ export async function cmdCommit(opts) {
             requireClean: opts.requireClean,
             quiet: opts.quiet,
         });
-        const ctx = opts.ctx ??
-            (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
         const env = buildGitCommitEnv({
             taskId: opts.taskId,
             allowTasks: opts.allowTasks,

package/dist/commands/guard/impl/comment-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAS/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+F/D"}
+{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyF/D"}

package/dist/commands/guard/impl/comment-commit.js

@@ -2,10 +2,9 @@ import { extractTaskSuffix } from "@agentplaneorg/core";
 import { invalidValueMessage, successMessage } from "../../../cli/output.js";
 import { CliError } from "../../../shared/errors.js";
 import { formatCommentBodyForCommit, normalizeCommentBodyForCommit, } from "../../../shared/comment-format.js";
-import { protectedPathKindForFile } from "../../../shared/protected-paths.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 import { buildGitCommitEnv } from "./env.js";
-import { stageAllowlist, suggestAllowPrefixes } from "./allow.js";
+import { stageAllowlist } from "./allow.js";
 import { guardCommitCheck } from "./policy.js";
 function deriveCommitMessageFromComment(opts) {
     const prefix = opts.emoji.trim();
@@ -49,27 +48,19 @@ function deriveCommitBodyFromComment(opts) {
 export async function commitFromComment(opts) {
     const ctx = opts.ctx ??
         (await loadCommandContext({ cwd: opts.cwd, rootOverride: opts.rootOverride ?? null }));
-    let allowPrefixes = opts.allow.map((prefix) => prefix.trim()).filter(Boolean);
-    if (opts.autoAllow && allowPrefixes.length === 0) {
-        const changed = await ctx.git.statusChangedPaths();
-        const tasksPath = opts.config.paths.tasks_path;
-        // Auto-allow is for ergonomic status commits. It must never silently
-        // broaden into policy/config/CI changes (those require explicit intent).
-        const eligible = changed.filter((filePath) => {
-            const kind = protectedPathKindForFile({ filePath, tasksPath });
-            if (!kind)
-                return true;
-            if (kind === "tasks")
-                return opts.allowTasks;
-            return false;
+    if (opts.autoAllow) {
+        throw new CliError({
+            exitCode: 2,
+            code: "E_USAGE",
+            message: "--commit-auto-allow is disabled; pass explicit --commit-allow <path-prefix>.",
         });
-        allowPrefixes = suggestAllowPrefixes(eligible);
     }
+    let allowPrefixes = opts.allow.map((prefix) => prefix.trim()).filter(Boolean);
     if (allowPrefixes.length === 0) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Provide at least one --commit-allow prefix or enable --commit-auto-allow",
+            message: "Provide at least one --commit-allow prefix",
         });
     }
     const staged = await stageAllowlist({

package/dist/commands/recipes/impl/commands/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../../../src/commands/recipes/impl/commands/install.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAM3E,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,GAAG,EAAE,OAAO,CAAC;CACd,GAAG,OAAO,CAAC,MAAM,CAAC,CAkMlB"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../../../src/commands/recipes/impl/commands/install.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAM3E,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,GAAG,EAAE,OAAO,CAAC;CACd,GAAG,OAAO,CAAC,MAAM,CAAC,CA6NlB"}