agentplane 0.3.5 → 0.3.6

package/dist/commands/task/verify-record.js

@@ -3,7 +3,7 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { ensureDocSections, setMarkdownSection } from "@agentplaneorg/core";
 import { mapBackendError, mapCoreError } from "../../cli/error-map.js";
-import { backendNotSupportedMessage } from "../../cli/output.js";
+import { backendNotSupportedMessage, successMessage } from "../../cli/output.js";
 import { CliError } from "../../shared/errors.js";
 import { ensureReconciledBeforeMutation } from "../shared/reconcile-check.js";
 import { loadCommandContext, loadTaskFromContext, } from "../shared/task-backend.js";
@@ -68,59 +68,113 @@ async function recordVerificationResult(opts) {
     const task = useStore
         ? await store.get(opts.taskId)
         : await loadTaskFromContext({ ctx, taskId: opts.taskId });
-    const existingDoc = useStore
-        ? String(task.doc ?? "")
-        : (typeof task.doc === "string" ? task.doc : "") || (await backend.getTaskDoc(task.id));
-    const baseDoc = ensureDocSections(existingDoc ?? "", config.tasks.doc.required_sections);
-    const verificationSection = extractDocSection(baseDoc, "Verification") ?? "";
-    const verifySteps = extractDocSection(baseDoc, "Verify Steps");
-    const verifyStepsHash = verifySteps
-        ? sha256Hex(verifySteps.replaceAll("\r\n", "\n").trim())
-        : null;
-    const docVersion = normalizeTaskDocVersion(task.doc_version);
-    const verifyStepsRef = [
-        `doc_version=${String(docVersion)}`,
-        `doc_updated_at=${String(task.doc_updated_at ?? "missing")}`,
-        `excerpt_hash=sha256:${verifyStepsHash ?? "missing"}`,
-    ].join(", ");
     const at = nowIso();
-    const entry = renderVerificationEntry({
-        at,
-        state: opts.state,
-        by: opts.by,
-        note: opts.note,
-        details: opts.details ?? null,
-        verifyStepsRef,
-    });
-    const nextVerification = appendBetweenMarkers(verificationSection, entry, docVersion);
-    const nextDoc = ensureDocSections(setMarkdownSection(baseDoc, "Verification", nextVerification), config.tasks.doc.required_sections);
-    const nextTask = {
-        ...task,
-        status: opts.state === "needs_rework" ? "DOING" : task.status,
-        commit: opts.state === "needs_rework" ? null : (task.commit ?? null),
-        doc: nextDoc,
-        doc_updated_by: opts.by,
-        events: appendTaskEvent(task, {
-            type: "verify",
+    if (useStore) {
+        await store.patch(opts.taskId, (current) => {
+            const existingDoc = String(current.doc ?? "");
+            const baseDoc = ensureDocSections(existingDoc, config.tasks.doc.required_sections);
+            const verificationSection = extractDocSection(baseDoc, "Verification") ?? "";
+            const verifySteps = extractDocSection(baseDoc, "Verify Steps");
+            const verifyStepsHash = verifySteps
+                ? sha256Hex(verifySteps.replaceAll("\r\n", "\n").trim())
+                : null;
+            const docVersion = normalizeTaskDocVersion(current.doc_version);
+            const verifyStepsRef = [
+                `doc_version=${String(docVersion)}`,
+                `doc_updated_at=${String(current.doc_updated_at ?? "missing")}`,
+                `excerpt_hash=sha256:${verifyStepsHash ?? "missing"}`,
+            ].join(", ");
+            const entry = renderVerificationEntry({
+                at,
+                state: opts.state,
+                by: opts.by,
+                note: opts.note,
+                details: opts.details ?? null,
+                verifyStepsRef,
+            });
+            const nextVerification = appendBetweenMarkers(verificationSection, entry, docVersion);
+            return {
+                task: {
+                    status: opts.state === "needs_rework" ? "DOING" : current.status,
+                    commit: opts.state === "needs_rework" ? null : (current.commit ?? null),
+                    verification: {
+                        state: opts.state,
+                        updated_at: at,
+                        updated_by: opts.by,
+                        note: opts.note,
+                    },
+                },
+                doc: {
+                    kind: "set-section",
+                    section: "Verification",
+                    text: nextVerification,
+                    requiredSections: config.tasks.doc.required_sections,
+                },
+                appendEvents: [
+                    {
+                        type: "verify",
+                        at,
+                        author: opts.by,
+                        state: opts.state,
+                        note: opts.note,
+                    },
+                ],
+                docMeta: { updatedBy: opts.by },
+            };
+        });
+    }
+    else {
+        const existingDoc = (typeof task.doc === "string" ? task.doc : "") || (await backend.getTaskDoc(task.id));
+        const baseDoc = ensureDocSections(existingDoc ?? "", config.tasks.doc.required_sections);
+        const verificationSection = extractDocSection(baseDoc, "Verification") ?? "";
+        const verifySteps = extractDocSection(baseDoc, "Verify Steps");
+        const verifyStepsHash = verifySteps
+            ? sha256Hex(verifySteps.replaceAll("\r\n", "\n").trim())
+            : null;
+        const docVersion = normalizeTaskDocVersion(task.doc_version);
+        const verifyStepsRef = [
+            `doc_version=${String(docVersion)}`,
+            `doc_updated_at=${String(task.doc_updated_at ?? "missing")}`,
+            `excerpt_hash=sha256:${verifyStepsHash ?? "missing"}`,
+        ].join(", ");
+        const entry = renderVerificationEntry({
             at,
-            author: opts.by,
             state: opts.state,
+            by: opts.by,
             note: opts.note,
-        }),
-        verification: {
-            state: opts.state,
-            updated_at: at,
-            updated_by: opts.by,
-            note: opts.note,
-        },
-    };
-    await (useStore ? store.update(opts.taskId, () => nextTask) : backend.writeTask(nextTask));
+            details: opts.details ?? null,
+            verifyStepsRef,
+        });
+        const nextVerification = appendBetweenMarkers(verificationSection, entry, docVersion);
+        const nextDoc = ensureDocSections(setMarkdownSection(baseDoc, "Verification", nextVerification), config.tasks.doc.required_sections);
+        await backend.writeTask({
+            ...task,
+            status: opts.state === "needs_rework" ? "DOING" : task.status,
+            commit: opts.state === "needs_rework" ? null : (task.commit ?? null),
+            doc: nextDoc,
+            doc_updated_by: opts.by,
+            events: appendTaskEvent(task, {
+                type: "verify",
+                at,
+                author: opts.by,
+                state: opts.state,
+                note: opts.note,
+            }),
+            verification: {
+                state: opts.state,
+                updated_at: at,
+                updated_by: opts.by,
+                note: opts.note,
+            },
+        });
+    }
     if (!opts.quiet) {
         const readmePath = path.join(resolved.gitRoot, config.paths.workflow_dir, task.id, "README.md");
-        process.stdout.write(`${readmePath}\n`);
+        const relReadmePath = path.relative(resolved.gitRoot, readmePath);
+        process.stdout.write(`${successMessage("verified", task.id, `state=${opts.state} readme=${relReadmePath}`)}\n`);
     }
 }
-export async function cmdTaskVerifyOk(opts) {
+async function resolveVerifyRecordInput(opts) {
     const by = String(opts.by ?? "").trim();
     const note = String(opts.note ?? "").trim();
     if (!by || !note) {
@@ -143,19 +197,23 @@ export async function cmdTaskVerifyOk(opts) {
             details = await readFile(path.resolve(opts.cwd, opts.file), "utf8");
         }
         catch (err) {
-            throw mapCoreError(err, { command: "task verify ok", filePath: opts.file });
+            throw mapCoreError(err, { command: opts.command, filePath: opts.file });
         }
     }
+    return { by, note, details };
+}
+async function executeVerifyRecordCommand(opts) {
+    const input = await resolveVerifyRecordInput(opts);
     try {
         await recordVerificationResult({
             ctx: opts.ctx,
             cwd: opts.cwd,
             rootOverride: opts.rootOverride,
             taskId: opts.taskId,
-            state: "ok",
-            by,
-            note,
-            details,
+            state: opts.state,
+            by: input.by,
+            note: input.note,
+            details: input.details,
             quiet: opts.quiet,
         });
         return 0;
@@ -163,98 +221,19 @@ export async function cmdTaskVerifyOk(opts) {
     catch (err) {
         if (err instanceof CliError)
             throw err;
-        throw mapBackendError(err, { command: "task verify ok", root: opts.rootOverride ?? null });
+        throw mapBackendError(err, { command: opts.command, root: opts.rootOverride ?? null });
     }
 }
+export async function cmdTaskVerifyOk(opts) {
+    return await executeVerifyRecordCommand({ ...opts, state: "ok", command: "task verify ok" });
+}
 export async function cmdTaskVerifyRework(opts) {
-    const by = String(opts.by ?? "").trim();
-    const note = String(opts.note ?? "").trim();
-    if (!by || !note) {
-        throw new CliError({
-            exitCode: 2,
-            code: "E_USAGE",
-            message: "Missing required inputs: --by and --note.",
-        });
-    }
-    if (typeof opts.details === "string" && typeof opts.file === "string") {
-        throw new CliError({
-            exitCode: 2,
-            code: "E_USAGE",
-            message: "Options --details and --file are mutually exclusive.",
-        });
-    }
-    let details = typeof opts.details === "string" ? opts.details : null;
-    if (typeof opts.file === "string") {
-        try {
-            details = await readFile(path.resolve(opts.cwd, opts.file), "utf8");
-        }
-        catch (err) {
-            throw mapCoreError(err, { command: "task verify rework", filePath: opts.file });
-        }
-    }
-    try {
-        await recordVerificationResult({
-            ctx: opts.ctx,
-            cwd: opts.cwd,
-            rootOverride: opts.rootOverride,
-            taskId: opts.taskId,
-            state: "needs_rework",
-            by,
-            note,
-            details,
-            quiet: opts.quiet,
-        });
-        return 0;
-    }
-    catch (err) {
-        if (err instanceof CliError)
-            throw err;
-        throw mapBackendError(err, { command: "task verify rework", root: opts.rootOverride ?? null });
-    }
+    return await executeVerifyRecordCommand({
+        ...opts,
+        state: "needs_rework",
+        command: "task verify rework",
+    });
 }
 export async function cmdVerifyParsed(opts) {
-    const by = String(opts.by ?? "").trim();
-    const note = String(opts.note ?? "").trim();
-    if (!by || !note) {
-        throw new CliError({
-            exitCode: 2,
-            code: "E_USAGE",
-            message: "Missing required inputs: --by and --note.",
-        });
-    }
-    if (typeof opts.details === "string" && typeof opts.file === "string") {
-        throw new CliError({
-            exitCode: 2,
-            code: "E_USAGE",
-            message: "Options --details and --file are mutually exclusive.",
-        });
-    }
-    let details = typeof opts.details === "string" ? opts.details : null;
-    if (typeof opts.file === "string") {
-        try {
-            details = await readFile(path.resolve(opts.cwd, opts.file), "utf8");
-        }
-        catch (err) {
-            throw mapCoreError(err, { command: "verify", filePath: opts.file });
-        }
-    }
-    try {
-        await recordVerificationResult({
-            ctx: opts.ctx,
-            cwd: opts.cwd,
-            rootOverride: opts.rootOverride,
-            taskId: opts.taskId,
-            state: opts.state,
-            by,
-            note,
-            details,
-            quiet: opts.quiet,
-        });
-        return 0;
-    }
-    catch (err) {
-        if (err instanceof CliError)
-            throw err;
-        throw mapBackendError(err, { command: "verify", root: opts.rootOverride ?? null });
-    }
+    return await executeVerifyRecordCommand({ ...opts, command: "verify" });
 }

package/dist/commands/task/verify-rework.command.d.ts

@@ -1,12 +1,8 @@
 import type { CommandCtx, CommandSpec } from "../../cli/spec/spec.js";
 import type { CommandContext } from "../shared/task-backend.js";
-export type TaskVerifyReworkParsed = {
+import { type VerifyCommonParsed } from "./verify-command-shared.js";
+export type TaskVerifyReworkParsed = VerifyCommonParsed & {
     taskId: string;
-    by: string;
-    note: string;
-    details?: string;
-    file?: string;
-    quiet: boolean;
 };
 export declare const taskVerifyReworkSpec: CommandSpec<TaskVerifyReworkParsed>;
 export declare function makeRunTaskVerifyReworkHandler(getCtx: (cmd: string) => Promise<CommandContext>): (ctx: CommandCtx, p: TaskVerifyReworkParsed) => Promise<number>;

package/dist/commands/task/verify-rework.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-rework.command.d.ts","sourceRoot":"","sources":["../../../src/commands/task/verify-rework.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,sBAAsB,CAkEpE,CAAC;AAEF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC/E,KAAK,UAAU,EAAE,GAAG,sBAAsB,KAAG,OAAO,CAAC,MAAM,CAAC,CAa3E"}
+{"version":3,"file":"verify-rework.command.d.ts","sourceRoot":"","sources":["../../../src/commands/task/verify-rework.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGhE,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG;IACxD,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,sBAAsB,CAwBpE,CAAC;AAEF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC/E,KAAK,UAAU,EAAE,GAAG,sBAAsB,KAAG,OAAO,CAAC,MAAM,CAAC,CAa3E"}

package/dist/commands/task/verify-rework.command.js

@@ -1,38 +1,11 @@
-import { usageError } from "../../cli/spec/errors.js";
 import { cmdTaskVerifyRework } from "./verify-record.js";
+import { parseVerifyCommonOptions, validateVerifyDetailsFileExclusive, validateVerifyNonEmptyInput, verifyCommonOptions, } from "./verify-command-shared.js";
 export const taskVerifyReworkSpec = {
     id: ["task", "verify", "rework"],
     group: "Task",
     summary: "Record verification as needs rework (resets commit, sets status to DOING, updates Verification).",
     args: [{ name: "task-id", required: true, valueHint: "<task-id>" }],
-    options: [
-        { kind: "string", name: "by", valueHint: "<id>", required: true, description: "Verifier id." },
-        {
-            kind: "string",
-            name: "note",
-            valueHint: "<text>",
-            required: true,
-            description: "Short verification note.",
-        },
-        {
-            kind: "string",
-            name: "details",
-            valueHint: "<text>",
-            description: "Optional details text (mutually exclusive with --file).",
-        },
-        {
-            kind: "string",
-            name: "file",
-            valueHint: "<path>",
-            description: "Optional details file path (mutually exclusive with --details).",
-        },
-        {
-            kind: "boolean",
-            name: "quiet",
-            default: false,
-            description: "Suppress normal output (still prints errors).",
-        },
-    ],
+    options: verifyCommonOptions,
     examples: [
         {
             cmd: 'agentplane task verify rework 202602030608-F1Q8AB --by REVIEWER --note "Needs changes"',
@@ -40,30 +13,15 @@ export const taskVerifyReworkSpec = {
         },
     ],
     validateRaw: (raw) => {
-        const details = raw.opts.details;
-        const file = raw.opts.file;
-        if (typeof details === "string" && typeof file === "string") {
-            throw usageError({
-                spec: taskVerifyReworkSpec,
-                message: "Provide at most one of --details or --file.",
-            });
-        }
-        const by = raw.opts.by;
-        if (typeof by === "string" && by.trim().length === 0) {
-            throw usageError({ spec: taskVerifyReworkSpec, message: "Invalid value for --by: empty." });
-        }
-        const note = raw.opts.note;
-        if (typeof note === "string" && note.trim().length === 0) {
-            throw usageError({ spec: taskVerifyReworkSpec, message: "Invalid value for --note: empty." });
-        }
+        validateVerifyDetailsFileExclusive(raw, taskVerifyReworkSpec, {
+            message: "Provide at most one of --details or --file.",
+        });
+        validateVerifyNonEmptyInput(raw, taskVerifyReworkSpec, "by");
+        validateVerifyNonEmptyInput(raw, taskVerifyReworkSpec, "note");
     },
     parse: (raw) => ({
         taskId: String(raw.args["task-id"]),
-        by: String(raw.opts.by),
-        note: String(raw.opts.note),
-        details: typeof raw.opts.details === "string" ? raw.opts.details : undefined,
-        file: typeof raw.opts.file === "string" ? raw.opts.file : undefined,
-        quiet: raw.opts.quiet === true,
+        ...parseVerifyCommonOptions(raw),
     }),
 };
 export function makeRunTaskVerifyReworkHandler(getCtx) {

package/dist/commands/verify.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.spec.d.ts","sourceRoot":"","sources":["../../src/commands/verify.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,KAAK,WAAW,GAAG,IAAI,GAAG,cAAc,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CA8FhD,CAAC"}
+{"version":3,"file":"verify.spec.d.ts","sourceRoot":"","sources":["../../src/commands/verify.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,KAAK,WAAW,GAAG,IAAI,GAAG,cAAc,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAoFhD,CAAC"}

package/dist/commands/verify.spec.js

@@ -1,4 +1,5 @@
 import { usageError } from "../cli/spec/errors.js";
+import { parseVerifyCommonOptions, validateVerifyDetailsFileExclusive, } from "./task/verify-command-shared.js";
 export const verifySpec = {
     id: ["verify"],
     group: "Lifecycle",
@@ -72,13 +73,7 @@ export const verifySpec = {
                 message: "Exactly one of --ok or --rework must be provided.",
             });
         }
-        if (typeof raw.opts.details === "string" && typeof raw.opts.file === "string") {
-            throw usageError({
-                spec: verifySpec,
-                command: "verify",
-                message: "Options --details and --file are mutually exclusive.",
-            });
-        }
+        validateVerifyDetailsFileExclusive(raw, verifySpec, { command: "verify" });
     },
     parse: (raw) => {
         const ok = raw.opts.ok === true;
@@ -86,11 +81,7 @@ export const verifySpec = {
         return {
             taskId: typeof raw.args["task-id"] === "string" ? raw.args["task-id"] : "",
             state,
-            by: raw.opts.by,
-            note: raw.opts.note,
-            details: raw.opts.details,
-            file: raw.opts.file,
-            quiet: raw.opts.quiet === true,
+            ...parseVerifyCommonOptions(raw),
         };
     },
 };

package/dist/policy/rules/allowlist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../../src/policy/rules/allowlist.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CA0C9D"}
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../../src/policy/rules/allowlist.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/D,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAmD9D"}

package/dist/policy/rules/allowlist.js

@@ -1,12 +1,22 @@
 import { gitPathIsUnderPrefix, normalizeGitPathPrefix } from "../../shared/git-path.js";
+import { taskArtifactPrefixes } from "../../shared/protected-paths.js";
 import { gitError, okResult } from "../result.js";
 export function allowlistRule(ctx) {
     const allowRaw = ctx.allow?.prefixes ?? [];
     const staged = ctx.git.stagedPaths ?? [];
+    const allow = allowRaw.map((p) => normalizeGitPathPrefix(p));
+    const taskAllow = ctx.allow?.allowTasks === true
+        ? taskArtifactPrefixes({
+            tasksPath: ctx.config.paths.tasks_path,
+            workflowDir: ctx.config.paths.workflow_dir,
+            taskId: ctx.taskId,
+        })
+        : [];
+    const effectiveAllow = [...new Set([...allow, ...taskAllow])];
     if (staged.length === 0) {
         return { ok: false, errors: [gitError("No staged files (git index empty)")], warnings: [] };
     }
-    if (allowRaw.length === 0) {
+    if (effectiveAllow.length === 0) {
         const message = ctx.action === "guard_commit" || ctx.action === "commit"
             ? "Provide at least one --allow <path> prefix"
             : "Provide at least one allowlist prefix";
@@ -16,8 +26,7 @@ export function allowlistRule(ctx) {
             warnings: [],
         };
     }
-    const allow = allowRaw.map((p) => normalizeGitPathPrefix(p));
-    if (allow.includes(".")) {
+    if (effectiveAllow.includes(".")) {
         return {
             ok: false,
             errors: [
@@ -28,7 +37,7 @@ export function allowlistRule(ctx) {
     }
     const errors = [];
     for (const filePath of staged) {
-        if (!allow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {
+        if (!effectiveAllow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {
             errors.push(`Staged file is outside allowlist: ${filePath}`);
         }
     }

package/dist/policy/rules/protected-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protected-paths.d.ts","sourceRoot":"","sources":["../../../src/policy/rules/protected-paths.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAgB,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAc7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAgDnE"}
+{"version":3,"file":"protected-paths.d.ts","sourceRoot":"","sources":["../../../src/policy/rules/protected-paths.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAgB,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAc7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAqDnE"}

package/dist/policy/rules/protected-paths.js

@@ -18,7 +18,12 @@ export function protectedPathsRule(ctx) {
     const allowCI = ctx.allow?.allowCI === true;
     const errors = [];
     for (const filePath of staged) {
-        const kind = protectedPathKindForFile({ filePath, tasksPath });
+        const kind = protectedPathKindForFile({
+            filePath,
+            tasksPath,
+            workflowDir: ctx.config.paths.workflow_dir,
+            taskId: ctx.taskId,
+        });
         if (!kind)
             continue;
         if (kind === "tasks" && !allowTasks) {

package/dist/shared/agent-emoji.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-emoji.d.ts","sourceRoot":"","sources":["../../src/shared/agent-emoji.ts"],"names":[],"mappings":"AAmCA,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlB"}
+{"version":3,"file":"agent-emoji.d.ts","sourceRoot":"","sources":["../../src/shared/agent-emoji.ts"],"names":[],"mappings":"AAkCA,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlB"}

package/dist/shared/protected-paths.d.ts

@@ -4,9 +4,16 @@ export type ProtectedPathOverride = {
     cliFlag: string;
     envVar: string;
 };
+export declare function taskArtifactPrefixes(opts: {
+    tasksPath: string;
+    workflowDir?: string;
+    taskId?: string;
+}): string[];
 export declare function getProtectedPathOverride(kind: ProtectedPathKind): ProtectedPathOverride;
 export declare function protectedPathKindForFile(opts: {
     filePath: string;
     tasksPath: string;
+    workflowDir?: string;
+    taskId?: string;
 }): ProtectedPathKind | null;
 //# sourceMappingURL=protected-paths.d.ts.map

package/dist/shared/protected-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protected-paths.d.ts","sourceRoot":"","sources":["../../src/shared/protected-paths.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;AAE/E,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAQF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAkBvF;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,iBAAiB,GAAG,IAAI,CA8B3B"}
+{"version":3,"file":"protected-paths.d.ts","sourceRoot":"","sources":["../../src/shared/protected-paths.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;AAE/E,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAYF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,EAAE,CAOX;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAkBvF;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,iBAAiB,GAAG,IAAI,CAsC3B"}

package/dist/shared/protected-paths.js

@@ -1,9 +1,20 @@
-function pathIsUnder(candidate, prefix) {
-    if (prefix === "." || prefix === "")
-        return true;
-    if (candidate === prefix)
-        return true;
-    return candidate.startsWith(`${prefix}/`);
+import { gitPathIsUnderPrefix, normalizeGitPathPrefix } from "./git-path.js";
+function taskWorkflowPrefix(workflowDir, taskId) {
+    const dir = normalizeGitPathPrefix(workflowDir ?? "");
+    const id = (taskId ?? "").trim();
+    if (!dir || !id)
+        return null;
+    return normalizeGitPathPrefix(`${dir}/${id}`);
+}
+export function taskArtifactPrefixes(opts) {
+    const out = new Set();
+    const tasksPath = normalizeGitPathPrefix(opts.tasksPath);
+    if (tasksPath)
+        out.add(tasksPath);
+    const workflowPrefix = taskWorkflowPrefix(opts.workflowDir, opts.taskId);
+    if (workflowPrefix)
+        out.add(workflowPrefix);
+    return [...out].toSorted((a, b) => a.localeCompare(b));
 }
 export function getProtectedPathOverride(kind) {
     switch (kind) {
@@ -28,24 +39,29 @@ export function protectedPathKindForFile(opts) {
     const p = opts.filePath;
     if (!p)
         return null;
-    if (p === opts.tasksPath)
+    if (taskArtifactPrefixes({
+        tasksPath: opts.tasksPath,
+        workflowDir: opts.workflowDir,
+        taskId: opts.taskId,
+    }).some((prefix) => gitPathIsUnderPrefix(p, prefix))) {
         return "tasks";
+    }
     // "Rules of the game": authoring/agent policies and registry.
     if (p === "AGENTS.md" ||
         p === "CLAUDE.md" ||
         p === "packages/agentplane/assets/AGENTS.md" ||
-        pathIsUnder(p, ".agentplane/agents")) {
+        gitPathIsUnderPrefix(p, ".agentplane/agents")) {
         return "policy";
     }
     // Framework config and task backend config determine enforcement behavior.
-    if (p === ".agentplane/config.json" || pathIsUnder(p, ".agentplane/backends")) {
+    if (p === ".agentplane/config.json" || gitPathIsUnderPrefix(p, ".agentplane/backends")) {
         return "config";
     }
     // Local hook orchestrator is a quality gate for commits.
     if (p === "lefthook.yml")
         return "hooks";
     // CI workflows are "remote hooks" for quality gates.
-    if (pathIsUnder(p, ".github/workflows") || pathIsUnder(p, ".github/actions")) {
+    if (gitPathIsUnderPrefix(p, ".github/workflows") || gitPathIsUnderPrefix(p, ".github/actions")) {
         return "ci";
     }
     return null;

package/dist/shared/repo-cli-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-cli-version.d.ts","sourceRoot":"","sources":["../../src/shared/repo-cli-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,WAAW,GACX,qBAAqB,GACrB,2BAA2B,CAAC;AAEhC,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAKjF;AAqBD,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,iBAAiB,GACzB,yBAAyB,CAuC3B"}
+{"version":3,"file":"repo-cli-version.d.ts","sourceRoot":"","sources":["../../src/shared/repo-cli-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,WAAW,GACX,qBAAqB,GACrB,2BAA2B,CAAC;AAEhC,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAKjF;AA8BD,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,iBAAiB,GACzB,yBAAyB,CAuC3B"}

package/dist/shared/repo-cli-version.js

@@ -9,16 +9,22 @@ export function getRepoExpectedCliVersion(config) {
 function buildRecovery(runtime, expectedVersion) {
     switch (runtime.mode) {
         case "global-installed": {
-            return `Run: npm i -g agentplane@${expectedVersion}`;
+            return `Run: npm i -g agentplane@${expectedVersion}. Then verify: agentplane runtime explain`;
         }
         case "global-in-framework":
         case "global-forced-in-framework": {
-            return "Run: scripts/reinstall-global-agentplane.sh";
+            const prefix = runtime.mode === "global-forced-in-framework"
+                ? "Unset AGENTPLANE_USE_GLOBAL_IN_FRAMEWORK=1 if forced global mode is not intentional. "
+                : "";
+            return (`${prefix}Run: scripts/reinstall-global-agentplane.sh. ` +
+                "Fallback: node packages/agentplane/bin/agentplane.js runtime explain. " +
+                "Then verify: agentplane runtime explain");
         }
         case "repo-local":
         case "repo-local-handoff": {
             return (`Sync this framework checkout to agentplane ${expectedVersion} or lower ` +
-                "framework.cli.expected_version if the repository intentionally targets an older CLI.");
+                "framework.cli.expected_version if the repository intentionally targets an older CLI. " +
+                "Then verify: agentplane runtime explain");
         }
     }
 }