agentplane 0.3.5 → 0.3.6

package/dist/cli/run-cli.test-helpers.js

@@ -6,7 +6,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { gzipSync } from "node:zlib";
-import { afterAll, afterEach, beforeAll } from "vitest";
+import { afterAll, afterEach, beforeAll, beforeEach, vi } from "vitest";
 import { defaultConfig } from "@agentplaneorg/core";
 import { runCli } from "./run-cli.js";
 const execFileAsync = promisify(execFile);
@@ -98,6 +98,17 @@ export function registerAgentplaneHome() {
         }));
     });
 }
+export function installRunCliIntegrationHarness() {
+    registerAgentplaneHome();
+    let restoreStdIO = null;
+    beforeEach(() => {
+        restoreStdIO = silenceStdIO();
+    });
+    afterEach(() => {
+        restoreStdIO?.();
+        restoreStdIO = null;
+    });
+}
 export function getAgentplaneHome() {
     return agentplaneHome;
 }
@@ -150,6 +161,26 @@ export function silenceStdIO() {
         }
     };
 }
+export function stubTaskBackend(overrides = {}) {
+    return {
+        id: "local",
+        capabilities: {
+            canonical_source: "local",
+            projection: "canonical",
+            reads_from_projection_by_default: false,
+            writes_task_readmes: true,
+            may_access_network_on_read: false,
+            may_access_network_on_write: false,
+            supports_projection_refresh: false,
+            supports_push_sync: false,
+            supports_snapshot_export: false,
+        },
+        listTasks: vi.fn().mockResolvedValue([]),
+        getTask: vi.fn().mockResolvedValue(null),
+        writeTask: vi.fn().mockImplementation(() => Promise.resolve()),
+        ...overrides,
+    };
+}
 export async function runCliSilent(args) {
     const io = captureStdIO();
     try {
@@ -215,11 +246,60 @@ export async function createRecipeArchive(opts) {
         name: opts?.name ?? "Viewer",
         summary: opts?.summary ?? "Preview task artifacts",
         description: opts?.description ?? "Provides a local viewer for task artifacts.",
-        agents: [{ id: "RECIPE_AGENT", summary: "Recipe agent", file: "agents/recipe.json" }],
+        compatibility: {
+            min_agentplane_version: "0.3.5",
+            manifest_api_version: "1",
+            scenario_api_version: "1",
+            runtime_api_version: "1",
+            platforms: ["darwin", "linux"],
+            repo_types: ["generic"],
+        },
+        skills: [
+            {
+                id: "RECIPE_SKILL",
+                summary: "Recipe analysis skill",
+                kind: "agent-skill",
+                file: "skills/analysis.json",
+            },
+        ],
+        agents: [
+            {
+                id: "RECIPE_AGENT",
+                display_name: "Recipe Agent",
+                role: "executor",
+                summary: "Recipe agent",
+                skills: ["RECIPE_SKILL"],
+                tools: ["RECIPE_TOOL"],
+                file: "agents/recipe.json",
+            },
+        ],
         tools: [
             { id: "RECIPE_TOOL", summary: "Recipe tool", runtime: "node", entrypoint: "tools/run.js" },
         ],
-        scenarios: [{ id: "RECIPE_SCENARIO", summary: "Recipe scenario" }],
+        scenarios: [
+            {
+                id: "RECIPE_SCENARIO",
+                name: "Recipe Scenario",
+                summary: "Recipe scenario",
+                use_when: ["Task artifacts need local preview"],
+                required_inputs: ["task_id"],
+                outputs: ["report"],
+                permissions: ["filesystem-write"],
+                artifacts: ["artifact.txt"],
+                agents_involved: ["RECIPE_AGENT"],
+                skills_used: ["RECIPE_SKILL"],
+                tools_used: ["RECIPE_TOOL"],
+                run_profile: {
+                    mode: "analysis",
+                    sandbox: "workspace-write",
+                    network: false,
+                    requires_human_approval: false,
+                    writes_artifacts_to: ["logs/", "reports/"],
+                    expected_exit_contract: "report",
+                },
+                file: "scenarios/recipe-scenario.json",
+            },
+        ],
     };
     if (normalizedTags) {
         manifest.tags = normalizedTags;
@@ -232,6 +312,13 @@ export async function createRecipeArchive(opts) {
         role: "Recipe agent",
         description: "Example agent installed from a recipe.",
     }, null, 2), "utf8");
+    const skillsDir = path.join(recipeDir, "skills");
+    await mkdir(skillsDir, { recursive: true });
+    await writeFile(path.join(skillsDir, "analysis.json"), JSON.stringify({
+        id: "RECIPE_SKILL",
+        summary: "Recipe analysis skill",
+        kind: "agent-skill",
+    }, null, 2), "utf8");
     const toolsDir = path.join(recipeDir, "tools");
     await mkdir(toolsDir, { recursive: true });
     await writeFile(path.join(toolsDir, "run.js"), [
@@ -302,22 +389,67 @@ export async function createUnsafeRecipeArchive(opts) {
         name: "Unsafe",
         summary: "Unsafe recipe",
         description: "Used for archive validation tests.",
-        agents: [{ id: "RECIPE_AGENT", summary: "Recipe agent", file: "agents/recipe.json" }],
+        skills: [
+            {
+                id: "RECIPE_SKILL",
+                summary: "Recipe skill",
+                kind: "agent-skill",
+                file: "skills/recipe.json",
+            },
+        ],
+        agents: [
+            {
+                id: "RECIPE_AGENT",
+                display_name: "Recipe Agent",
+                role: "executor",
+                summary: "Recipe agent",
+                skills: ["RECIPE_SKILL"],
+                tools: ["RECIPE_TOOL"],
+                file: "agents/recipe.json",
+            },
+        ],
         tools: [
             { id: "RECIPE_TOOL", summary: "Recipe tool", runtime: "bash", entrypoint: "tools/run.sh" },
         ],
-        scenarios: [{ id: "RECIPE_SCENARIO", summary: "Recipe scenario" }],
+        scenarios: [
+            {
+                id: "RECIPE_SCENARIO",
+                name: "Recipe Scenario",
+                summary: "Recipe scenario",
+                use_when: ["Unsafe validation fixture"],
+                required_inputs: [],
+                outputs: [],
+                permissions: [],
+                artifacts: [],
+                agents_involved: ["RECIPE_AGENT"],
+                skills_used: ["RECIPE_SKILL"],
+                tools_used: ["RECIPE_TOOL"],
+                run_profile: { mode: "analysis" },
+                file: "scenarios/recipe-scenario.json",
+            },
+        ],
     };
     await writeFile(path.join(recipeDir, "manifest.json"), JSON.stringify(manifest, null, 2), "utf8");
     const agentsDir = path.join(recipeDir, "agents");
     await mkdir(agentsDir, { recursive: true });
     await writeFile(path.join(agentsDir, "recipe.json"), JSON.stringify({ id: "RECIPE_AGENT", role: "Recipe agent" }, null, 2), "utf8");
+    const skillsDir = path.join(recipeDir, "skills");
+    await mkdir(skillsDir, { recursive: true });
+    await writeFile(path.join(skillsDir, "recipe.json"), JSON.stringify({ id: "RECIPE_SKILL" }), "utf8");
     const toolsDir = path.join(recipeDir, "tools");
     await mkdir(toolsDir, { recursive: true });
     await writeFile(path.join(toolsDir, "run.sh"), "#!/usr/bin/env bash\n", "utf8");
     const scenariosDir = path.join(recipeDir, "scenarios");
     await mkdir(scenariosDir, { recursive: true });
-    await writeFile(path.join(scenariosDir, "recipe-scenario.json"), JSON.stringify({ schema_version: "1", id: "RECIPE_SCENARIO", summary: "Recipe scenario" }, null, 2), "utf8");
+    await writeFile(path.join(scenariosDir, "recipe-scenario.json"), JSON.stringify({
+        schema_version: "1",
+        id: "RECIPE_SCENARIO",
+        summary: "Recipe scenario",
+        goal: "Exercise unsafe archive validation.",
+        inputs: [],
+        outputs: [],
+        steps: [{ tool: "RECIPE_TOOL" }],
+    }, null, 2), "utf8");
     const entryPath = opts.entryPath ?? "../evil.txt";
     await writeFile(path.join(baseDir, "evil.txt"), "evil", "utf8");
     const archivePath = opts.format === "zip" ? path.join(baseDir, "unsafe.zip") : path.join(baseDir, "unsafe.tar.gz");

package/dist/commands/commit.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.spec.d.ts","sourceRoot":"","sources":["../../src/commands/commit.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CA8JhD,CAAC"}
+{"version":3,"file":"commit.spec.d.ts","sourceRoot":"","sources":["../../src/commands/commit.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CA+JhD,CAAC"}

package/dist/commands/commit.spec.js

@@ -3,7 +3,7 @@ import { findRepoWideAllowPrefixes, repoWideAllowPrefixMessage, } from "../share
 export const commitSpec = {
     id: ["commit"],
     group: "Guard",
-    summary: "Create a git commit after validating policy and allowlist against staged changes.",
+    summary: "Create a git commit after validating policy and allowlist; if the index is empty, stage matching allowlist paths first.",
     args: [{ name: "task-id", required: true, valueHint: "<task-id>" }],
     options: [
         {
@@ -49,7 +49,7 @@ export const commitSpec = {
             kind: "boolean",
             name: "allow-tasks",
             default: false,
-            description: "Allow task workflow artifacts (tasks/ and .agentplane/tasks/).",
+            description: "Allow the tasks export snapshot plus artifacts under the active task subtree.",
         },
         {
             kind: "boolean",

package/dist/commands/doctor/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAyB5D,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,MAAM,EAAE,CA+BxF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAM1E"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAsB5D,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,MAAM,EAAE,CA+BxF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAM1E"}

package/dist/commands/doctor/runtime.js

@@ -10,10 +10,7 @@ function renderCliVersionFacts(expectation) {
             ...(expectation.recovery ? [`[WARN] Recovery: ${expectation.recovery}`] : []),
         ];
     }
-    return [
-        `[INFO] Repository expected agentplane CLI: ${expectation.expectedVersion}`,
-        ...(expectation.summary ? [`[INFO] ${expectation.summary}`] : []),
-    ];
+    return [];
 }
 export function checkRuntimeSourceFacts(cwd, config) {
     const report = resolveRuntimeSourceInfo({ cwd, entryModuleUrl: import.meta.url });
@@ -25,9 +22,9 @@ export function checkRuntimeSourceFacts(cwd, config) {
     }
     const warning = report.mode === "global-in-framework"
         ? "[WARN] Framework checkout detected but the active runtime is still a global installed binary. " +
-            "Update or reinstall agentplane to pick up repo-local handoff, or run the repo-local binary directly."
+            "Run scripts/reinstall-global-agentplane.sh to refresh the wrapper, or run the repo-local binary directly."
         : report.mode === "global-forced-in-framework"
-            ? "[WARN] Framework checkout is forcing the global installed binary via AGENTPLANE_USE_GLOBAL_IN_FRAMEWORK=1."
+            ? "[WARN] Framework checkout is forcing the global installed binary via AGENTPLANE_USE_GLOBAL_IN_FRAMEWORK=1. Unset it unless that override is intentional."
             : null;
     return [
         ...(warning ? [warning] : []),

package/dist/commands/guard/commit.command.js

@@ -34,7 +34,7 @@ export const guardCommitSpec = {
             kind: "boolean",
             name: "allow-tasks",
             default: false,
-            description: "Allow task workflow artifacts (tasks/ and .agentplane/tasks/).",
+            description: "Allow the tasks export snapshot plus artifacts under the active task subtree.",
         },
         {
             kind: "boolean",

package/dist/commands/guard/impl/allow.d.ts

@@ -14,5 +14,10 @@ export declare function stageAllowlist(opts: {
     allow: string[];
     allowTasks: boolean;
     tasksPath: string;
+    workflowDir?: string;
+    taskId?: string;
+    allowTaskOnly?: boolean;
+    emptyAllowMessage?: string;
+    noMatchMessage?: string;
 }): Promise<string[]>;
 //# sourceMappingURL=allow.d.ts.map

package/dist/commands/guard/impl/allow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkDpB"}
+{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAuDpB"}

package/dist/commands/guard/impl/allow.js

@@ -2,6 +2,7 @@ import { resolveProject } from "@agentplaneorg/core";
 import { exitCodeForError } from "../../../cli/exit-codes.js";
 import { gitPathIsUnderPrefix, normalizeGitPathPrefix } from "../../../shared/git-path.js";
 import { CliError } from "../../../shared/errors.js";
+import { taskArtifactPrefixes } from "../../../shared/protected-paths.js";
 import { GitContext } from "../../shared/git-context.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 function normalizeAllowPrefixes(prefixes) {
@@ -75,28 +76,32 @@ export async function stageAllowlist(opts) {
         });
     }
     const allow = normalizeAllowPrefixes(opts.allow);
-    if (allow.length === 0) {
+    if (allow.includes(".")) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Provide at least one allowed prefix",
+            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
         });
     }
-    if (allow.includes(".")) {
+    const taskAllow = taskArtifactPrefixes({
+        tasksPath: opts.tasksPath,
+        workflowDir: opts.workflowDir,
+        taskId: opts.taskId,
+    });
+    const effectiveAllow = normalizeAllowPrefixes(opts.allowTasks ? [...allow, ...taskAllow] : allow);
+    if (effectiveAllow.length === 0 || (allow.length === 0 && opts.allowTaskOnly !== true)) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
+            message: opts.emptyAllowMessage ?? "Provide at least one allowed prefix",
         });
     }
-    const denied = new Set();
-    if (!opts.allowTasks)
-        denied.add(opts.tasksPath);
+    const denied = opts.allowTasks ? [] : taskAllow;
     const staged = [];
     for (const filePath of changed) {
-        if (denied.has(filePath))
+        if (denied.some((prefix) => gitPathIsUnderPrefix(filePath, prefix)))
             continue;
-        if (allow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {
+        if (effectiveAllow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {
             staged.push(filePath);
         }
     }
@@ -105,7 +110,7 @@ export async function stageAllowlist(opts) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "No changes matched allowed prefixes (update --commit-allow)",
+            message: opts.noMatchMessage ?? "No changes matched allowed prefixes (update --commit-allow)",
         });
     }
     // `git add <pathspec>` is not reliable for staging deletes/renames across versions/configs.

package/dist/commands/guard/impl/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuExE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgKlB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyLxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmMlB"}

package/dist/commands/guard/impl/commands.js

@@ -1,15 +1,30 @@
 import { mapCoreError } from "../../../cli/error-map.js";
-import { successMessage } from "../../../cli/output.js";
+import { infoMessage, successMessage } from "../../../cli/output.js";
+import { stripAnsi } from "../../../cli/shared/ansi.js";
 import { withDiagnosticContext } from "../../../shared/diagnostics.js";
 import { CliError } from "../../../shared/errors.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 import { loadTaskFromContext } from "../../shared/task-backend.js";
 import { execFileAsync, gitEnv } from "../../shared/git.js";
 import { ensureReconciledBeforeMutation } from "../../shared/reconcile-check.js";
-import { suggestAllowPrefixes } from "./allow.js";
+import { stageAllowlist, suggestAllowPrefixes } from "./allow.js";
 import { buildCloseCommitMessage, taskReadmePathForTask } from "./close-message.js";
 import { buildGitCommitEnv } from "./env.js";
 import { guardCommitCheck } from "./policy.js";
+const COMMIT_FAILURE_SIGNAL_PATTERNS = [
+    /Code style issues found/i,
+    /Run Prettier with --write/i,
+    /\bESLint\b/i,
+    /\b[0-9]+\s+problems?\b/i,
+    /\berror\b/i,
+    /\bfailed\b/i,
+    /✖/,
+];
+const FORMATTER_SIGNAL_PATTERNS = [
+    /Code style issues found/i,
+    /Run Prettier with --write/i,
+];
+const ESLINT_SIGNAL_PATTERNS = [/\bESLint\b/i, /\b[0-9]+\s+problems?\b/i];
 function readText(value) {
     if (typeof value === "string")
         return value;
@@ -21,16 +36,103 @@ function summarizeOutput(raw) {
     const lines = raw
         .replaceAll("\r\n", "\n")
         .split("\n")
-        .map((line) => line.trimEnd())
+        .map((line) => stripAnsi(line).trimEnd())
         .filter((line) => line.trim().length > 0)
         .map((line) => (line.length > 180 ? `${line.slice(0, 180)} [truncated]` : line));
     if (lines.length <= 12)
         return lines;
-    const head = lines.slice(0, 6);
-    const tail = lines.slice(-6);
-    return [...head, `[${lines.length - 12} lines omitted]`, ...tail];
+    const selected = new Set();
+    for (let index = 0; index < Math.min(6, lines.length); index += 1) {
+        selected.add(index);
+    }
+    for (let index = Math.max(lines.length - 6, 0); index < lines.length; index += 1) {
+        selected.add(index);
+    }
+    for (const [index, line] of lines.entries()) {
+        if (selected.has(index))
+            continue;
+        if (COMMIT_FAILURE_SIGNAL_PATTERNS.some((pattern) => pattern.test(line))) {
+            selected.add(index);
+        }
+    }
+    const ordered = [...selected].toSorted((a, b) => a - b);
+    const summary = [];
+    let previous = -1;
+    for (const index of ordered) {
+        if (previous >= 0 && index - previous > 1) {
+            summary.push(`[${index - previous - 1} lines omitted]`);
+        }
+        summary.push(lines[index] ?? "");
+        previous = index;
+    }
+    return summary;
+}
+function detectCommitFailureSignal(output) {
+    if (FORMATTER_SIGNAL_PATTERNS.some((pattern) => pattern.test(output))) {
+        return "formatter";
+    }
+    if (ESLINT_SIGNAL_PATTERNS.some((pattern) => pattern.test(output))) {
+        return "eslint";
+    }
+    return null;
+}
+function commitFailureDiagnostic(phase, output) {
+    const signal = detectCommitFailureSignal(output);
+    if (signal === "formatter") {
+        return {
+            state: phase === "close_commit"
+                ? "git rejected the generated close commit"
+                : "git rejected the requested task-scoped commit",
+            likelyCause: phase === "close_commit"
+                ? "a formatting check in the pre-commit path rejected the deterministic close commit after the task README was staged"
+                : "a formatting check in the pre-commit path rejected the staged task-scoped commit",
+            nextAction: {
+                command: "bun run format",
+                reason: "apply formatter fixes before retrying the commit flow",
+                reasonCode: "git_pre_commit_format",
+            },
+        };
+    }
+    if (signal === "eslint") {
+        return {
+            state: phase === "close_commit"
+                ? "git rejected the generated close commit"
+                : "git rejected the requested task-scoped commit",
+            likelyCause: phase === "close_commit"
+                ? "a lint check in the pre-commit path rejected the deterministic close commit after the task README was staged"
+                : "a lint check in the pre-commit path rejected the staged task-scoped commit",
+            nextAction: {
+                command: "bun run lint:core",
+                reason: "rerun lint and fix the reported error before retrying the commit flow",
+                reasonCode: "git_pre_commit_lint",
+            },
+        };
+    }
+    if (phase === "close_commit") {
+        return {
+            state: "git rejected the generated close commit",
+            likelyCause: "a hook or commit policy blocked the deterministic task close commit after the task README was staged",
+            nextAction: {
+                command: "git status --short --untracked-files=no",
+                reason: "inspect the staged close-commit payload before fixing the hook or policy failure",
+                reasonCode: "git_close_commit_blocked",
+            },
+        };
+    }
+    return {
+        state: "git rejected the requested task-scoped commit",
+        likelyCause: "a hook or commit policy blocked the staged changes after guard validation passed",
+        nextAction: {
+            command: "git status --short --untracked-files=no",
+            reason: "inspect the staged task-scoped payload before fixing the hook or policy failure",
+            reasonCode: "git_task_commit_blocked",
+        },
+    };
 }
-function asCommitFailure(err) {
+function hasExplicitCommitScope(opts) {
+    return opts.allow.some((prefix) => prefix.trim().length > 0) || opts.allowTasks;
+}
+function asCommitFailure(err, phase) {
     if (err instanceof Error) {
         const e = err;
         const cmd = typeof e.cmd === "string" ? e.cmd : "";
@@ -51,15 +153,7 @@ function asCommitFailure(err) {
                 exitCode: 5,
                 code: "E_GIT",
                 message: lines.join("\n"),
-                context: withDiagnosticContext({ command: "commit" }, {
-                    state: "git rejected the generated close commit",
-                    likelyCause: "a hook or commit policy blocked the deterministic task close commit after the task README was staged",
-                    nextAction: {
-                        command: "git status --short --untracked-files=no",
-                        reason: "inspect the staged close-commit payload before fixing the hook or policy failure",
-                        reasonCode: "git_close_commit_blocked",
-                    },
-                }),
+                context: withDiagnosticContext({ command: "commit" }, commitFailureDiagnostic(phase, output)),
             });
         }
         return null;
@@ -235,6 +329,31 @@ export async function cmdCommit(opts) {
             });
         }
         await ensureReconciledBeforeMutation({ ctx, command: "commit" });
+        let autoStaged = [];
+        const staged = await ctx.git.statusStagedPaths();
+        if (staged.length === 0) {
+            if (!hasExplicitCommitScope(opts)) {
+                throw new CliError({
+                    exitCode: 2,
+                    code: "E_USAGE",
+                    message: "No staged files and no commit allowlist. Pass --allow <path-prefix>, use --allow-tasks for active task artifacts, or stage files manually.",
+                });
+            }
+            autoStaged = await stageAllowlist({
+                ctx,
+                allow: opts.allow,
+                allowTasks: opts.allowTasks,
+                tasksPath: ctx.config.paths.tasks_path,
+                workflowDir: ctx.config.paths.workflow_dir,
+                taskId: opts.taskId,
+                allowTaskOnly: true,
+                emptyAllowMessage: "No staged files and no commit allowlist. Pass --allow <path-prefix>, use --allow-tasks for active task artifacts, or stage files manually.",
+                noMatchMessage: "No changed files matched the commit allowlist (adjust --allow / --allow-tasks or stage files manually).",
+            });
+            if (!opts.quiet) {
+                process.stdout.write(`${infoMessage(`commit auto-staged ${autoStaged.length} path(s) from allowlist`)}\n`);
+            }
+        }
         await guardCommitCheck({
             ctx,
             cwd: opts.cwd,
@@ -263,14 +382,14 @@ export async function cmdCommit(opts) {
         await ctx.git.commit({ message: opts.message, env });
         if (!opts.quiet) {
             const { hash, subject } = await ctx.git.headHashSubject();
-            process.stdout.write(`${successMessage("committed", `${hash?.slice(0, 12) ?? ""} ${subject ?? ""}`.trim())}\n`);
+            process.stdout.write(`${successMessage("committed", `${hash?.slice(0, 12) ?? ""} ${subject ?? ""}`.trim(), autoStaged.length > 0 ? `staged=${autoStaged.join(", ")}` : undefined)}\n`);
         }
         return 0;
     }
     catch (err) {
         if (err instanceof CliError)
             throw err;
-        const commitFailure = asCommitFailure(err);
+        const commitFailure = asCommitFailure(err, opts.close ? "close_commit" : "task_commit");
         if (commitFailure)
             throw commitFailure;
         throw mapCoreError(err, { command: "commit", root: opts.rootOverride ?? null });

package/dist/commands/guard/impl/comment-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyF/D"}
+{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA2F/D"}

package/dist/commands/guard/impl/comment-commit.js

@@ -68,6 +68,8 @@ export async function commitFromComment(opts) {
         allow: allowPrefixes,
         allowTasks: opts.allowTasks,
         tasksPath: opts.config.paths.tasks_path,
+        workflowDir: opts.config.paths.workflow_dir,
+        taskId: opts.taskId,
     });
     const message = deriveCommitMessageFromComment({
         taskId: opts.taskId,

package/dist/commands/hooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/hooks/index.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,UAAU,mDAAoD,CAAC;AA8G5E,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmClB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BlB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8HlB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/hooks/index.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,UAAU,mDAAoD,CAAC;AA8G5E,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmClB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BlB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsGlB"}

package/dist/commands/hooks/index.js

@@ -5,13 +5,11 @@ import { evaluatePolicy } from "../../policy/evaluate.js";
 import { mapBackendError, mapCoreError } from "../../cli/error-map.js";
 import { fileExists } from "../../cli/fs-utils.js";
 import { infoMessage, successMessage } from "../../cli/output.js";
-import { resolveCommitEmojiForAgent } from "../../shared/agent-emoji.js";
 import { CliError } from "../../shared/errors.js";
 import { GitContext } from "../shared/git-context.js";
 import { throwIfPolicyDenied } from "../shared/policy-deny.js";
 import { gitCurrentBranch, gitRevParse } from "../shared/git-ops.js";
 import { isPathWithin } from "../shared/path.js";
-import { readDirectWorkLock } from "../../shared/direct-work-lock.js";
 const HOOK_MARKER = "agentplane-hook";
 const SHIM_MARKER = "agentplane-hook-shim";
 export const HOOK_NAMES = ["commit-msg", "pre-commit", "pre-push"];
@@ -201,40 +199,15 @@ export async function cmdHooksRun(opts) {
             const loaded = await loadConfig(resolved.agentplaneDir);
             const taskId = (process.env.AGENTPLANE_TASK_ID ?? "").trim();
             const statusTo = (process.env.AGENTPLANE_STATUS_TO ?? "").trim().toUpperCase();
-            const agentsDirAbs = path.join(resolved.gitRoot, loaded.config.paths.agents_dir);
-            let agentId = (process.env.AGENTPLANE_AGENT_ID ?? "").trim();
-            if (!agentId && loaded.config.workflow_mode === "direct" && taskId) {
-                const lock = await readDirectWorkLock(resolved.agentplaneDir);
-                const lockAgent = lock?.agent?.trim() ?? "";
-                if (lock?.task_id === taskId && lockAgent)
-                    agentId = lockAgent;
-            }
             const emoji = subject.split(/\s+/).find(Boolean) ?? "";
-            if (taskId) {
-                if (statusTo === "DONE") {
-                    if (emoji !== "✅") {
-                        throw new CliError({
-                            exitCode: 5,
-                            code: "E_GIT",
-                            message: "Finish commits must use a checkmark emoji.\n" +
-                                "Expected:\n" +
-                                "  ✅ <TASK_SUFFIX> <scope>: <summary>",
-                        });
-                    }
-                }
-                else if (agentId) {
-                    const expectedEmoji = await resolveCommitEmojiForAgent({ agentsDirAbs, agentId });
-                    if (emoji !== expectedEmoji) {
-                        throw new CliError({
-                            exitCode: 5,
-                            code: "E_GIT",
-                            message: "Commit emoji does not match the executor agent policy.\n" +
-                                `executor_agent=${agentId}\n` +
-                                "Expected:\n" +
-                                `  ${expectedEmoji} <TASK_SUFFIX> <scope>: <summary>`,
-                        });
-                    }
-                }
+            if (taskId && statusTo === "DONE" && emoji !== "✅") {
+                throw new CliError({
+                    exitCode: 5,
+                    code: "E_GIT",
+                    message: "Finish commits must use a checkmark emoji.\n" +
+                        "Expected:\n" +
+                        "  ✅ <TASK_SUFFIX> <scope>: <summary>",
+                });
             }
             const res = evaluatePolicy({
                 action: "hook_commit_msg",