agentplane 0.3.5 → 0.3.7

package/dist/commands/doctor/workspace.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { parseTaskReadme, renderTaskDocFromSections } from "@agentplaneorg/core";
 import { renderDiagnosticFinding } from "../../shared/diagnostics.js";
 import { resolvePolicyGatewayForRepo } from "../../shared/policy-gateway.js";
 import { GitContext } from "../shared/git-context.js";
@@ -84,7 +85,7 @@ async function readTaskDocSnapshotsFromProjection(ctx) {
         return null;
     }
 }
-function buildTaskReadmeMigrationFindings(tasks) {
+export function buildTaskReadmeMigrationFindings(tasks) {
     if (tasks.length === 0)
         return [];
     const legacy = tasks.filter((task) => task.doc_version !== 3);
@@ -138,7 +139,7 @@ function buildTaskReadmeMigrationFindings(tasks) {
         }),
     ];
 }
-async function checkTaskReadmeMigrationState(repoRoot, ctx) {
+export async function checkTaskReadmeMigrationState(repoRoot, ctx) {
     const projectionTasks = await readTaskDocSnapshotsFromProjection(ctx);
     const tasks = projectionTasks && projectionTasks.length > 0
         ? projectionTasks
@@ -197,6 +198,129 @@ async function checkDoneTaskReadmeArchiveDrift(repoRoot, ctx) {
         }),
     ];
 }
+function normalizeTaskBodyForComparison(text) {
+    return text.replaceAll("\r\n", "\n").trim();
+}
+function normalizeCanonicalSections(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const sections = {};
+    for (const [key, entry] of Object.entries(value)) {
+        const title = key.trim();
+        if (!title || typeof entry !== "string")
+            continue;
+        sections[title] = entry;
+    }
+    return Object.keys(sections).length > 0 ? sections : null;
+}
+async function checkTaskProjectionDrift(repoRoot, ctx) {
+    const workflowDir = path.join(repoRoot, ctx?.config.paths.workflow_dir ?? ".agentplane/tasks");
+    let entries;
+    try {
+        entries = await fs.readdir(workflowDir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const drifted = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const readmePath = path.join(workflowDir, entry.name, "README.md");
+        let text = "";
+        try {
+            text = await fs.readFile(readmePath, "utf8");
+        }
+        catch {
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = parseTaskReadme(text);
+        }
+        catch {
+            continue;
+        }
+        const sections = normalizeCanonicalSections(parsed.frontmatter.sections);
+        if (!sections)
+            continue;
+        const renderedBody = renderTaskDocFromSections(sections);
+        if (normalizeTaskBodyForComparison(parsed.body) === normalizeTaskBodyForComparison(renderedBody)) {
+            continue;
+        }
+        const taskId = typeof parsed.frontmatter.id === "string" && parsed.frontmatter.id.trim()
+            ? parsed.frontmatter.id.trim()
+            : entry.name;
+        const status = typeof parsed.frontmatter.status === "string" && parsed.frontmatter.status.trim()
+            ? parsed.frontmatter.status.trim().toUpperCase()
+            : "UNKNOWN";
+        drifted.push({ id: taskId, status });
+    }
+    if (drifted.length === 0)
+        return [];
+    const activeCount = drifted.filter((task) => task.status !== "DONE").length;
+    const examples = drifted
+        .slice(0, 5)
+        .map((task) => `${task.id}[${task.status}]`)
+        .join(", ");
+    return [
+        renderDiagnosticFinding({
+            severity: "WARN",
+            state: "task README projection drift detected",
+            likelyCause: "canonical frontmatter.sections no longer match the rendered task body on disk",
+            nextAction: {
+                command: "agentplane task normalize",
+                reason: "re-render task README bodies from canonical one-file task state",
+            },
+            details: [
+                `Drifted task READMEs: ${drifted.length}; active drifted tasks: ${activeCount}`,
+                examples ? `Examples: ${examples}` : "Examples unavailable.",
+            ],
+        }),
+    ];
+}
+function checkBackendReadiness(ctx) {
+    if (ctx?.backendId !== "redmine")
+        return [];
+    const { supports_task_revisions, supports_revision_guarded_writes } = ctx.taskBackend.capabilities;
+    if (supports_task_revisions === supports_revision_guarded_writes &&
+        supports_task_revisions === true) {
+        return [];
+    }
+    if (supports_task_revisions === false && supports_revision_guarded_writes === false) {
+        return [
+            renderDiagnosticFinding({
+                severity: "WARN",
+                state: "Redmine backend is running in partial compatibility mode without canonical_state support",
+                likelyCause: "AGENTPLANE_REDMINE_CUSTOM_FIELDS_CANONICAL_STATE is not configured, so Redmine cannot round-trip the full canonical task state or guard writes by remote revision",
+                nextAction: {
+                    command: "agentplane backend inspect redmine --yes",
+                    reason: "inspect visible Redmine custom fields first, then wire AGENTPLANE_REDMINE_CUSTOM_FIELDS_CANONICAL_STATE to the correct field id",
+                },
+                details: [
+                    `Backend config: ${ctx.backendConfigPath}`,
+                    "Current capability flags: supports_task_revisions=false; supports_revision_guarded_writes=false",
+                    "Legacy doc field syncing can still work, but the backend remains partial-compatibility only.",
+                ],
+            }),
+        ];
+    }
+    return [
+        renderDiagnosticFinding({
+            severity: "WARN",
+            state: "Redmine backend capability contract is internally inconsistent",
+            likelyCause: "backend capability flags diverged, so doctor cannot rely on a single revision-guard readiness state",
+            nextAction: {
+                command: "inspect Redmine backend capability wiring and rerun agentplane doctor",
+                reason: "restore a coherent readiness contract before relying on guarded remote writes",
+            },
+            details: [
+                `Backend config: ${ctx.backendConfigPath}`,
+                `Current capability flags: supports_task_revisions=${String(supports_task_revisions)}; supports_revision_guarded_writes=${String(supports_revision_guarded_writes)}`,
+            ],
+        }),
+    ];
+}
 export async function checkWorkspace(repoRoot, opts) {
     const problems = [];
     const requiredFiles = [path.join(repoRoot, ".agentplane", "config.json")];
@@ -243,6 +367,6 @@ export async function checkWorkspace(repoRoot, opts) {
     if (!hasJson) {
         problems.push("No agent profiles found in .agentplane/agents (*.json expected).");
     }
-    problems.push(...(await checkTaskReadmeMigrationState(repoRoot, opts?.ctx)), ...(await checkDoneTaskReadmeArchiveDrift(repoRoot, opts?.ctx)));
+    problems.push(...checkBackendReadiness(opts?.ctx), ...(await checkTaskReadmeMigrationState(repoRoot, opts?.ctx)), ...(await checkDoneTaskReadmeArchiveDrift(repoRoot, opts?.ctx)), ...(await checkTaskProjectionDrift(repoRoot, opts?.ctx)));
     return problems;
 }

package/dist/commands/guard/commit.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CA0G1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CA2BtE"}
+{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CAmI1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CA2BtE"}

package/dist/commands/guard/commit.command.js

@@ -34,23 +34,38 @@ export const guardCommitSpec = {
             kind: "boolean",
             name: "allow-tasks",
             default: false,
-            description: "Allow task workflow artifacts (tasks/ and .agentplane/tasks/).",
+            description: "Allow the tasks export snapshot plus artifacts under the active task subtree; standalone path scope.",
         },
         {
             kind: "boolean",
             name: "allow-base",
             default: false,
-            description: "Allow base branch edits.",
+            description: "Allow base branch edits; branch override only, not a path allowlist.",
         },
         {
             kind: "boolean",
             name: "allow-policy",
             default: false,
-            description: "Allow policy edits (e.g. AGENTS.md).",
+            description: "Allow policy edits (e.g. AGENTS.md); standalone path scope.",
+        },
+        {
+            kind: "boolean",
+            name: "allow-config",
+            default: false,
+            description: "Allow config edits; standalone path scope.",
+        },
+        {
+            kind: "boolean",
+            name: "allow-hooks",
+            default: false,
+            description: "Allow hooks edits; standalone path scope.",
+        },
+        {
+            kind: "boolean",
+            name: "allow-ci",
+            default: false,
+            description: "Allow CI workflow edits; standalone path scope.",
         },
-        { kind: "boolean", name: "allow-config", default: false, description: "Allow config edits." },
-        { kind: "boolean", name: "allow-hooks", default: false, description: "Allow hooks edits." },
-        { kind: "boolean", name: "allow-ci", default: false, description: "Allow CI workflow edits." },
         {
             kind: "boolean",
             name: "require-clean",
@@ -64,6 +79,15 @@ export const guardCommitSpec = {
             cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --allow packages/agentplane',
             why: "Validate staged changes are covered by allowlist and policy.",
         },
+        {
+            cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: update publish workflow" --allow-ci',
+            why: "Validate already staged CI-only changes without a redundant explicit workflow path prefix.",
+        },
+    ],
+    notes: [
+        "Protected path-scoped overrides can stand alone without a duplicate explicit prefix: `--allow-tasks`, `--allow-policy`, `--allow-config`, `--allow-hooks`, and `--allow-ci` each admit their own path family.",
+        "`agentplane guard commit` remains staged-only: it validates the current index and never auto-stages files for you.",
+        "`--allow-base` is different: it only overrides base-branch protection and never selects file paths by itself.",
     ],
     validateRaw: (raw) => {
         const msg = typeof raw.opts.message === "string" ? raw.opts.message.trim() : "";

package/dist/commands/guard/impl/allow.d.ts

@@ -13,6 +13,15 @@ export declare function stageAllowlist(opts: {
     ctx: CommandContext;
     allow: string[];
     allowTasks: boolean;
+    allowPolicy?: boolean;
+    allowConfig?: boolean;
+    allowHooks?: boolean;
+    allowCI?: boolean;
     tasksPath: string;
+    workflowDir?: string;
+    taskId?: string;
+    allowTaskOnly?: boolean;
+    emptyAllowMessage?: string;
+    noMatchMessage?: string;
 }): Promise<string[]>;
 //# sourceMappingURL=allow.d.ts.map

package/dist/commands/guard/impl/allow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkDpB"}
+{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAUA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoEpB"}

package/dist/commands/guard/impl/allow.js

@@ -2,6 +2,7 @@ import { resolveProject } from "@agentplaneorg/core";
 import { exitCodeForError } from "../../../cli/exit-codes.js";
 import { gitPathIsUnderPrefix, normalizeGitPathPrefix } from "../../../shared/git-path.js";
 import { CliError } from "../../../shared/errors.js";
+import { protectedPathAllowPrefixes, taskArtifactPrefixes, } from "../../../shared/protected-paths.js";
 import { GitContext } from "../../shared/git-context.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 function normalizeAllowPrefixes(prefixes) {
@@ -75,28 +76,43 @@ export async function stageAllowlist(opts) {
         });
     }
     const allow = normalizeAllowPrefixes(opts.allow);
-    if (allow.length === 0) {
+    if (allow.includes(".")) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Provide at least one allowed prefix",
+            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
         });
     }
-    if (allow.includes(".")) {
+    const taskAllow = taskArtifactPrefixes({
+        tasksPath: opts.tasksPath,
+        workflowDir: opts.workflowDir,
+        taskId: opts.taskId,
+    });
+    const protectedAllow = protectedPathAllowPrefixes({
+        tasksPath: opts.tasksPath,
+        workflowDir: opts.workflowDir,
+        taskId: opts.taskId,
+        allowTasks: opts.allowTasks,
+        allowPolicy: opts.allowPolicy,
+        allowConfig: opts.allowConfig,
+        allowHooks: opts.allowHooks,
+        allowCI: opts.allowCI,
+    });
+    const effectiveAllow = normalizeAllowPrefixes([...allow, ...protectedAllow]);
+    if (effectiveAllow.length === 0 ||
+        (allow.length === 0 && protectedAllow.length === 0 && opts.allowTaskOnly !== true)) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "Repo-wide allowlist ('.') is not allowed; choose minimal prefixes (tip: `agentplane guard suggest-allow --format args`).",
+            message: opts.emptyAllowMessage ?? "Provide at least one allowed prefix",
         });
     }
-    const denied = new Set();
-    if (!opts.allowTasks)
-        denied.add(opts.tasksPath);
+    const denied = opts.allowTasks ? [] : taskAllow;
     const staged = [];
     for (const filePath of changed) {
-        if (denied.has(filePath))
+        if (denied.some((prefix) => gitPathIsUnderPrefix(filePath, prefix)))
             continue;
-        if (allow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {
+        if (effectiveAllow.some((prefix) => gitPathIsUnderPrefix(filePath, prefix))) {
             staged.push(filePath);
         }
     }
@@ -105,7 +121,7 @@ export async function stageAllowlist(opts) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",
-            message: "No changes matched allowed prefixes (update --commit-allow)",
+            message: opts.noMatchMessage ?? "No changes matched allowed prefixes (update --commit-allow)",
         });
     }
     // `git add <pathspec>` is not reliable for staging deletes/renames across versions/configs.

package/dist/commands/guard/impl/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuExE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgKlB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAuMxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuMlB"}

package/dist/commands/guard/impl/commands.js

@@ -1,15 +1,30 @@
 import { mapCoreError } from "../../../cli/error-map.js";
-import { successMessage } from "../../../cli/output.js";
+import { infoMessage, successMessage } from "../../../cli/output.js";
+import { stripAnsi } from "../../../cli/shared/ansi.js";
 import { withDiagnosticContext } from "../../../shared/diagnostics.js";
 import { CliError } from "../../../shared/errors.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 import { loadTaskFromContext } from "../../shared/task-backend.js";
 import { execFileAsync, gitEnv } from "../../shared/git.js";
 import { ensureReconciledBeforeMutation } from "../../shared/reconcile-check.js";
-import { suggestAllowPrefixes } from "./allow.js";
+import { stageAllowlist, suggestAllowPrefixes } from "./allow.js";
 import { buildCloseCommitMessage, taskReadmePathForTask } from "./close-message.js";
 import { buildGitCommitEnv } from "./env.js";
 import { guardCommitCheck } from "./policy.js";
+const COMMIT_FAILURE_SIGNAL_PATTERNS = [
+    /Code style issues found/i,
+    /Run Prettier with --write/i,
+    /\bESLint\b/i,
+    /\b[0-9]+\s+problems?\b/i,
+    /\berror\b/i,
+    /\bfailed\b/i,
+    /✖/,
+];
+const FORMATTER_SIGNAL_PATTERNS = [
+    /Code style issues found/i,
+    /Run Prettier with --write/i,
+];
+const ESLINT_SIGNAL_PATTERNS = [/\bESLint\b/i, /\b[0-9]+\s+problems?\b/i];
 function readText(value) {
     if (typeof value === "string")
         return value;
@@ -21,16 +36,108 @@ function summarizeOutput(raw) {
     const lines = raw
         .replaceAll("\r\n", "\n")
         .split("\n")
-        .map((line) => line.trimEnd())
+        .map((line) => stripAnsi(line).trimEnd())
         .filter((line) => line.trim().length > 0)
         .map((line) => (line.length > 180 ? `${line.slice(0, 180)} [truncated]` : line));
     if (lines.length <= 12)
         return lines;
-    const head = lines.slice(0, 6);
-    const tail = lines.slice(-6);
-    return [...head, `[${lines.length - 12} lines omitted]`, ...tail];
+    const selected = new Set();
+    for (let index = 0; index < Math.min(6, lines.length); index += 1) {
+        selected.add(index);
+    }
+    for (let index = Math.max(lines.length - 6, 0); index < lines.length; index += 1) {
+        selected.add(index);
+    }
+    for (const [index, line] of lines.entries()) {
+        if (selected.has(index))
+            continue;
+        if (COMMIT_FAILURE_SIGNAL_PATTERNS.some((pattern) => pattern.test(line))) {
+            selected.add(index);
+        }
+    }
+    const ordered = [...selected].toSorted((a, b) => a - b);
+    const summary = [];
+    let previous = -1;
+    for (const index of ordered) {
+        if (previous >= 0 && index - previous > 1) {
+            summary.push(`[${index - previous - 1} lines omitted]`);
+        }
+        summary.push(lines[index] ?? "");
+        previous = index;
+    }
+    return summary;
+}
+function detectCommitFailureSignal(output) {
+    if (FORMATTER_SIGNAL_PATTERNS.some((pattern) => pattern.test(output))) {
+        return "formatter";
+    }
+    if (ESLINT_SIGNAL_PATTERNS.some((pattern) => pattern.test(output))) {
+        return "eslint";
+    }
+    return null;
+}
+function commitFailureDiagnostic(phase, output) {
+    const signal = detectCommitFailureSignal(output);
+    if (signal === "formatter") {
+        return {
+            state: phase === "close_commit"
+                ? "git rejected the generated close commit"
+                : "git rejected the requested task-scoped commit",
+            likelyCause: phase === "close_commit"
+                ? "a formatting check in the pre-commit path rejected the deterministic close commit after the task README was staged"
+                : "a formatting check in the pre-commit path rejected the staged task-scoped commit",
+            nextAction: {
+                command: "bun run format",
+                reason: "apply formatter fixes before retrying the commit flow",
+                reasonCode: "git_pre_commit_format",
+            },
+        };
+    }
+    if (signal === "eslint") {
+        return {
+            state: phase === "close_commit"
+                ? "git rejected the generated close commit"
+                : "git rejected the requested task-scoped commit",
+            likelyCause: phase === "close_commit"
+                ? "a lint check in the pre-commit path rejected the deterministic close commit after the task README was staged"
+                : "a lint check in the pre-commit path rejected the staged task-scoped commit",
+            nextAction: {
+                command: "bun run lint:core",
+                reason: "rerun lint and fix the reported error before retrying the commit flow",
+                reasonCode: "git_pre_commit_lint",
+            },
+        };
+    }
+    if (phase === "close_commit") {
+        return {
+            state: "git rejected the generated close commit",
+            likelyCause: "a hook or commit policy blocked the deterministic task close commit after the task README was staged",
+            nextAction: {
+                command: "git status --short --untracked-files=no",
+                reason: "inspect the staged close-commit payload before fixing the hook or policy failure",
+                reasonCode: "git_close_commit_blocked",
+            },
+        };
+    }
+    return {
+        state: "git rejected the requested task-scoped commit",
+        likelyCause: "a hook or commit policy blocked the staged changes after guard validation passed",
+        nextAction: {
+            command: "git status --short --untracked-files=no",
+            reason: "inspect the staged task-scoped payload before fixing the hook or policy failure",
+            reasonCode: "git_task_commit_blocked",
+        },
+    };
 }
-function asCommitFailure(err) {
+function hasExplicitCommitScope(opts) {
+    return (opts.allow.some((prefix) => prefix.trim().length > 0) ||
+        opts.allowTasks ||
+        opts.allowPolicy ||
+        opts.allowConfig ||
+        opts.allowHooks ||
+        opts.allowCI);
+}
+function asCommitFailure(err, phase) {
     if (err instanceof Error) {
         const e = err;
         const cmd = typeof e.cmd === "string" ? e.cmd : "";
@@ -51,15 +158,7 @@ function asCommitFailure(err) {
                 exitCode: 5,
                 code: "E_GIT",
                 message: lines.join("\n"),
-                context: withDiagnosticContext({ command: "commit" }, {
-                    state: "git rejected the generated close commit",
-                    likelyCause: "a hook or commit policy blocked the deterministic task close commit after the task README was staged",
-                    nextAction: {
-                        command: "git status --short --untracked-files=no",
-                        reason: "inspect the staged close-commit payload before fixing the hook or policy failure",
-                        reasonCode: "git_close_commit_blocked",
-                    },
-                }),
+                context: withDiagnosticContext({ command: "commit" }, commitFailureDiagnostic(phase, output)),
             });
         }
         return null;
@@ -235,6 +334,35 @@ export async function cmdCommit(opts) {
             });
         }
         await ensureReconciledBeforeMutation({ ctx, command: "commit" });
+        let autoStaged = [];
+        const staged = await ctx.git.statusStagedPaths();
+        if (staged.length === 0) {
+            if (!hasExplicitCommitScope(opts)) {
+                throw new CliError({
+                    exitCode: 2,
+                    code: "E_USAGE",
+                    message: "No staged files and no commit allowlist. Pass --allow <path-prefix>, use --allow-tasks for active task artifacts, or stage files manually.",
+                });
+            }
+            autoStaged = await stageAllowlist({
+                ctx,
+                allow: opts.allow,
+                allowTasks: opts.allowTasks,
+                allowPolicy: opts.allowPolicy,
+                allowConfig: opts.allowConfig,
+                allowHooks: opts.allowHooks,
+                allowCI: opts.allowCI,
+                tasksPath: ctx.config.paths.tasks_path,
+                workflowDir: ctx.config.paths.workflow_dir,
+                taskId: opts.taskId,
+                allowTaskOnly: true,
+                emptyAllowMessage: "No staged files and no commit allowlist. Pass --allow <path-prefix>, use --allow-tasks for active task artifacts, or stage files manually.",
+                noMatchMessage: "No changed files matched the commit allowlist (adjust --allow, protected allow flags, or --allow-tasks; otherwise stage files manually).",
+            });
+            if (!opts.quiet) {
+                process.stdout.write(`${infoMessage(`commit auto-staged ${autoStaged.length} path(s) from allowlist`)}\n`);
+            }
+        }
         await guardCommitCheck({
             ctx,
             cwd: opts.cwd,
@@ -263,14 +391,14 @@ export async function cmdCommit(opts) {
         await ctx.git.commit({ message: opts.message, env });
         if (!opts.quiet) {
             const { hash, subject } = await ctx.git.headHashSubject();
-            process.stdout.write(`${successMessage("committed", `${hash?.slice(0, 12) ?? ""} ${subject ?? ""}`.trim())}\n`);
+            process.stdout.write(`${successMessage("committed", `${hash?.slice(0, 12) ?? ""} ${subject ?? ""}`.trim(), autoStaged.length > 0 ? `staged=${autoStaged.join(", ")}` : undefined)}\n`);
         }
         return 0;
     }
     catch (err) {
         if (err instanceof CliError)
             throw err;
-        const commitFailure = asCommitFailure(err);
+        const commitFailure = asCommitFailure(err, opts.close ? "close_commit" : "task_commit");
         if (commitFailure)
             throw commitFailure;
         throw mapCoreError(err, { command: "commit", root: opts.rootOverride ?? null });

package/dist/commands/guard/impl/comment-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyF/D"}
+{"version":3,"file":"comment-commit.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/comment-commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAQ/E,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAiEvF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA2F/D"}

package/dist/commands/guard/impl/comment-commit.js

@@ -68,6 +68,8 @@ export async function commitFromComment(opts) {
         allow: allowPrefixes,
         allowTasks: opts.allowTasks,
         tasksPath: opts.config.paths.tasks_path,
+        workflowDir: opts.config.paths.workflow_dir,
+        taskId: opts.taskId,
     });
     const message = deriveCommitMessageFromComment({
         taskId: opts.taskId,

package/dist/commands/hooks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/hooks/index.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,UAAU,mDAAoD,CAAC;AA8G5E,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmClB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BlB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8HlB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/hooks/index.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,UAAU,mDAAoD,CAAC;AA8G5E,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmClB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BlB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsGlB"}

package/dist/commands/hooks/index.js

@@ -5,13 +5,11 @@ import { evaluatePolicy } from "../../policy/evaluate.js";
 import { mapBackendError, mapCoreError } from "../../cli/error-map.js";
 import { fileExists } from "../../cli/fs-utils.js";
 import { infoMessage, successMessage } from "../../cli/output.js";
-import { resolveCommitEmojiForAgent } from "../../shared/agent-emoji.js";
 import { CliError } from "../../shared/errors.js";
 import { GitContext } from "../shared/git-context.js";
 import { throwIfPolicyDenied } from "../shared/policy-deny.js";
 import { gitCurrentBranch, gitRevParse } from "../shared/git-ops.js";
 import { isPathWithin } from "../shared/path.js";
-import { readDirectWorkLock } from "../../shared/direct-work-lock.js";
 const HOOK_MARKER = "agentplane-hook";
 const SHIM_MARKER = "agentplane-hook-shim";
 export const HOOK_NAMES = ["commit-msg", "pre-commit", "pre-push"];
@@ -201,40 +199,15 @@ export async function cmdHooksRun(opts) {
             const loaded = await loadConfig(resolved.agentplaneDir);
             const taskId = (process.env.AGENTPLANE_TASK_ID ?? "").trim();
             const statusTo = (process.env.AGENTPLANE_STATUS_TO ?? "").trim().toUpperCase();
-            const agentsDirAbs = path.join(resolved.gitRoot, loaded.config.paths.agents_dir);
-            let agentId = (process.env.AGENTPLANE_AGENT_ID ?? "").trim();
-            if (!agentId && loaded.config.workflow_mode === "direct" && taskId) {
-                const lock = await readDirectWorkLock(resolved.agentplaneDir);
-                const lockAgent = lock?.agent?.trim() ?? "";
-                if (lock?.task_id === taskId && lockAgent)
-                    agentId = lockAgent;
-            }
             const emoji = subject.split(/\s+/).find(Boolean) ?? "";
-            if (taskId) {
-                if (statusTo === "DONE") {
-                    if (emoji !== "✅") {
-                        throw new CliError({
-                            exitCode: 5,
-                            code: "E_GIT",
-                            message: "Finish commits must use a checkmark emoji.\n" +
-                                "Expected:\n" +
-                                "  ✅ <TASK_SUFFIX> <scope>: <summary>",
-                        });
-                    }
-                }
-                else if (agentId) {
-                    const expectedEmoji = await resolveCommitEmojiForAgent({ agentsDirAbs, agentId });
-                    if (emoji !== expectedEmoji) {
-                        throw new CliError({
-                            exitCode: 5,
-                            code: "E_GIT",
-                            message: "Commit emoji does not match the executor agent policy.\n" +
-                                `executor_agent=${agentId}\n` +
-                                "Expected:\n" +
-                                `  ${expectedEmoji} <TASK_SUFFIX> <scope>: <summary>`,
-                        });
-                    }
-                }
+            if (taskId && statusTo === "DONE" && emoji !== "✅") {
+                throw new CliError({
+                    exitCode: 5,
+                    code: "E_GIT",
+                    message: "Finish commits must use a checkmark emoji.\n" +
+                        "Expected:\n" +
+                        "  ✅ <TASK_SUFFIX> <scope>: <summary>",
+                });
             }
             const res = evaluatePolicy({
                 action: "hook_commit_msg",

package/dist/commands/recipes/impl/apply.d.ts

@@ -3,6 +3,10 @@ export declare function moveRecipeDir(opts: {
     from: string;
     to: string;
 }): Promise<void>;
+export declare function validateRecipeAssets(opts: {
+    manifest: RecipeManifest;
+    recipeDir: string;
+}): Promise<void>;
 export declare function applyRecipeAgents(opts: {
     manifest: RecipeManifest;
     recipeDir: string;