agentplane 0.3.6 → 0.3.8

package/dist/commands/docs/cli.command.js

@@ -7,7 +7,7 @@ import { writeTextIfChanged } from "../../shared/write-if-changed.js";
 export const docsCliSpec = {
     id: ["docs", "cli"],
     group: "Docs",
-    summary: "Generate an MDX CLI reference from the current cli2 registry/spec.",
+    summary: "Generate an MDX CLI reference from the current command spec catalog.",
     options: [
         {
             kind: "string",
@@ -35,7 +35,7 @@ export function makeRunDocsCliHandler(getHelpJson) {
             throw usageError({
                 spec: docsCliSpec,
                 command: "docs cli",
-                message: `Failed to read cli2 registry/spec for docs generation: ${err instanceof Error ? err.message : String(err)}`,
+                message: `Failed to read command specs for docs generation: ${err instanceof Error ? err.message : String(err)}`,
             });
         }
         const mdx = renderCliDocsMdx(list);

package/dist/commands/doctor/runtime.js

@@ -22,7 +22,7 @@ export function checkRuntimeSourceFacts(cwd, config) {
     }
     const warning = report.mode === "global-in-framework"
         ? "[WARN] Framework checkout detected but the active runtime is still a global installed binary. " +
-            "Run scripts/reinstall-global-agentplane.sh to refresh the wrapper, or run the repo-local binary directly."
+            "Run bun run framework:dev:bootstrap first so the wrapper can hand off to a built repo-local runtime."
         : report.mode === "global-forced-in-framework"
             ? "[WARN] Framework checkout is forcing the global installed binary via AGENTPLANE_USE_GLOBAL_IN_FRAMEWORK=1. Unset it unless that override is intentional."
             : null;

package/dist/commands/doctor/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/workflow.ts"],"names":[],"mappings":"AAUA,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAU/E;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAiD7C"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/workflow.ts"],"names":[],"mappings":"AAWA,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAU/E;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAyD7C"}

package/dist/commands/doctor/workflow.js

@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { loadConfig } from "@agentplaneorg/core";
 import { emitWorkflowEvent, resolveWorkflowPaths, safeAutofixWorkflowText, validateWorkflowAtPath, } from "../../workflow-runtime/index.js";
 export async function checkWorkflowContract(repoRoot) {
     const result = await validateWorkflowAtPath(repoRoot);
@@ -26,7 +27,15 @@ export async function safeFixWorkflow(repoRoot) {
             return { changed: false, note: "Skip: workflow contract file not found." };
         }
     }
-    const fixed = safeAutofixWorkflowText(current);
+    const loaded = await loadConfig(path.join(repoRoot, ".agentplane"));
+    const fixed = safeAutofixWorkflowText(current, {
+        mode: loaded.config.workflow_mode,
+        approvals: {
+            require_plan: loaded.config.agents?.approvals?.require_plan ?? true,
+            require_verify: loaded.config.agents?.approvals?.require_verify ?? true,
+            require_network: loaded.config.agents?.approvals?.require_network ?? true,
+        },
+    });
     if (fixed.diagnostics.some((d) => d.code === "WF_FIX_SKIPPED_UNSAFE")) {
         const details = fixed.diagnostics.map((d) => `${d.path}`).join(", ");
         return {

package/dist/commands/doctor/workspace.d.ts

@@ -1,5 +1,13 @@
 import { type CommandContext } from "../shared/task-backend.js";
+type TaskDocSnapshot = {
+    id?: unknown;
+    status?: unknown;
+    doc_version?: unknown;
+};
+export declare function buildTaskReadmeMigrationFindings(tasks: TaskDocSnapshot[]): string[];
+export declare function checkTaskReadmeMigrationState(repoRoot: string, ctx?: CommandContext): Promise<string[]>;
 export declare function checkWorkspace(repoRoot: string, opts?: {
     ctx?: CommandContext;
 }): Promise<string[]>;
+export {};
 //# sourceMappingURL=workspace.d.ts.map

package/dist/commands/doctor/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/workspace.ts"],"names":[],"mappings":"AAQA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA6NpF,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,cAAc,CAAA;CAAE,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CAyDnB"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/doctor/workspace.ts"],"names":[],"mappings":"AAUA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEpF,KAAK,eAAe,GAAG;IACrB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAuFF,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,EAAE,CAyDnF;AAED,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnB;AAuMD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,cAAc,CAAA;CAAE,GAC9B,OAAO,CAAC,MAAM,EAAE,CAAC,CA2DnB"}

package/dist/commands/doctor/workspace.js

@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { parseTaskReadme, renderTaskDocFromSections } from "@agentplaneorg/core";
 import { renderDiagnosticFinding } from "../../shared/diagnostics.js";
 import { resolvePolicyGatewayForRepo } from "../../shared/policy-gateway.js";
 import { GitContext } from "../shared/git-context.js";
@@ -84,7 +85,7 @@ async function readTaskDocSnapshotsFromProjection(ctx) {
         return null;
     }
 }
-function buildTaskReadmeMigrationFindings(tasks) {
+export function buildTaskReadmeMigrationFindings(tasks) {
     if (tasks.length === 0)
         return [];
     const legacy = tasks.filter((task) => task.doc_version !== 3);
@@ -138,7 +139,7 @@ function buildTaskReadmeMigrationFindings(tasks) {
         }),
     ];
 }
-async function checkTaskReadmeMigrationState(repoRoot, ctx) {
+export async function checkTaskReadmeMigrationState(repoRoot, ctx) {
     const projectionTasks = await readTaskDocSnapshotsFromProjection(ctx);
     const tasks = projectionTasks && projectionTasks.length > 0
         ? projectionTasks
@@ -197,6 +198,129 @@ async function checkDoneTaskReadmeArchiveDrift(repoRoot, ctx) {
         }),
     ];
 }
+function normalizeTaskBodyForComparison(text) {
+    return text.replaceAll("\r\n", "\n").trim();
+}
+function normalizeCanonicalSections(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const sections = {};
+    for (const [key, entry] of Object.entries(value)) {
+        const title = key.trim();
+        if (!title || typeof entry !== "string")
+            continue;
+        sections[title] = entry;
+    }
+    return Object.keys(sections).length > 0 ? sections : null;
+}
+async function checkTaskProjectionDrift(repoRoot, ctx) {
+    const workflowDir = path.join(repoRoot, ctx?.config.paths.workflow_dir ?? ".agentplane/tasks");
+    let entries;
+    try {
+        entries = await fs.readdir(workflowDir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const drifted = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const readmePath = path.join(workflowDir, entry.name, "README.md");
+        let text = "";
+        try {
+            text = await fs.readFile(readmePath, "utf8");
+        }
+        catch {
+            continue;
+        }
+        let parsed;
+        try {
+            parsed = parseTaskReadme(text);
+        }
+        catch {
+            continue;
+        }
+        const sections = normalizeCanonicalSections(parsed.frontmatter.sections);
+        if (!sections)
+            continue;
+        const renderedBody = renderTaskDocFromSections(sections);
+        if (normalizeTaskBodyForComparison(parsed.body) === normalizeTaskBodyForComparison(renderedBody)) {
+            continue;
+        }
+        const taskId = typeof parsed.frontmatter.id === "string" && parsed.frontmatter.id.trim()
+            ? parsed.frontmatter.id.trim()
+            : entry.name;
+        const status = typeof parsed.frontmatter.status === "string" && parsed.frontmatter.status.trim()
+            ? parsed.frontmatter.status.trim().toUpperCase()
+            : "UNKNOWN";
+        drifted.push({ id: taskId, status });
+    }
+    if (drifted.length === 0)
+        return [];
+    const activeCount = drifted.filter((task) => task.status !== "DONE").length;
+    const examples = drifted
+        .slice(0, 5)
+        .map((task) => `${task.id}[${task.status}]`)
+        .join(", ");
+    return [
+        renderDiagnosticFinding({
+            severity: "WARN",
+            state: "task README projection drift detected",
+            likelyCause: "canonical frontmatter.sections no longer match the rendered task body on disk",
+            nextAction: {
+                command: "agentplane task normalize",
+                reason: "re-render task README bodies from canonical one-file task state",
+            },
+            details: [
+                `Drifted task READMEs: ${drifted.length}; active drifted tasks: ${activeCount}`,
+                examples ? `Examples: ${examples}` : "Examples unavailable.",
+            ],
+        }),
+    ];
+}
+function checkBackendReadiness(ctx) {
+    if (ctx?.backendId !== "redmine")
+        return [];
+    const { supports_task_revisions, supports_revision_guarded_writes } = ctx.taskBackend.capabilities;
+    if (supports_task_revisions === supports_revision_guarded_writes &&
+        supports_task_revisions === true) {
+        return [];
+    }
+    if (supports_task_revisions === false && supports_revision_guarded_writes === false) {
+        return [
+            renderDiagnosticFinding({
+                severity: "WARN",
+                state: "Redmine backend is running in partial compatibility mode without canonical_state support",
+                likelyCause: "AGENTPLANE_REDMINE_CUSTOM_FIELDS_CANONICAL_STATE is not configured, so Redmine cannot round-trip the full canonical task state or guard writes by remote revision",
+                nextAction: {
+                    command: "agentplane backend inspect redmine --yes",
+                    reason: "inspect visible Redmine custom fields first, then wire AGENTPLANE_REDMINE_CUSTOM_FIELDS_CANONICAL_STATE to the correct field id",
+                },
+                details: [
+                    `Backend config: ${ctx.backendConfigPath}`,
+                    "Current capability flags: supports_task_revisions=false; supports_revision_guarded_writes=false",
+                    "Legacy doc field syncing can still work, but the backend remains partial-compatibility only.",
+                ],
+            }),
+        ];
+    }
+    return [
+        renderDiagnosticFinding({
+            severity: "WARN",
+            state: "Redmine backend capability contract is internally inconsistent",
+            likelyCause: "backend capability flags diverged, so doctor cannot rely on a single revision-guard readiness state",
+            nextAction: {
+                command: "inspect Redmine backend capability wiring and rerun agentplane doctor",
+                reason: "restore a coherent readiness contract before relying on guarded remote writes",
+            },
+            details: [
+                `Backend config: ${ctx.backendConfigPath}`,
+                `Current capability flags: supports_task_revisions=${String(supports_task_revisions)}; supports_revision_guarded_writes=${String(supports_revision_guarded_writes)}`,
+            ],
+        }),
+    ];
+}
 export async function checkWorkspace(repoRoot, opts) {
     const problems = [];
     const requiredFiles = [path.join(repoRoot, ".agentplane", "config.json")];
@@ -243,6 +367,6 @@ export async function checkWorkspace(repoRoot, opts) {
     if (!hasJson) {
         problems.push("No agent profiles found in .agentplane/agents (*.json expected).");
     }
-    problems.push(...(await checkTaskReadmeMigrationState(repoRoot, opts?.ctx)), ...(await checkDoneTaskReadmeArchiveDrift(repoRoot, opts?.ctx)));
+    problems.push(...checkBackendReadiness(opts?.ctx), ...(await checkTaskReadmeMigrationState(repoRoot, opts?.ctx)), ...(await checkDoneTaskReadmeArchiveDrift(repoRoot, opts?.ctx)), ...(await checkTaskProjectionDrift(repoRoot, opts?.ctx)));
     return problems;
 }

package/dist/commands/finish.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finish.spec.d.ts","sourceRoot":"","sources":["../../src/commands/finish.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CA6ThD,CAAC"}
+{"version":3,"file":"finish.spec.d.ts","sourceRoot":"","sources":["../../src/commands/finish.spec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wBAAwB,EAAE,OAAO,CAAC;IAClC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,YAAY,CAqUhD,CAAC"}

package/dist/commands/finish.spec.js

@@ -213,6 +213,13 @@ export const finishSpec = {
                 message: "--commit-from-comment/--status-commit requires exactly one task id",
             });
         }
+        if (commitFromComment && statusCommit) {
+            throw usageError({
+                spec: finishSpec,
+                command: "finish",
+                message: "--commit-from-comment cannot be combined with --status-commit in finish; use one deterministic commit path.",
+            });
+        }
         if (commitFromComment && commitAllow.length === 0) {
             throw usageError({
                 spec: finishSpec,

package/dist/commands/guard/commit.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CA0G1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CA2BtE"}
+{"version":3,"file":"commit.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/commit.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAOtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,iBAAiB,CAmI1D,CAAC;AAEF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,IAC1E,KAAK,UAAU,EAAE,GAAG,iBAAiB,KAAG,OAAO,CAAC,MAAM,CAAC,CA2BtE"}

package/dist/commands/guard/commit.command.js

@@ -34,23 +34,38 @@ export const guardCommitSpec = {
             kind: "boolean",
             name: "allow-tasks",
             default: false,
-            description: "Allow the tasks export snapshot plus artifacts under the active task subtree.",
+            description: "Allow the tasks export snapshot plus artifacts under the active task subtree; standalone path scope.",
         },
         {
             kind: "boolean",
             name: "allow-base",
             default: false,
-            description: "Allow base branch edits.",
+            description: "Allow base branch edits; branch override only, not a path allowlist.",
         },
         {
             kind: "boolean",
             name: "allow-policy",
             default: false,
-            description: "Allow policy edits (e.g. AGENTS.md).",
+            description: "Allow policy edits (e.g. AGENTS.md); standalone path scope.",
+        },
+        {
+            kind: "boolean",
+            name: "allow-config",
+            default: false,
+            description: "Allow config edits; standalone path scope.",
+        },
+        {
+            kind: "boolean",
+            name: "allow-hooks",
+            default: false,
+            description: "Allow hooks edits; standalone path scope.",
+        },
+        {
+            kind: "boolean",
+            name: "allow-ci",
+            default: false,
+            description: "Allow CI workflow edits; standalone path scope.",
         },
-        { kind: "boolean", name: "allow-config", default: false, description: "Allow config edits." },
-        { kind: "boolean", name: "allow-hooks", default: false, description: "Allow hooks edits." },
-        { kind: "boolean", name: "allow-ci", default: false, description: "Allow CI workflow edits." },
         {
             kind: "boolean",
             name: "require-clean",
@@ -64,6 +79,15 @@ export const guardCommitSpec = {
             cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: implement allowlist guard" --allow packages/agentplane',
             why: "Validate staged changes are covered by allowlist and policy.",
         },
+        {
+            cmd: 'agentplane guard commit 202602030608-F1Q8AB -m "✨ F1Q8AB task: update publish workflow" --allow-ci',
+            why: "Validate already staged CI-only changes without a redundant explicit workflow path prefix.",
+        },
+    ],
+    notes: [
+        "Protected path-scoped overrides can stand alone without a duplicate explicit prefix: `--allow-tasks`, `--allow-policy`, `--allow-config`, `--allow-hooks`, and `--allow-ci` each admit their own path family.",
+        "`agentplane guard commit` remains staged-only: it validates the current index and never auto-stages files for you.",
+        "`--allow-base` is different: it only overrides base-branch protection and never selects file paths by itself.",
     ],
     validateRaw: (raw) => {
         const msg = typeof raw.opts.message === "string" ? raw.opts.message.trim() : "";

package/dist/commands/guard/guard.command.d.ts

@@ -1,5 +1,5 @@
 import type { CommandHandler, CommandSpec } from "../../cli/spec/spec.js";
-export type GuardGroupParsed = Record<string, never>;
-export declare const guardSpec: CommandSpec<GuardGroupParsed>;
-export declare const runGuard: CommandHandler<GuardGroupParsed>;
+import { type GroupCommandParsed } from "../../cli/group-command.js";
+export declare const guardSpec: CommandSpec<GroupCommandParsed>;
+export declare const runGuard: CommandHandler<GroupCommandParsed>;
 //# sourceMappingURL=guard.command.d.ts.map

package/dist/commands/guard/guard.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/guard.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAG1E,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAErD,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,gBAAgB,CAenD,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,cAAc,CAAC,gBAAgB,CAGrD,CAAC"}
+{"version":3,"file":"guard.command.d.ts","sourceRoot":"","sources":["../../../src/commands/guard/guard.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AAEpC,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,kBAAkB,CAOrD,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,cAAc,CAAC,kBAAkB,CAMvD,CAAC"}

package/dist/commands/guard/guard.command.js

@@ -1,21 +1,16 @@
-import { usageError } from "../../cli/spec/errors.js";
+import { loadDirectSubcommandNames, parseGroupCommand, throwGroupCommandUsage, } from "../../cli/group-command.js";
 export const guardSpec = {
     id: ["guard"],
     group: "Guard",
     summary: "Guard commands (commit checks, git hygiene, and allowlist helpers).",
     synopsis: ["agentplane guard <command> [args] [options]"],
-    validateRaw: (raw) => {
-        if (raw.extra.length > 0) {
-            throw usageError({
-                spec: guardSpec,
-                message: `Unknown subcommand: ${raw.extra[0]}`,
-            });
-        }
-        throw usageError({ spec: guardSpec, message: "Missing subcommand." });
-    },
-    parse: () => ({}),
+    args: [{ name: "cmd", required: false, variadic: true, valueHint: "<command>" }],
+    parse: (raw) => parseGroupCommand(raw),
 };
-export const runGuard = () => {
-    // Unreachable (validateRaw always throws).
-    return Promise.resolve(2);
+export const runGuard = async (_ctx, p) => {
+    throwGroupCommandUsage({
+        spec: guardSpec,
+        cmd: p.cmd,
+        subcommands: await loadDirectSubcommandNames(["guard"]),
+    });
 };

package/dist/commands/guard/impl/allow.d.ts

@@ -13,6 +13,10 @@ export declare function stageAllowlist(opts: {
     ctx: CommandContext;
     allow: string[];
     allowTasks: boolean;
+    allowPolicy?: boolean;
+    allowConfig?: boolean;
+    allowHooks?: boolean;
+    allowCI?: boolean;
     tasksPath: string;
     workflowDir?: string;
     taskId?: string;

package/dist/commands/guard/impl/allow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAuDpB"}
+{"version":3,"file":"allow.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/allow.ts"],"names":[],"mappings":"AAUA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAkBvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOpB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoEpB"}

package/dist/commands/guard/impl/allow.js

@@ -2,7 +2,7 @@ import { resolveProject } from "@agentplaneorg/core";
 import { exitCodeForError } from "../../../cli/exit-codes.js";
 import { gitPathIsUnderPrefix, normalizeGitPathPrefix } from "../../../shared/git-path.js";
 import { CliError } from "../../../shared/errors.js";
-import { taskArtifactPrefixes } from "../../../shared/protected-paths.js";
+import { protectedPathAllowPrefixes, taskArtifactPrefixes, } from "../../../shared/protected-paths.js";
 import { GitContext } from "../../shared/git-context.js";
 import { loadCommandContext } from "../../shared/task-backend.js";
 function normalizeAllowPrefixes(prefixes) {
@@ -88,8 +88,19 @@ export async function stageAllowlist(opts) {
         workflowDir: opts.workflowDir,
         taskId: opts.taskId,
     });
-    const effectiveAllow = normalizeAllowPrefixes(opts.allowTasks ? [...allow, ...taskAllow] : allow);
-    if (effectiveAllow.length === 0 || (allow.length === 0 && opts.allowTaskOnly !== true)) {
+    const protectedAllow = protectedPathAllowPrefixes({
+        tasksPath: opts.tasksPath,
+        workflowDir: opts.workflowDir,
+        taskId: opts.taskId,
+        allowTasks: opts.allowTasks,
+        allowPolicy: opts.allowPolicy,
+        allowConfig: opts.allowConfig,
+        allowHooks: opts.allowHooks,
+        allowCI: opts.allowCI,
+    });
+    const effectiveAllow = normalizeAllowPrefixes([...allow, ...protectedAllow]);
+    if (effectiveAllow.length === 0 ||
+        (allow.length === 0 && protectedAllow.length === 0 && opts.allowTaskOnly !== true)) {
         throw new CliError({
             exitCode: 2,
             code: "E_USAGE",

package/dist/commands/guard/impl/commands.d.ts

@@ -15,6 +15,7 @@ export declare function cmdCommit(opts: {
     ctx?: CommandContext;
     cwd: string;
     rootOverride?: string;
+    baseBranchOverride?: string | null;
     taskId: string;
     message: string;
     close: boolean;
@@ -30,5 +31,6 @@ export declare function cmdCommit(opts: {
     quiet: boolean;
     closeUnstageOthers: boolean;
     closeCheckOnly: boolean;
+    closeStageTaskArtifacts?: boolean;
 }): Promise<number>;
 //# sourceMappingURL=commands.d.ts.map

package/dist/commands/guard/impl/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAyLxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmMlB"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/commands.ts"],"names":[],"mappings":"AASA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQvF,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAsOxE,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC,GAAG,OAAO,CAAC,MAAM,CAAC,CAuNlB"}

package/dist/commands/guard/impl/commands.js

@@ -1,3 +1,6 @@
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { resolveTaskIndexPath } from "../../../backends/task-index.js";
 import { mapCoreError } from "../../../cli/error-map.js";
 import { infoMessage, successMessage } from "../../../cli/output.js";
 import { stripAnsi } from "../../../cli/shared/ansi.js";
@@ -25,6 +28,37 @@ const FORMATTER_SIGNAL_PATTERNS = [
     /Run Prettier with --write/i,
 ];
 const ESLINT_SIGNAL_PATTERNS = [/\bESLint\b/i, /\b[0-9]+\s+problems?\b/i];
+async function resetRebuildableTaskIndexCache(ctx) {
+    const gitRoot = path.resolve(ctx.resolvedProject.gitRoot);
+    const workflowDirAbs = path.resolve(gitRoot, ctx.config.paths.workflow_dir);
+    const cachePath = path.resolve(resolveTaskIndexPath(workflowDirAbs));
+    const relativeCachePath = path.relative(gitRoot, cachePath);
+    if (!relativeCachePath || relativeCachePath.startsWith(".."))
+        return;
+    try {
+        await execFileAsync("git", ["ls-files", "--error-unmatch", "--", relativeCachePath], {
+            cwd: gitRoot,
+            env: gitEnv(),
+        });
+        const gitPath = relativeCachePath.split(path.sep).join("/");
+        const cacheBlob = await execFileAsync("git", ["show", `HEAD:${gitPath}`], {
+            cwd: gitRoot,
+            env: gitEnv(),
+        });
+        await mkdir(path.dirname(cachePath), { recursive: true });
+        await writeFile(cachePath, cacheBlob.stdout, "utf8");
+        await execFileAsync("git", ["restore", "--staged", "--", relativeCachePath], {
+            cwd: gitRoot,
+            env: gitEnv(),
+        });
+    }
+    catch {
+        // The task index is a rebuildable cache. If it is absent from HEAD here, remove it so
+        // deterministic close commits only see canonical task artifacts.
+        await rm(cachePath, { force: true });
+    }
+    ctx.git.invalidateStatus();
+}
 function readText(value) {
     if (typeof value === "string")
         return value;
@@ -130,7 +164,12 @@ function commitFailureDiagnostic(phase, output) {
     };
 }
 function hasExplicitCommitScope(opts) {
-    return opts.allow.some((prefix) => prefix.trim().length > 0) || opts.allowTasks;
+    return (opts.allow.some((prefix) => prefix.trim().length > 0) ||
+        opts.allowTasks ||
+        opts.allowPolicy ||
+        opts.allowConfig ||
+        opts.allowHooks ||
+        opts.allowCI);
 }
 function asCommitFailure(err, phase) {
     if (err instanceof Error) {
@@ -237,6 +276,7 @@ export async function cmdCommit(opts) {
         if (opts.close) {
             if (!opts.closeCheckOnly) {
                 await ensureReconciledBeforeMutation({ ctx, command: "commit" });
+                await resetRebuildableTaskIndexCache(ctx);
             }
             // Make the close commit deterministic: start from a clean index unless --unstage-others is used.
             let staged = await ctx.git.statusStagedPaths();
@@ -256,7 +296,7 @@ export async function cmdCommit(opts) {
                     message: "Staged files exist (close commit requires an empty index; rerun with --unstage-others to auto-unstage).",
                     context: withDiagnosticContext({ command: "commit" }, {
                         state: "close commit cannot run with a non-empty git index",
-                        likelyCause: "deterministic close commits only stage the task README, but other staged files are already in the index",
+                        likelyCause: "deterministic close commits only stage the active task artifact scope, but other staged files are already in the index",
                         nextAction: {
                             command: "git restore --staged -- .",
                             reason: "clear the current index before rerunning the close commit flow",
@@ -285,18 +325,30 @@ export async function cmdCommit(opts) {
                 }
                 return 0;
             }
-            await ctx.git.stage([readmeRel]);
+            await (opts.closeStageTaskArtifacts === true
+                ? stageAllowlist({
+                    ctx,
+                    allow: [],
+                    allowTasks: true,
+                    tasksPath: ctx.config.paths.tasks_path,
+                    workflowDir: ctx.config.paths.workflow_dir,
+                    taskId: opts.taskId,
+                    allowTaskOnly: true,
+                    emptyAllowMessage: "No changed task artifacts to stage for the deterministic close commit.",
+                    noMatchMessage: "No changed files matched the active task artifact scope for the deterministic close commit.",
+                })
+                : ctx.git.stage([readmeRel]));
             // Close commits should not require manual --allow flags:
-            // the command stages exactly one task README under workflow_dir.
-            const allow = [ctx.config.paths.workflow_dir];
+            // the command stages only the active task artifact scope.
             await guardCommitCheck({
                 ctx,
                 cwd: opts.cwd,
                 rootOverride: opts.rootOverride,
+                baseBranchOverride: opts.baseBranchOverride ?? null,
                 taskId: opts.taskId,
                 message: msg.subject,
-                allow,
-                allowBase: false,
+                allow: [],
+                allowBase: opts.allowBase,
                 allowTasks: true,
                 allowPolicy: false,
                 allowConfig: false,
@@ -308,7 +360,7 @@ export async function cmdCommit(opts) {
             const env = buildGitCommitEnv({
                 taskId: opts.taskId,
                 allowTasks: true,
-                allowBase: false,
+                allowBase: opts.allowBase,
                 allowPolicy: false,
                 allowConfig: false,
                 allowHooks: false,
@@ -343,12 +395,16 @@ export async function cmdCommit(opts) {
                 ctx,
                 allow: opts.allow,
                 allowTasks: opts.allowTasks,
+                allowPolicy: opts.allowPolicy,
+                allowConfig: opts.allowConfig,
+                allowHooks: opts.allowHooks,
+                allowCI: opts.allowCI,
                 tasksPath: ctx.config.paths.tasks_path,
                 workflowDir: ctx.config.paths.workflow_dir,
                 taskId: opts.taskId,
                 allowTaskOnly: true,
                 emptyAllowMessage: "No staged files and no commit allowlist. Pass --allow <path-prefix>, use --allow-tasks for active task artifacts, or stage files manually.",
-                noMatchMessage: "No changed files matched the commit allowlist (adjust --allow / --allow-tasks or stage files manually).",
+                noMatchMessage: "No changed files matched the commit allowlist (adjust --allow, protected allow flags, or --allow-tasks; otherwise stage files manually).",
             });
             if (!opts.quiet) {
                 process.stdout.write(`${infoMessage(`commit auto-staged ${autoStaged.length} path(s) from allowlist`)}\n`);
@@ -358,6 +414,7 @@ export async function cmdCommit(opts) {
             ctx,
             cwd: opts.cwd,
             rootOverride: opts.rootOverride,
+            baseBranchOverride: opts.baseBranchOverride ?? null,
             taskId: opts.taskId,
             message: opts.message,
             allow: opts.allow,

package/dist/commands/guard/impl/policy.d.ts

@@ -3,6 +3,7 @@ export type GuardCommitOptions = {
     ctx?: CommandContext;
     cwd: string;
     rootOverride?: string;
+    baseBranchOverride?: string | null;
     taskId: string;
     message: string;
     allow: string[];

package/dist/commands/guard/impl/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/policy.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEvF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4C9E"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../src/commands/guard/impl/policy.ts"],"names":[],"mappings":"AAKA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEvF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C9E"}

package/dist/commands/guard/impl/policy.js

@@ -9,13 +9,16 @@ export async function guardCommitCheck(opts) {
     const staged = await ctx.git.statusStagedPaths();
     const unstagedTrackedPaths = opts.requireClean ? await ctx.git.statusUnstagedTrackedPaths() : [];
     const inBranchPr = ctx.config.workflow_mode === "branch_pr";
+    const explicitBaseBranch = opts.baseBranchOverride?.trim();
     const baseBranch = inBranchPr
-        ? await resolveBaseBranch({
-            cwd: opts.cwd,
-            rootOverride: opts.rootOverride ?? null,
-            cliBaseOpt: null,
-            mode: ctx.config.workflow_mode,
-        })
+        ? explicitBaseBranch && explicitBaseBranch.length > 0
+            ? explicitBaseBranch
+            : await resolveBaseBranch({
+                cwd: opts.cwd,
+                rootOverride: opts.rootOverride ?? null,
+                cliBaseOpt: null,
+                mode: ctx.config.workflow_mode,
+            })
         : null;
     const currentBranch = inBranchPr
         ? await gitCurrentBranch(ctx.resolvedProject.gitRoot)