all-hands-cli 0.1.12 → 0.1.14

package/.allhands/skills/harness-maintenance/references/validation-tooling.md

@@ -1,203 +1,157 @@
 # Validation Tooling
 
-Per **Agentic Validation Tooling**, programmatic validation replaces human supervision. This reference covers how validation suites are created, structured, and how they compound from stochastic exploration into deterministic gates.
+Programmatic validation replaces human supervision. Validation suites compound from stochastic exploration into deterministic gates.
 
 ## Crystallization Lifecycle
 
-Per **Agentic Validation Tooling**, validation compounds through a lifecycle:
-
-1. **Stochastic exploration** — Agent-driven exploratory testing using model intuition discovers patterns
+1. **Stochastic exploration** — Agent-driven exploratory testing discovers patterns
 2. **Pattern crystallization** — Discovered patterns become deterministic checks
 3. **CI/CD entrenchment** — Deterministic checks gate releases
 4. **Frontier shift** — Stochastic exploration moves to new unknowns
 
-This is how validation compounds. Every domain has both a stochastic dimension (exploratory) and a deterministic dimension (binary pass/fail).
+Every domain has both a stochastic dimension (exploratory) and a deterministic dimension (binary pass/fail).
 
 ## Suite Existence Threshold
 
-A validation suite must have a meaningful stochastic dimension to justify existing. Deterministic-only tools (type checking, linting, formatting) are test commands referenced directly in acceptance criteria and CI/CD — they are NOT suites.
+A suite must have a meaningful stochastic dimension to justify existing. Deterministic-only tools (type checking, linting, formatting) are test commands in acceptance criteria and CI/CD — they are NOT suites.
 
 ## Repository Agnosticism
 
-This reference file is a generic rule file that ships with the harness. It MUST NOT contain references to project-specific validation suites, commands, or infrastructure. All examples must either:
-- Reference existing default validation suites shipped with this repo (currently: xcode-automation, browser-automation)
-- Use generic/hypothetical descriptions that any target repository can map to their own context
-
-When examples are needed, use **snippets from the existing default suites** rather than naming suites or commands that belong to a specific target project. Target repositories create their own suites for their domains — this file teaches how to create and structure them, not what they should be called.
+This file MUST NOT contain project-specific references. All examples must either reference default suites shipped with this repo (currently: xcode-automation, browser-automation) or use generic descriptions. This file teaches patterns, not inventories.
 
-**Why**: Target repositories consume this file as authoritative guidance. Project-specific references create confusion (agents look for suites that don't exist), couple the harness to a single project, and violate the principle that this file teaches patterns, not inventories. If a pattern needs a concrete example, draw it from xcode-automation or browser-automation.
+Project-specific references cause agents to look for suites that don't exist in target repos and couple the harness to a single project. If a pattern needs a concrete example, draw it from xcode-automation or browser-automation.
 
 ## Creating Validation Tooling
 
 Follow `.allhands/flows/shared/CREATE_VALIDATION_TOOLING_SPEC.md` for the full process. This creates a spec, not an implementation.
 
 ### Research Phase
-- Run `ah tavily search "<validation_type> testing tools"` for available tools
-- Run `ah perplexity research "best practices <validation_type> testing <technology>"` for best practices
+- `ah tavily search "<validation_type> testing tools"` for available tools
+- `ah perplexity research "best practices <validation_type> testing <technology>"` for best practices
 - Determine whether the domain has a meaningful stochastic dimension before proceeding
-- Run `ah tools --list` to check existing MCP integrations
+- `ah tools --list` to check existing MCP integrations
 
 ### Tool Validation Phase
-Per **Agentic Validation Tooling**, research produces assumptions; running the tool produces ground truth:
+Research produces assumptions; running the tool produces ground truth:
 - Install and verify tool responds to `--help`
 - Create a minimal test target (temp directory, not committed)
 - Execute representative stochastic workflows
-- Systematically try commands against codebase-relevant scenarios
+- Try commands against codebase-relevant scenarios
 - Document divergences from researched documentation
 
 ### Suite Writing Philosophy
 
-Per **Frontier Models are Capable** and **Context is Precious**:
-
-- **`--help` as prerequisite**: Suites MUST instruct agents to pull `<tool> --help` before any exploration — command vocabulary shapes exploration quality. The suite MUST NOT replicate full command docs.
-- **Inline command examples**: Weave brief examples into use-case motivations as calibration anchors — not exhaustive catalogs, not separated command reference sections.
-- **Motivation framing**: Frame around harness value: reducing human-in-loop supervision, verifying code quality, confirming implementation matches expectations.
-- **Exploration categories**: Describe with enough command specificity to orient. For untested territory, prefer motivations over prescriptive sequences — the agent extrapolates better from goals than rigid steps. For patterns verified through testing, state them authoritatively (see below).
+- **`--help` as prerequisite**: Suites MUST instruct agents to run `<tool> --help` before exploration. Suites MUST NOT replicate full command docs.
+- **Inline command examples**: Weave brief examples into use-case motivations as calibration anchors — not exhaustive catalogs.
+- **Motivation framing**: Frame around reducing human-in-loop supervision, verifying quality, confirming implementation matches expectations.
+- **Exploration categories**: Enough command specificity to orient. Untested territory: motivations over prescriptive sequences. Verified patterns: state authoritatively.
 
-Formula: **motivations backed by inline command examples + `--help` as prerequisite and progressive disclosure**. Commands woven into use cases give direction; `--help` reveals depth.
+Formula: **motivations + inline command examples + `--help` for progressive disclosure**.
 
 ### Proven vs Untested Guidance
 
-Validation suites should be grounded in hands-on testing against the actual repo, not theoretical instructions. The level of authority in how guidance is written depends on whether it has been verified:
+- **Proven patterns** (verified via Tool Validation Phase): State authoritatively within use-case motivations. Override generic tool docs when they conflict. Example: "`xctrace` requires `--device '<UDID>'` for simulator" is a hard requirement discovered through testing, stated directly alongside the motivation.
+- **Untested edge cases**: Define the motivation and reference analogous solved examples. Do NOT write prescriptive steps for unverified scenarios — frontier models given clear motivation and a reference example extrapolate better than they follow rigid untested instructions.
 
-- **Proven patterns** (verified via the Tool Validation Phase): State authoritatively within use-case motivations — the pattern is established fact, not a suggestion. These override generic tool documentation when they conflict. Example: "`xctrace` requires `--device '<UDID>'` for simulator" is a hard requirement discovered through testing, stated directly alongside the motivation (why: `xctrace` can't find simulator processes without it). The motivation formula still applies — proven patterns are *authoritative examples within motivations*, not raw command catalogs.
-- **Untested edge cases** (not yet exercised in this repo): Define the **motivation** (what the agent should achieve and why) and reference **analogous solved examples** from proven patterns. Do NOT write prescriptive step-by-step instructions for scenarios that haven't been verified — unverified prescriptions can mislead the agent into rigid sequences that don't match reality. Instead, trust that a frontier model given clear motivation and a reference example of how a similar problem was solved will extrapolate the correct approach through stochastic exploration.
-
-**Why this matters**: Frontier models produce emergent, adaptive behavior when given goals and reference points. Unverified prescriptive instructions constrain this emergence and risk encoding incorrect assumptions. Motivation + examples activate the model's reasoning about the problem space; rigid untested instructions bypass it. The Tool Validation Phase exists to convert untested guidance into proven patterns over time — the crystallization lifecycle in action.
+The Tool Validation Phase converts untested guidance into proven patterns over time — the crystallization lifecycle in action.
 
 ### Evidence Capture
 
-Per **Quality Engineering**, two audiences require different artifacts:
-
-- **Agent (self-verification)**: Primitives used during the observe-act-verify loop (state checks, assertions, console output). Real-time, not recorded.
-- **Engineer (review artifacts)**: Trust evidence produced after exploration (recordings, screenshots, traces, reports).
+- **Agent (self-verification)**: State checks, assertions, console output during observe-act-verify. Real-time, not recorded.
+- **Engineer (review artifacts)**: Recordings, screenshots, traces, reports produced after exploration.
 
 Pattern: explore first, capture second.
 
 ## Validation Suite Schema
 
-Run `ah schema validation-suite` for the authoritative schema. Key sections in a suite:
+Run `ah schema validation-suite` for the authoritative schema. Key sections:
 
-- **Stochastic Validation**: Agent-driven exploratory testing with model intuition
+- **Stochastic Validation**: Agent-driven exploratory testing
 - **Deterministic Integration**: Binary pass/fail commands that gate completion
 
-List available suites: `ah validation-tools list`
-
 ## Integration with Prompt Execution
 
-Prompt files reference validation suites in their `validation_suites` frontmatter. During execution:
-1. Agent reads suite's **Stochastic Validation** section during implementation for exploratory quality
-2. Agent runs suite's **Deterministic Integration** section for acceptance criteria gating
+Prompt files reference suites in `validation_suites` frontmatter. During execution:
+1. Agent reads **Stochastic Validation** during implementation
+2. Agent runs **Deterministic Integration** for acceptance criteria gating
 3. Validation review (`PROMPT_VALIDATION_REVIEW.md`) confirms pass/fail
 
 ## Command Documentation Principle
 
-Two categories of commands exist in validation suites, each requiring different documentation approaches:
-
-**External tooling commands — Document explicitly**: Commands from external tools (`xctrace`, `xcrun simctl`, `agent-browser`, `playwright`, `curl`, etc.) are stable, unfamiliar to agents by default, and unlikely to change with codebase evolution. Document specific commands, flags, and use cases inline with motivations. Example from xcode-automation: `xcrun xctrace record --template 'Time Profiler' --device '<UDID>' --attach '<PID>'` — the flags, ordering constraints, and PID discovery method are all external tool knowledge that the suite documents explicitly.
-
-**Internal codebase commands — Document patterns, not inventories**: Project-specific scripts, test commands, and codebase-specific CLI wrappers evolve rapidly. Instead:
-1. **Document core infrastructure commands explicitly** — commands that boot services, manage environments, and are foundational to validation in the target project. These are stable and essential per-project, but suites should teach agents how to discover them (e.g., "check `package.json` scripts" or "run `--help`"), not hardcode specific script names.
-2. **Teach patterns for everything else** — naming conventions, where to discover project commands, what categories mean, and how to build upon them.
-3. **Document motivations** — why different test categories exist, when to use which, what confidence each provides.
-
-Per **Frontier Models are Capable**: An agent given patterns + motivations + discovery instructions outperforms one given stale command inventories. Suites that teach patterns age gracefully; suites that enumerate commands require maintenance on every change.
+- **External tooling** (xctrace, simctl, playwright, etc.) — Document explicitly: commands, flags, use cases inline with motivations. Stable and unfamiliar to agents by default. Example from xcode-automation: `xcrun xctrace record --template 'Time Profiler' --device '<UDID>' --attach '<PID>'` — flags, ordering constraints, and PID discovery are external tool knowledge that belongs in the suite.
+- **Internal codebase commands** — Document patterns, not inventories: teach discovery (`package.json` scripts, `--help`), naming conventions, motivations for test categories. Pattern-based suites age gracefully; command inventories require constant maintenance.
 
 ## Decision Tree Requirement
 
-Every validation suite MUST include a decision tree that routes agents to the correct validation approach based on their situation. Decision trees:
-- Distinguish which instructions are relevant to which validation scenario (e.g., UI-only test vs full E2E with native code changes)
-- Show where/when stochastic vs deterministic testing applies
-- Surface deterministic branch points where other validation suites must be utilized (e.g., "Does this branch have native code changes? → Yes → follow xcode-automation decision tree")
-- Cleanly articulate multiple expected use cases within a single suite
+Every suite MUST include a decision tree routing agents to the correct validation approach:
+- Distinguish relevant instructions per scenario (e.g., UI-only vs full E2E)
+- Show where stochastic vs deterministic testing applies
+- Surface branch points where other suites must be utilized (e.g., "Does this branch have native code changes? → Yes → follow xcode-automation decision tree")
 
-The decision tree replaces flat prerequisite lists with structured routing. An agent reads the tree and follows the branch matching their situation, skipping irrelevant setup and finding the right cross-references.
+The decision tree replaces flat prerequisite lists with structured routing — an agent follows the branch matching their situation, skipping irrelevant setup.
 
 ## tmux Session Management Standard
 
-All suites that require long-running processes (dev servers, Expo servers, Flask API, Metro bundler) MUST use the tmux approach proven in xcode-automation:
+Suites requiring long-running processes MUST use tmux:
 
 ```bash
-# CRITICAL: -t $TMUX_PANE pins split to agent's window, not user's focused window
+# -t $TMUX_PANE pins split to agent's window, not user's focused window
 tmux split-window -h -d -t $TMUX_PANE \
   -c /path/to/repo '<command>'
 ```
 
-**Observability**: Agents MUST verify processes are running correctly via tmux pane capture (`tmux capture-pane -p -t <pane_id>`) before proceeding with validation. This prevents silent failures where a dev server fails to start but the agent proceeds to test against nothing.
-
-**Teardown**: Reverse order of setup. Kill processes via `tmux send-keys -t <pane_id> C-c` or kill the pane.
-
-**Worktree isolation**: Each worktree uses unique ports (via `.env.local`), so tmux sessions in different worktrees don't conflict. Agents must use the correct repo path (`-c`) for the worktree they're operating in.
+- **Observability**: Verify via `tmux capture-pane -p -t <pane_id>` before proceeding
+- **Teardown**: Reverse order. `tmux send-keys -t <pane_id> C-c` or kill the pane
+- **Worktree isolation**: Unique ports per worktree (`.env.local`), correct repo path (`-c`)
 
 Reference xcode-automation as the canonical tmux pattern.
 
 ## Hypothesis-First Validation Workflow
 
-New suites should be drafted, then tested hands-on on a feature branch before guidance is marked as proven. This aligns with the Proven vs Untested Guidance principle:
+New suites: draft, then test on a feature branch before marking guidance as proven.
 
-1. **Draft**: Write suite files based on plan and codebase analysis (mark unverified practices as hypotheses)
-2. **Test on feature branch**: Check out a feature branch and exercise each suite's practices hands-on — boot services, run commands, verify workflows, test worktree isolation
-3. **Verify & adjust**: Document what works, what doesn't, what needs adjustment. Worktree-specific concerns get explicit verification.
-4. **Solidify**: Only after verification do practices become authoritative guidance. Unverified practices stay framed as motivations per the Proven vs Untested Guidance principle.
+1. **Draft**: Write suite based on plan/analysis (mark unverified practices as hypotheses)
+2. **Test on feature branch**: Exercise practices hands-on
+3. **Verify & adjust**: Document what works, what doesn't
+4. **Solidify**: Only verified practices become authoritative guidance
 
-The plan/handoff document persists as the hypothesis record. If implementation runs long, it serves as the handoff document for future work.
+The plan/handoff document persists as the hypothesis record for future work.
 
 ## Cross-Referencing Between Suites
 
-**Reference** when complex multi-step setup is involved (e.g., simulator setup spanning multiple tools) — point to the authoritative suite's decision tree rather than duplicating instructions.
-
-**Inline** when the command is simple and stable (e.g., `xcrun simctl boot <UDID>`) — no need to send agents to another document for a single command.
-
-Decision trees are the natural place for cross-references — branch points that route to another suite's decision tree. Example from browser-automation: "Does the change affect native iOS rendering? → Yes → follow xcode-automation decision tree for build and simulator verification."
-
-## Testing Scenario Matrix
-
-Target repositories should build a scenario matrix mapping their validation scenarios to suite combinations. The matrix documents which suites apply to which types of changes, so agents can quickly determine what validation is needed. Structure as a table:
+- **Reference** for complex multi-step setup — point to the authoritative suite's decision tree
+- **Inline** for simple, stable commands — no redirect needed for a single command
 
-| Scenario | Suite(s) | Notes |
-|----------|----------|-------|
-| _Description of change type_ | _Which suites apply_ | _Any special setup or cross-references_ |
+Decision tree branch points are the natural place for cross-references.
 
-Example using this repo's default suites:
+## Suite Discoverability
 
-| Scenario | Suite(s) | Notes |
-|----------|----------|-------|
-| Browser UI changes only | browser-automation | Dev server must be running |
-| Native iOS/macOS changes | xcode-automation | Simulator setup via session defaults |
-| Cross-platform changes (web + native) | browser-automation + xcode-automation | Each suite's decision tree routes to the relevant validation path |
+Suite discovery is programmatic, not manual. No maintained inventories or mapping tables.
 
-When a suite serves as a shared dependency for multiple scenarios (e.g., a database management suite referenced by both API and front-end suites), it should be cross-referenced via decision tree branch points rather than duplicated.
+- **During creation**: `ah validation-tools list` — check for overlap and cross-reference points before creating a new suite.
+- **During utilization**: Agents run `ah validation-tools list` to discover suites via glob patterns and descriptions. Decision trees handle routing.
 
 ## Environment Management Patterns
 
-Validation suites that depend on environment configuration should document these patterns for their domain:
-
-**ENV injection**: Document how the target project injects environment variables for different contexts (local development, testing, production). Suites should teach the pattern (e.g., "check for `.env.*` files and wrapper scripts") rather than hardcoding specific variable names.
-
-**Service isolation**: When validation requires running services (dev servers, databases, bundlers), document how to avoid port conflicts across concurrent worktrees or parallel agent sessions. Reference the suite's ENV Configuration table for relevant variables.
-
-**Worktree isolation**: Each worktree should use unique ports and isolated service instances where possible. Suites should document which resources need isolation and how to configure it (e.g., xcode-automation documents simulator isolation via dedicated simulator clones and derived data paths).
-
-## Suite Creation Guidance
+Suites depending on environment configuration should document:
 
-When creating a new validation suite for a new domain:
+- **ENV injection**: Teach discovery patterns (e.g., "check `.env.*` files") rather than hardcoding variable names
+- **Service isolation**: How to avoid port conflicts across concurrent worktrees/sessions
+- **Worktree isolation**: Unique ports and isolated service instances per worktree
 
-**Engineer provides**: Testing scenarios, tooling requirements, CI/CD integration needs, cross-references to existing suites.
+## Suite Creation Checklist
 
-**Suite author follows**:
-1. Follow the validation suite schema (`ah schema validation-suite`)
-2. Validate the stochastic dimension meets the existence threshold
-3. Apply the Command Documentation Principle — external tools explicit, internal commands via patterns + discovery
-4. Include a Decision Tree routing agents to the correct validation path
-5. Use tmux Session Management Standard for long-running processes
-6. Document proven vs untested guidance per the Hypothesis-First Validation Workflow
+1. Follow `ah schema validation-suite`
+2. Validate stochastic dimension meets existence threshold
+3. External tools explicit, internal commands via patterns + discovery
+4. Include a Decision Tree
+5. Use tmux standard for long-running processes
+6. Mark proven vs untested guidance
 7. Cross-reference other suites at decision tree branch points
 
-**Structural templates** (reference the existing default suites for patterns):
-- xcode-automation — external-tool-heavy suite (MCP tools, xctrace, simctl). Reference for suites that primarily wrap external CLI tools with agent-driven exploration.
-- browser-automation — dual-dimension suite (agent-browser stochastic, Playwright deterministic). Reference for suites that have both agent-driven exploration and scripted CI-gated tests.
+**Structural templates**: xcode-automation (external-tool-heavy), browser-automation (dual stochastic/deterministic).
 
 ## Related References
 
-- [`tools-commands-mcp-hooks.md`](tools-commands-mcp-hooks.md) — When validation uses hooks, CLI commands, or MCP research tools
-- [`knowledge-compounding.md`](knowledge-compounding.md) — When crystallized patterns need to compound into persistent knowledge
+- [`tools-commands-mcp-hooks.md`](tools-commands-mcp-hooks.md) — Validation using hooks, CLI commands, or MCP tools
+- [`knowledge-compounding.md`](knowledge-compounding.md) — Crystallized patterns compounding into persistent knowledge

package/.internal.json

@@ -29,7 +29,8 @@
     ".reposearch/**",
     "concerns.md",
     "specs/**",
-    ".allhands/docs.local.json"
+    ".allhands/docs.local.json",
+    ".allhands/.sync-state.json"
   ],
   "initOnly": [
     ".allhands/skills/**",

package/bin/sync-cli.js

@@ -4856,9 +4856,9 @@ var Yargs = YargsFactory(esm_default);
 var yargs_default = Yargs;
 
 // src/commands/sync.ts
-import { copyFileSync, existsSync as existsSync9, mkdirSync, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync2, readFileSync as readFileSync9, unlinkSync, writeFileSync as writeFileSync4 } from "fs";
 import { homedir } from "os";
-import { basename as basename4, dirname as dirname7, join as join7, resolve as resolve6 } from "path";
+import { basename as basename4, dirname as dirname8, join as join8, resolve as resolve6 } from "path";
 
 // src/lib/git.ts
 import { execSync, spawnSync } from "child_process";
@@ -4909,6 +4909,14 @@ function getFileBlobHash(filePath, repoPath) {
   const result = git(["hash-object", filePath], repoPath);
   return result.success ? result.stdout.trim() : null;
 }
+function getHeadCommit(repoPath) {
+  const result = git(["rev-parse", "HEAD"], repoPath);
+  return result.success ? result.stdout.trim() : null;
+}
+function hasUncommittedChanges(repoPath) {
+  const result = git(["status", "--porcelain"], repoPath);
+  return result.success && result.stdout.length > 0;
+}
 function fileExistsInHistory(relPath, blobHash, repoPath) {
   const result = git(["rev-list", "HEAD", "--objects", "--", relPath], repoPath);
   if (!result.success || !result.stdout) return false;
@@ -6789,7 +6797,8 @@ function getNextBackupPath(filePath) {
 
 // src/lib/constants.ts
 var SYNC_CONFIG_FILENAME = ".allhands-sync-config.json";
-var PUSH_BLOCKLIST = ["CLAUDE.project.md", ".allhands-sync-config.json"];
+var SYNC_STATE_FILENAME = ".allhands/.sync-state.json";
+var PUSH_BLOCKLIST = ["CLAUDE.project.md", ".allhands-sync-config.json", ".allhands/.sync-state.json"];
 var SYNC_CONFIG_TEMPLATE = {
   $comment: "Customization for claude-all-hands push command",
   includes: [],
@@ -6884,6 +6893,52 @@ function ensureTargetLines(targetRoot, verbose = false) {
   return anyChanged;
 }
 
+// src/lib/sync-state.ts
+import { existsSync as existsSync9, mkdirSync, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname7, join as join7 } from "path";
+function writeSyncState(targetRoot, allhandsRoot, syncedFiles) {
+  const files = {};
+  for (const relPath of [...syncedFiles].sort()) {
+    const sourceFile = join7(allhandsRoot, relPath);
+    if (!existsSync9(sourceFile)) continue;
+    const hash = getFileBlobHash(sourceFile, allhandsRoot);
+    if (hash) {
+      files[relPath] = hash;
+    }
+  }
+  const state = {
+    version: 1,
+    syncedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    sourceCommit: getHeadCommit(allhandsRoot),
+    dirty: hasUncommittedChanges(allhandsRoot),
+    files
+  };
+  const outPath = join7(targetRoot, SYNC_STATE_FILENAME);
+  mkdirSync(dirname7(outPath), { recursive: true });
+  writeFileSync3(outPath, JSON.stringify(state, null, 2) + "\n");
+}
+function readSyncState(targetRoot) {
+  const stateFile = join7(targetRoot, SYNC_STATE_FILENAME);
+  if (!existsSync9(stateFile)) return null;
+  try {
+    const content = readFileSync8(stateFile, "utf-8");
+    const parsed = JSON.parse(content);
+    if (!parsed || typeof parsed !== "object" || parsed.version !== 1 || !parsed.files || typeof parsed.files !== "object") {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function wasModifiedSinceSync(targetFilePath, relPath, syncState, repoPath) {
+  const manifestHash = syncState.files[relPath];
+  if (!manifestHash) return null;
+  const targetHash = getFileBlobHash(targetFilePath, repoPath);
+  if (!targetHash) return true;
+  return targetHash !== manifestHash;
+}
+
 // src/commands/sync.ts
 var AH_SHIM_SCRIPT = `#!/bin/bash
 # AllHands CLI shim - finds and executes project-local .allhands/harness/ah
@@ -6902,34 +6957,34 @@ echo "hint: run 'npx all-hands sync .' to initialize this project" >&2
 exit 1
 `;
 function setupAhShim() {
-  const localBin = join7(homedir(), ".local", "bin");
-  const shimPath = join7(localBin, "ah");
+  const localBin = join8(homedir(), ".local", "bin");
+  const shimPath = join8(localBin, "ah");
   const pathEnv = process.env.PATH || "";
   const inPath = pathEnv.split(":").some(
-    (p) => p === localBin || p === join7(homedir(), ".local/bin")
+    (p) => p === localBin || p === join8(homedir(), ".local/bin")
   );
-  if (existsSync9(shimPath)) {
-    const existing = readFileSync8(shimPath, "utf-8");
+  if (existsSync10(shimPath)) {
+    const existing = readFileSync9(shimPath, "utf-8");
     if (existing.includes(".allhands/harness/ah")) {
       return { installed: false, path: shimPath, inPath };
     }
   }
-  mkdirSync(localBin, { recursive: true });
-  writeFileSync3(shimPath, AH_SHIM_SCRIPT, { mode: 493 });
+  mkdirSync2(localBin, { recursive: true });
+  writeFileSync4(shimPath, AH_SHIM_SCRIPT, { mode: 493 });
   return { installed: true, path: shimPath, inPath };
 }
 async function cmdSync(target = ".", autoYes = false, init = false) {
   const resolvedTarget = resolve6(process.cwd(), target);
   const allhandsRoot = getAllhandsRoot();
-  const targetAllhandsDir = join7(resolvedTarget, ".allhands");
-  const isFirstTime = !existsSync9(targetAllhandsDir);
+  const targetAllhandsDir = join8(resolvedTarget, ".allhands");
+  const isFirstTime = !existsSync10(targetAllhandsDir);
   if (isFirstTime) {
     console.log(`Initializing allhands in: ${resolvedTarget}`);
   } else {
     console.log(`Updating allhands in: ${resolvedTarget}`);
   }
   console.log(`Source: ${allhandsRoot}`);
-  if (!existsSync9(resolvedTarget)) {
+  if (!existsSync10(resolvedTarget)) {
     console.error(`Error: Target directory does not exist: ${resolvedTarget}`);
     return 1;
   }
@@ -6973,15 +7028,15 @@ async function cmdSync(target = ".", autoYes = false, init = false) {
   const conflicts = [];
   const deletedInSource = [];
   for (const relPath of distributable) {
-    const sourceFile = join7(allhandsRoot, relPath);
-    const targetFile = join7(resolvedTarget, relPath);
-    if (!existsSync9(sourceFile)) {
-      if (!isFirstTime && existsSync9(targetFile)) {
+    const sourceFile = join8(allhandsRoot, relPath);
+    const targetFile = join8(resolvedTarget, relPath);
+    if (!existsSync10(sourceFile)) {
+      if (!isFirstTime && existsSync10(targetFile)) {
         deletedInSource.push(relPath);
       }
       continue;
     }
-    if (existsSync9(targetFile)) {
+    if (existsSync10(targetFile)) {
       if (filesAreDifferent(sourceFile, targetFile)) {
         conflicts.push(relPath);
       }
@@ -7002,7 +7057,7 @@ Auto-overwriting ${conflicts.length} conflicting files (--yes mode)`);
     if (resolution === "backup") {
       console.log("\nCreating backups...");
       for (const relPath of conflicts) {
-        const targetFile = join7(resolvedTarget, relPath);
+        const targetFile = join8(resolvedTarget, relPath);
         const bkPath = getNextBackupPath(targetFile);
         copyFileSync(targetFile, bkPath);
         console.log(`  ${relPath} \u2192 ${basename4(bkPath)}`);
@@ -7011,12 +7066,14 @@ Auto-overwriting ${conflicts.length} conflicting files (--yes mode)`);
   }
   console.log("\nCopying allhands files...");
   console.log(`Found ${distributable.size} files to distribute`);
+  const syncedFiles = /* @__PURE__ */ new Set();
   for (const relPath of [...distributable].sort()) {
-    const sourceFile = join7(allhandsRoot, relPath);
-    const targetFile = join7(resolvedTarget, relPath);
-    if (!existsSync9(sourceFile)) continue;
-    mkdirSync(dirname7(targetFile), { recursive: true });
-    if (existsSync9(targetFile)) {
+    const sourceFile = join8(allhandsRoot, relPath);
+    const targetFile = join8(resolvedTarget, relPath);
+    if (!existsSync10(sourceFile)) continue;
+    syncedFiles.add(relPath);
+    mkdirSync2(dirname8(targetFile), { recursive: true });
+    if (existsSync10(targetFile)) {
       if (!filesAreDifferent(sourceFile, targetFile)) {
         skipped++;
         continue;
@@ -7029,6 +7086,7 @@ Auto-overwriting ${conflicts.length} conflicting files (--yes mode)`);
     }
   }
   restoreDotfiles(resolvedTarget);
+  writeSyncState(resolvedTarget, allhandsRoot, syncedFiles);
   if (!isFirstTime && deletedInSource.length > 0) {
     console.log(`
 ${deletedInSource.length} files removed from allhands source:`);
@@ -7038,8 +7096,8 @@ ${deletedInSource.length} files removed from allhands source:`);
     const shouldDelete = autoYes || await confirm("Delete these from target?");
     if (shouldDelete) {
       for (const f of deletedInSource) {
-        const targetFile = join7(resolvedTarget, f);
-        if (existsSync9(targetFile)) {
+        const targetFile = join8(resolvedTarget, f);
+        if (existsSync10(targetFile)) {
           unlinkSync(targetFile);
           console.log(`  Deleted: ${f}`);
         }
@@ -7050,9 +7108,9 @@ ${deletedInSource.length} files removed from allhands source:`);
   const targetLinesUpdated = ensureTargetLines(resolvedTarget, true);
   const envExamples = [".env.example", ".env.ai.example"];
   for (const envExample of envExamples) {
-    const sourceEnv = join7(allhandsRoot, envExample);
-    const targetEnv = join7(resolvedTarget, envExample);
-    if (existsSync9(sourceEnv)) {
+    const sourceEnv = join8(allhandsRoot, envExample);
+    const targetEnv = join8(resolvedTarget, envExample);
+    if (existsSync10(sourceEnv)) {
       console.log(`Copying ${envExample}`);
       copyFileSync(sourceEnv, targetEnv);
     }
@@ -7074,15 +7132,15 @@ ${deletedInSource.length} files removed from allhands source:`);
   }
   let syncConfigCreated = false;
   if (isFirstTime) {
-    const syncConfigPath = join7(resolvedTarget, SYNC_CONFIG_FILENAME);
-    if (existsSync9(syncConfigPath)) {
+    const syncConfigPath = join8(resolvedTarget, SYNC_CONFIG_FILENAME);
+    if (existsSync10(syncConfigPath)) {
       console.log(`
 ${SYNC_CONFIG_FILENAME} already exists - skipping`);
     } else if (!autoYes) {
       console.log("\nThe push command lets you contribute changes back to all-hands.");
       console.log("A sync config file lets you customize which files to include/exclude.");
       if (await confirm(`Create ${SYNC_CONFIG_FILENAME}?`)) {
-        writeFileSync3(syncConfigPath, JSON.stringify(SYNC_CONFIG_TEMPLATE, null, 2) + "\n");
+        writeFileSync4(syncConfigPath, JSON.stringify(SYNC_CONFIG_TEMPLATE, null, 2) + "\n");
         syncConfigCreated = true;
         console.log(`  Created ${SYNC_CONFIG_FILENAME}`);
       }
@@ -7113,21 +7171,21 @@ ${"=".repeat(60)}`);
 }
 
 // src/commands/pull-manifest.ts
-import { existsSync as existsSync10, writeFileSync as writeFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync11, writeFileSync as writeFileSync5 } from "fs";
+import { join as join9 } from "path";
 async function cmdPullManifest() {
   const cwd = process.cwd();
   if (!isGitRepo(cwd)) {
     console.error("Error: Not in a git repository");
     return 1;
   }
-  const configPath = join8(cwd, SYNC_CONFIG_FILENAME);
-  if (existsSync10(configPath)) {
+  const configPath = join9(cwd, SYNC_CONFIG_FILENAME);
+  if (existsSync11(configPath)) {
     console.error(`Error: ${SYNC_CONFIG_FILENAME} already exists`);
     console.error("Remove it first if you want to regenerate");
     return 1;
   }
-  writeFileSync4(configPath, JSON.stringify(SYNC_CONFIG_TEMPLATE, null, 2) + "\n");
+  writeFileSync5(configPath, JSON.stringify(SYNC_CONFIG_TEMPLATE, null, 2) + "\n");
   console.log(`Created ${SYNC_CONFIG_FILENAME}`);
   console.log("\nUsage:");
   console.log('  - Add file paths to "includes" to push additional files');
@@ -7137,9 +7195,9 @@ async function cmdPullManifest() {
 }
 
 // src/commands/push.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync2, readFileSync as readFileSync9, rmSync } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync3, readFileSync as readFileSync10, rmSync } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname8, join as join9 } from "path";
+import { dirname as dirname9, join as join10 } from "path";
 import * as readline2 from "readline";
 
 // src/lib/gh.ts
@@ -7175,12 +7233,12 @@ function getGhUser() {
 
 // src/commands/push.ts
 function loadSyncConfig(cwd) {
-  const configPath = join9(cwd, SYNC_CONFIG_FILENAME);
-  if (!existsSync11(configPath)) {
+  const configPath = join10(cwd, SYNC_CONFIG_FILENAME);
+  if (!existsSync12(configPath)) {
     return null;
   }
   try {
-    const content = readFileSync9(configPath, "utf-8");
+    const content = readFileSync10(configPath, "utf-8");
     return JSON.parse(content);
   } catch (e) {
     throw new Error(`Failed to parse ${SYNC_CONFIG_FILENAME}: ${e instanceof Error ? e.message : String(e)}`);
@@ -7233,8 +7291,12 @@ function checkPrerequisites(cwd) {
   }
   return { success: true, ghUser };
 }
-function wasModifiedByTargetRepo(cwd, relPath, allhandsRoot) {
-  const localFile = join9(cwd, relPath);
+function wasModifiedByTargetRepo(cwd, relPath, allhandsRoot, syncState) {
+  const localFile = join10(cwd, relPath);
+  if (syncState) {
+    const manifestResult = wasModifiedSinceSync(localFile, relPath, syncState, cwd);
+    if (manifestResult !== null) return manifestResult;
+  }
   const localBlobHash = getFileBlobHash(localFile, allhandsRoot);
   if (!localBlobHash) return true;
   return !fileExistsInHistory(relPath, localBlobHash, allhandsRoot);
@@ -7243,6 +7305,7 @@ function collectFilesToPush(cwd, finalIncludes, finalExcludes) {
   const allhandsRoot = getAllhandsRoot();
   const manifest = new Manifest(allhandsRoot);
   const upstreamFiles = manifest.getDistributableFiles();
+  const syncState = readSyncState(cwd);
   const filesToPush = [];
   const localGitFiles = new Set(getGitFiles(cwd));
   const deletedFiles = /* @__PURE__ */ new Set();
@@ -7268,11 +7331,11 @@ function collectFilesToPush(cwd, finalIncludes, finalExcludes) {
     if (!localGitFiles.has(relPath) && !deletedFiles.has(relPath)) {
       continue;
     }
-    const localFile = join9(cwd, relPath);
-    const upstreamFile = join9(allhandsRoot, relPath);
-    if (existsSync11(localFile)) {
+    const localFile = join10(cwd, relPath);
+    const upstreamFile = join10(allhandsRoot, relPath);
+    if (existsSync12(localFile)) {
       if (filesAreDifferent(localFile, upstreamFile)) {
-        if (wasModifiedByTargetRepo(cwd, relPath, allhandsRoot)) {
+        if (wasModifiedByTargetRepo(cwd, relPath, allhandsRoot, syncState)) {
           filesToPush.push({ path: relPath, type: "M" });
         }
       }
@@ -7287,9 +7350,9 @@ function collectFilesToPush(cwd, finalIncludes, finalExcludes) {
       if (PUSH_BLOCKLIST.includes(relPath)) continue;
       if (finalExcludes.some((p) => minimatch(relPath, p, { dot: true }))) continue;
       if (filesToPush.some((f) => f.path === relPath)) continue;
-      const localFile = join9(cwd, relPath);
-      const upstreamFile = join9(allhandsRoot, relPath);
-      if (existsSync11(upstreamFile) && !filesAreDifferent(localFile, upstreamFile)) {
+      const localFile = join10(cwd, relPath);
+      const upstreamFile = join10(allhandsRoot, relPath);
+      if (existsSync12(upstreamFile) && !filesAreDifferent(localFile, upstreamFile)) {
         continue;
       }
       filesToPush.push({ path: relPath, type: "A" });
@@ -7322,8 +7385,8 @@ async function createPullRequest(cwd, ghUser, filesToPush, title, body) {
       return 1;
     }
   }
-  const tempDir = join9(tmpdir(), `allhands-push-${Date.now()}`);
-  mkdirSync2(tempDir, { recursive: true });
+  const tempDir = join10(tmpdir(), `allhands-push-${Date.now()}`);
+  mkdirSync3(tempDir, { recursive: true });
   try {
     console.log("Cloning fork...");
     const cloneResult = gh(["repo", "clone", `${ghUser}/${repoName}`, tempDir, "--", "--depth=1"]);
@@ -7354,9 +7417,9 @@ async function createPullRequest(cwd, ghUser, filesToPush, title, body) {
       if (file.type === "D") {
         git(["rm", "--ignore-unmatch", file.path], tempDir);
       } else {
-        const src = join9(cwd, file.path);
-        const dest = join9(tempDir, file.path);
-        mkdirSync2(dirname8(dest), { recursive: true });
+        const src = join10(cwd, file.path);
+        const dest = join10(tempDir, file.path);
+        mkdirSync3(dirname9(dest), { recursive: true });
         copyFileSync2(src, dest);
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "all-hands-cli",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Agentic harness for model-first software development",
   "type": "module",
   "bin": {

package/src/commands/push.ts

@@ -9,6 +9,7 @@ import { Manifest, filesAreDifferent } from '../lib/manifest.js';
 import { getAllhandsRoot, UPSTREAM_REPO } from '../lib/paths.js';
 import { askQuestion, confirm } from '../lib/ui.js';
 import { PUSH_BLOCKLIST, SYNC_CONFIG_FILENAME } from '../lib/constants.js';
+import { readSyncState, wasModifiedSinceSync, SyncState } from '../lib/sync-state.js';
 
 interface SyncConfig {
   includes?: string[];
@@ -98,12 +99,25 @@ function checkPrerequisites(cwd: string): PrerequisiteResult {
  * Determine if a file was actually modified by the target repo,
  * vs simply being out of date because upstream moved forward.
  *
- * Compares the target file's content against all historical versions
- * in the upstream repo. If it matches any previous version, the target
- * repo hasn't modified it.
+ * Prefers the sync-state manifest (written during sync) which records the
+ * exact blob hash of each source file at sync time. Falls back to git
+ * history search for repos synced before the manifest existed.
  */
-function wasModifiedByTargetRepo(cwd: string, relPath: string, allhandsRoot: string): boolean {
+function wasModifiedByTargetRepo(
+  cwd: string,
+  relPath: string,
+  allhandsRoot: string,
+  syncState: SyncState | null
+): boolean {
   const localFile = join(cwd, relPath);
+
+  // Prefer manifest check when available
+  if (syncState) {
+    const manifestResult = wasModifiedSinceSync(localFile, relPath, syncState, cwd);
+    if (manifestResult !== null) return manifestResult;
+  }
+
+  // Fall back to git history for legacy repos or files not in manifest
   const localBlobHash = getFileBlobHash(localFile, allhandsRoot);
 
   if (!localBlobHash) return true; // safe default: assume modified on error
@@ -119,6 +133,7 @@ function collectFilesToPush(
   const allhandsRoot = getAllhandsRoot();
   const manifest = new Manifest(allhandsRoot);
   const upstreamFiles = manifest.getDistributableFiles();
+  const syncState = readSyncState(cwd);
   const filesToPush: FileEntry[] = [];
 
   // Get non-ignored files in user's repo (respects .gitignore)
@@ -156,7 +171,7 @@ function collectFilesToPush(
 
     if (existsSync(localFile)) {
       if (filesAreDifferent(localFile, upstreamFile)) {
-        if (wasModifiedByTargetRepo(cwd, relPath, allhandsRoot)) {
+        if (wasModifiedByTargetRepo(cwd, relPath, allhandsRoot, syncState)) {
           filesToPush.push({ path: relPath, type: 'M' });
         }
       }

package/src/commands/sync.ts

@@ -8,6 +8,7 @@ import { ConflictResolution, askConflictResolution, confirm, getNextBackupPath }
 import { SYNC_CONFIG_FILENAME, SYNC_CONFIG_TEMPLATE } from '../lib/constants.js';
 import { restoreDotfiles } from '../lib/dotfiles.js';
 import { ensureTargetLines } from '../lib/target-lines.js';
+import { writeSyncState } from '../lib/sync-state.js';
 
 const AH_SHIM_SCRIPT = `#!/bin/bash
 # AllHands CLI shim - finds and executes project-local .allhands/harness/ah
@@ -169,12 +170,16 @@ export async function cmdSync(target: string = '.', autoYes: boolean = false, in
   console.log('\nCopying allhands files...');
   console.log(`Found ${distributable.size} files to distribute`);
 
+  const syncedFiles = new Set<string>();
+
   for (const relPath of [...distributable].sort()) {
     const sourceFile = join(allhandsRoot, relPath);
     const targetFile = join(resolvedTarget, relPath);
 
     if (!existsSync(sourceFile)) continue;
 
+    syncedFiles.add(relPath);
+
     mkdirSync(dirname(targetFile), { recursive: true });
 
     if (existsSync(targetFile)) {
@@ -193,6 +198,9 @@ export async function cmdSync(target: string = '.', autoYes: boolean = false, in
   // Restore dotfiles (gitignore → .gitignore, etc.)
   restoreDotfiles(resolvedTarget);
 
+  // Write sync-state manifest for push false-positive detection
+  writeSyncState(resolvedTarget, allhandsRoot, syncedFiles);
+
   // Update-only: Handle deleted files
   if (!isFirstTime && deletedInSource.length > 0) {
     console.log(`\n${deletedInSource.length} files removed from allhands source:`);

package/src/lib/constants.ts

@@ -1,7 +1,8 @@
 export const SYNC_CONFIG_FILENAME = '.allhands-sync-config.json';
+export const SYNC_STATE_FILENAME = '.allhands/.sync-state.json';
 
 // Files that should never be pushed back to upstream
-export const PUSH_BLOCKLIST = ['CLAUDE.project.md', '.allhands-sync-config.json'];
+export const PUSH_BLOCKLIST = ['CLAUDE.project.md', '.allhands-sync-config.json', '.allhands/.sync-state.json'];
 
 export const SYNC_CONFIG_TEMPLATE = {
   $comment: 'Customization for claude-all-hands push command',

package/src/lib/git.ts

@@ -70,6 +70,22 @@ export function getFileBlobHash(filePath: string, repoPath: string): string | nu
   return result.success ? result.stdout.trim() : null;
 }
 
+/**
+ * Get the HEAD commit hash of a repo. Returns null if no commits exist.
+ */
+export function getHeadCommit(repoPath: string): string | null {
+  const result = git(['rev-parse', 'HEAD'], repoPath);
+  return result.success ? result.stdout.trim() : null;
+}
+
+/**
+ * Check if a repo has uncommitted changes (staged or unstaged).
+ */
+export function hasUncommittedChanges(repoPath: string): boolean {
+  const result = git(['status', '--porcelain'], repoPath);
+  return result.success && result.stdout.length > 0;
+}
+
 /**
  * Check if a specific blob hash appears in the git history of a file path.
  * Uses a single `rev-list --objects` call instead of per-commit lookups.

package/src/lib/sync-state.ts

@@ -0,0 +1,93 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { getFileBlobHash } from './git.js';
+import { getHeadCommit, hasUncommittedChanges } from './git.js';
+import { SYNC_STATE_FILENAME } from './constants.js';
+
+export interface SyncState {
+  version: 1;
+  syncedAt: string;
+  sourceCommit: string | null;
+  dirty: boolean;
+  files: Record<string, string>;
+}
+
+/**
+ * Write a sync-state manifest recording the blob hash of each synced file.
+ * This allows push to detect whether a target file was modified locally
+ * without relying on git history (which fails for uncommitted working-tree copies).
+ */
+export function writeSyncState(
+  targetRoot: string,
+  allhandsRoot: string,
+  syncedFiles: Set<string>
+): void {
+  const files: Record<string, string> = {};
+
+  for (const relPath of [...syncedFiles].sort()) {
+    const sourceFile = join(allhandsRoot, relPath);
+    if (!existsSync(sourceFile)) continue;
+    const hash = getFileBlobHash(sourceFile, allhandsRoot);
+    if (hash) {
+      files[relPath] = hash;
+    }
+  }
+
+  const state: SyncState = {
+    version: 1,
+    syncedAt: new Date().toISOString(),
+    sourceCommit: getHeadCommit(allhandsRoot),
+    dirty: hasUncommittedChanges(allhandsRoot),
+    files,
+  };
+
+  const outPath = join(targetRoot, SYNC_STATE_FILENAME);
+  mkdirSync(dirname(outPath), { recursive: true });
+  writeFileSync(outPath, JSON.stringify(state, null, 2) + '\n');
+}
+
+/**
+ * Read the sync-state manifest from a target repo.
+ * Returns null if the manifest does not exist or cannot be parsed.
+ */
+export function readSyncState(targetRoot: string): SyncState | null {
+  const stateFile = join(targetRoot, SYNC_STATE_FILENAME);
+  if (!existsSync(stateFile)) return null;
+  try {
+    const content = readFileSync(stateFile, 'utf-8');
+    const parsed = JSON.parse(content);
+    if (
+      !parsed ||
+      typeof parsed !== 'object' ||
+      parsed.version !== 1 ||
+      !parsed.files ||
+      typeof parsed.files !== 'object'
+    ) {
+      return null;
+    }
+    return parsed as SyncState;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check whether a target file was modified since the last sync.
+ * Returns null if the file is not in the manifest (caller should fall back).
+ * Returns true if the target's hash differs from the manifest.
+ * Returns false if the target's hash matches the manifest.
+ */
+export function wasModifiedSinceSync(
+  targetFilePath: string,
+  relPath: string,
+  syncState: SyncState,
+  repoPath: string
+): boolean | null {
+  const manifestHash = syncState.files[relPath];
+  if (!manifestHash) return null;
+
+  const targetHash = getFileBlobHash(targetFilePath, repoPath);
+  if (!targetHash) return true; // safe default: assume modified on error
+
+  return targetHash !== manifestHash;
+}