cclaw-cli 6.8.0 → 6.10.0

package/dist/early-loop.js

@@ -137,9 +137,23 @@ export function parseEarlyLoopLog(text, options = {}) {
                 continue;
             }
         }
+        // v6.9.0 schema repair: legacy logs may carry rows with no runId
+        // (the prior parser silently coerced them to "active", which then
+        // collided across runs). Surface a structured warning on read but
+        // skip the row so derived status doesn't fold cross-run state.
+        // Writers must always provide a runId (enforced upstream in the
+        // CLI/hook surface).
+        if (runId.length === 0) {
+            issues?.push({
+                lineNumber,
+                reason: "missing-runId: legacy entry skipped to avoid cross-run pollution",
+                rawLine: raw
+            });
+            continue;
+        }
         entries.push({
             ts: normalizeText(parsed.ts, ""),
-            runId: runId.length > 0 ? runId : "active",
+            runId,
             stage: stage.length > 0 ? stage : "brainstorm",
             iteration,
             concerns,

package/dist/gate-evidence.js

@@ -9,8 +9,8 @@ import { readDelegationLedger } from "./delegation.js";
 import { exists } from "./fs-utils.js";
 import { computeEarlyLoopStatus, isEarlyLoopStage, normalizeEarlyLoopMaxIterations } from "./early-loop.js";
 import { detectPublicApiChanges } from "./internal/detect-public-api-changes.js";
+import { detectSupplyChainChanges } from "./internal/detect-supply-chain-changes.js";
 import { readFlowState, writeFlowState } from "./runs.js";
-import { parseTddCycleLog, validateTddCycleOrder } from "./tdd-cycle.js";
 import { validateTddVerificationEvidence } from "./tdd-verification-evidence.js";
 async function currentStageArtifactExists(projectRoot, stage, track) {
     const resolved = await resolveArtifactPath(stage, {
@@ -376,35 +376,20 @@ export async function verifyCurrentStageGateEvidence(projectRoot, flowState, opt
         }
         if (stage === "tdd") {
             const docsDriftDetection = await detectPublicApiChanges(projectRoot);
-            if (docsDriftDetection.triggered) {
+            const supplyChainDetection = await detectSupplyChainChanges(projectRoot);
+            if (docsDriftDetection.triggered || supplyChainDetection.triggered) {
                 const ledger = await readDelegationLedger(projectRoot);
                 const hasDocUpdaterCompletion = ledger.entries.some((entry) => entry.runId === flowState.activeRunId &&
                     entry.stage === "tdd" &&
                     entry.agent === "doc-updater" &&
                     entry.status === "completed");
                 if (!hasDocUpdaterCompletion) {
-                    issues.push(`tdd docs drift gate blocked (tdd_docs_drift_check): public surface changes detected (${docsDriftDetection.changedFiles.join(", ")}) but no completed doc-updater delegation exists for the active run.`);
-                }
-            }
-            const tddLogPath = path.join(projectRoot, RUNTIME_ROOT, "state", "tdd-cycle-log.jsonl");
-            if (await exists(tddLogPath)) {
-                try {
-                    const tddLogRaw = await fs.readFile(tddLogPath, "utf8");
-                    const parsedCycles = parseTddCycleLog(tddLogRaw);
-                    const tddOrderValidation = validateTddCycleOrder(parsedCycles, {
-                        runId: flowState.activeRunId
-                    });
-                    if (!tddOrderValidation.ok) {
-                        const details = [...tddOrderValidation.issues];
-                        if (tddOrderValidation.openRedSlices.length > 0) {
-                            details.push(`open red slices: ${tddOrderValidation.openRedSlices.join(", ")}`);
-                        }
-                        issues.push(`tdd cycle order gate blocked: ${details.join("; ")}`);
+                    if (docsDriftDetection.triggered) {
+                        issues.push(`tdd docs drift gate blocked (tdd_docs_drift_check): public surface changes detected (${docsDriftDetection.changedFiles.join(", ")}) but no completed doc-updater delegation exists for the active run.`);
+                    }
+                    if (supplyChainDetection.triggered) {
+                        issues.push(`tdd docs drift gate blocked (tdd_docs_drift_check): supply-chain changes detected (${supplyChainDetection.changedFiles.join(", ")}) but no completed doc-updater delegation exists for the active run.`);
                     }
-                }
-                catch (err) {
-                    const reason = err instanceof Error ? err.message : String(err);
-                    issues.push(`tdd cycle order gate blocked: unable to read tdd-cycle-log.jsonl (${reason}).`);
                 }
             }
         }
@@ -477,6 +462,13 @@ export async function verifyCurrentStageGateEvidence(projectRoot, flowState, opt
             forcingPending: floor.forcingPending,
             noNewDecisions: floor.noNewDecisions
         };
+        // v6.9.0 — when the QA log floor is blocking, mirror that decision into
+        // `gates.issues` so the harness has a single structured source of truth
+        // for "this stage is blocked". The `qa_log_unconverged` linter rule
+        // remains the verbose detail/fallback channel.
+        if (qaLogFloor.blocking) {
+            issues.push(`qa log floor blocked (qa_log_unconverged): ${qaLogFloor.count}/${qaLogFloor.min} entries on stage "${stage}" (track=${flowState.track}, discoveryMode=${flowState.discoveryMode ?? "default"}). Continue elicitation or pass --skip-questions to record the stop.`);
+        }
     }
     return {
         ok: issues.length === 0,

package/dist/harness-adapters.js

@@ -293,9 +293,11 @@ export function harnessesByTier() {
     });
 }
 function ironLawsAgentsMdBlock() {
+    // v6.9.0: keep this set in sync with `ironLawsSkillMarkdown()` —
+    // post-Phase A, only `stop-clean-or-handoff` is still hook-enforced
+    // (Stop hook). All other iron laws live in stage HARD-GATE blocks.
     const enforcedLawIds = new Set([
-        "stop-clean-or-handoff",
-        "review-coverage-complete-before-ship"
+        "stop-clean-or-handoff"
     ]);
     const enforcedRows = IRON_LAWS
         .filter((law) => enforcedLawIds.has(law.id))

package/dist/install.js

@@ -38,8 +38,6 @@ import { FLOW_STAGES } from "./types.js";
 const OPENCODE_PLUGIN_REL_PATH = ".opencode/plugins/cclaw-plugin.mjs";
 const CURSOR_RULE_REL_PATH = ".cursor/rules/cclaw-workflow.mdc";
 const CURSOR_GUIDELINES_REL_PATH = ".cursor/rules/cclaw-guidelines.mdc";
-const GIT_HOOK_MANAGED_MARKER = "cclaw-managed-git-hook";
-const GIT_HOOK_RUNTIME_REL_DIR = `${RUNTIME_ROOT}/hooks/git`;
 const INIT_SENTINEL_FILE = ".init-in-progress";
 const execFileAsync = promisify(execFile);
 function runtimePath(projectRoot, ...segments) {
@@ -145,13 +143,17 @@ const DEPRECATED_COMMAND_FILES = [
 const DEPRECATED_SKILL_FILES = [
     ["flow-finish", "SKILL.md"],
     ["flow-ops", "SKILL.md"],
-    ["tdd-cycle-log", "SKILL.md"],
     ["flow-retro", "SKILL.md"],
     ["flow-compound", "SKILL.md"],
     ["flow-archive", "SKILL.md"],
     ["flow-rewind", "SKILL.md"],
     ["using-git-worktrees", "SKILL.md"]
 ];
+// Skill folders whose entire directory should be removed on sync so the
+// abandoned tree doesn't linger in user projects.
+const DEPRECATED_SKILL_FOLDERS_FULL = [
+    "tdd-cycle-log"
+];
 const DEPRECATED_STATE_FILES = [
     "checkpoint.json",
     "flow-state.snapshot.json",
@@ -161,7 +163,10 @@ const DEPRECATED_STATE_FILES = [
     "harness-gaps.json",
     "context-mode.json",
     "session-digest.md",
-    "context-warnings.jsonl"
+    "context-warnings.jsonl",
+    // Runtime Honesty 6.9.0 removed the per-run TDD cycle JSONL: gate evidence
+    // now reads cycle phase progression directly from the artifact table.
+    "tdd-cycle-log.jsonl"
 ];
 const DEPRECATED_HOOK_FILES = [
     "observe.sh",
@@ -193,225 +198,33 @@ async function resolveGitHooksDir(projectRoot) {
         return null;
     }
 }
-function managedGitRuntimeScript(hookName) {
-    return `#!/usr/bin/env node
-// ${GIT_HOOK_MANAGED_MARKER}: runtime ${hookName}
-import fs from "node:fs";
-import path from "node:path";
-import process from "node:process";
-import { spawnSync } from "node:child_process";
-
-const HOOK_NAME = ${JSON.stringify(hookName)};
-const RUNTIME_ROOT = ${JSON.stringify(RUNTIME_ROOT)};
-
-function runGit(args, cwd) {
-  const result = spawnSync("git", args, {
-    cwd,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  return {
-    status: typeof result.status === "number" ? result.status : 1,
-    stdout: typeof result.stdout === "string" ? result.stdout : ""
-  };
-}
-
-function resolveRepoRoot() {
-  const result = runGit(["rev-parse", "--show-toplevel"], process.cwd());
-  if (result.status === 0) {
-    const root = result.stdout.trim();
-    if (root.length > 0) return root;
-  }
-  return process.cwd();
-}
-
-function isZeroSha(value) {
-  return /^0{40,64}$/u.test(value);
-}
-
-function readStdin() {
-  try {
-    return fs.readFileSync(0, "utf8");
-  } catch {
-    return "";
-  }
-}
-
-function uniqueLines(chunks) {
-  return [...new Set(chunks
-    .join("\n")
-    .split(/\r?\n/gu)
-    .map((line) => line.trim())
-    .filter((line) => line.length > 0))].join("\n");
-}
-
-function diffNames(root, range) {
-  const result = runGit(["diff", "--name-only", range], root);
-  return result.status === 0 ? result.stdout : "";
-}
-
-function changedFilesFromUnpushedCommits(root, localSha = "HEAD") {
-  const revList = runGit(["rev-list", "--reverse", localSha, "--not", "--remotes"], root);
-  if (revList.status !== 0 || revList.stdout.trim().length === 0) {
-    return "";
-  }
-  const chunks = [];
-  for (const commit of revList.stdout.split(/\r?\n/gu).map((line) => line.trim()).filter(Boolean)) {
-    const diffTree = runGit(["diff-tree", "--no-commit-id", "--name-only", "-r", "--root", commit], root);
-    if (diffTree.status === 0) chunks.push(diffTree.stdout);
-  }
-  return uniqueLines(chunks);
-}
-
-function changedFilesFromPrePushStdin(root, stdin) {
-  const chunks = [];
-  for (const rawLine of stdin.split(/\r?\n/gu)) {
-    const parts = rawLine.trim().split(/\s+/u);
-    if (parts.length < 4) continue;
-    const [localRef, localSha, remoteRef, remoteSha] = parts;
-    void localRef;
-    void remoteRef;
-    if (!localSha || isZeroSha(localSha)) continue;
-    if (remoteSha && !isZeroSha(remoteSha)) {
-      chunks.push(diffNames(root, remoteSha + ".." + localSha));
-      continue;
-    }
-    const upstream = runGit(["rev-parse", "--verify", "--quiet", "@{upstream}"], root);
-    if (upstream.status === 0 && upstream.stdout.trim().length > 0) {
-      chunks.push(diffNames(root, upstream.stdout.trim() + ".." + localSha));
-      continue;
-    }
-    chunks.push(changedFilesFromUnpushedCommits(root, localSha));
-  }
-  return uniqueLines(chunks);
-}
-
-function resolveChangedFiles(root) {
-  if (HOOK_NAME === "pre-commit") {
-    const result = runGit(["diff", "--cached", "--name-only"], root);
-    return result.status === 0 ? result.stdout : "";
-  }
-  const stdinChanged = changedFilesFromPrePushStdin(root, readStdin());
-  if (stdinChanged.length > 0) {
-    return stdinChanged;
-  }
-  const upstreamResult = runGit(["diff", "--name-only", "@{upstream}..HEAD"], root);
-  if (upstreamResult.status === 0) {
-    return upstreamResult.stdout;
-  }
-  const unpushed = changedFilesFromUnpushedCommits(root);
-  if (unpushed.length > 0) {
-    return unpushed;
-  }
-  const fallback = runGit(["diff", "--name-only", "HEAD~1...HEAD"], root);
-  return fallback.status === 0 ? fallback.stdout : "";
-}
-
-const root = resolveRepoRoot();
-const runtimeHook = path.join(root, RUNTIME_ROOT, "hooks", "run-hook.mjs");
-if (!fs.existsSync(runtimeHook)) {
-  // cclaw git relay is installed but the runtime entrypoint is missing —
-  // warn visibly (without blocking the commit) so the drift is noticed.
-  process.stderr.write(
-    "[cclaw] " + HOOK_NAME + ": " + runtimeHook + " not found; run \`cclaw sync\` to reinstall\\n"
-  );
-  process.exit(0);
-}
-
-const changedFiles = resolveChangedFiles(root)
-  .split(/\\r?\\n/gu)
-  .map((line) => line.trim())
-  .filter((line) => line.length > 0);
-if (changedFiles.length === 0) {
-  process.exit(0);
-}
-
-const payload = JSON.stringify({
-  tool_name: "Write",
-  tool_input: {
-    path: changedFiles.join("\\n"),
-    paths: changedFiles
-  }
-});
-
-  const result = spawnSync(process.execPath, [runtimeHook, "prompt-guard"], {
-  cwd: root,
-  env: process.env,
-  input: payload,
-  encoding: "utf8",
-  stdio: ["pipe", "ignore", "inherit"]
-});
-process.exit(typeof result.status === "number" ? result.status : 1);
-`;
-}
-function managedGitRelayHook(hookName) {
-    return `#!/usr/bin/env node
-// ${GIT_HOOK_MANAGED_MARKER}: relay ${hookName}
-import fs from "node:fs";
-import path from "node:path";
-import process from "node:process";
-import { spawn, spawnSync } from "node:child_process";
-
-const RUNTIME_REL_DIR = ${JSON.stringify(GIT_HOOK_RUNTIME_REL_DIR)};
-const HOOK_NAME = ${JSON.stringify(hookName)};
-
-function resolveRepoRoot() {
-  const result = spawnSync("git", ["rev-parse", "--show-toplevel"], {
-    cwd: process.cwd(),
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"]
-  });
-  if (typeof result.status === "number" && result.status === 0) {
-    const root = (result.stdout || "").trim();
-    if (root.length > 0) return root;
-  }
-  return process.cwd();
-}
-
-const root = resolveRepoRoot();
-const runtimeHook = path.join(root, RUNTIME_REL_DIR, HOOK_NAME + ".mjs");
-if (!fs.existsSync(runtimeHook)) {
-  process.exit(0);
-}
-
-const child = spawn(process.execPath, [runtimeHook, ...process.argv.slice(2)], {
-  cwd: root,
-  env: process.env,
-  stdio: "inherit"
-});
-child.on("error", () => process.exit(1));
-child.on("close", (code, signal) => {
-  process.exit(signal ? 1 : typeof code === "number" ? code : 1);
-});
-`;
-}
-async function removeManagedGitHookRelays(projectRoot) {
+// Legacy cleanup: prior versions installed Node-based git pre-commit/pre-push relays
+// under .git/hooks/* and a runtime tree at .cclaw/hooks/git/. Runtime Honesty 6.9.0
+// removed managed git hooks entirely; the cleanup below stays so existing installs
+// shed the leftover files on next sync/uninstall.
+const LEGACY_GIT_HOOK_MANAGED_MARKER = "cclaw-managed-git-hook";
+const LEGACY_GIT_HOOK_RUNTIME_REL_DIR = `${RUNTIME_ROOT}/hooks/git`;
+async function cleanupLegacyManagedGitHookRelays(projectRoot) {
     const hooksDir = await resolveGitHooksDir(projectRoot);
-    if (!hooksDir) {
-        return;
-    }
-    for (const hookName of ["pre-commit", "pre-push"]) {
-        const hookPath = path.join(hooksDir, hookName);
-        if (!(await exists(hookPath)))
-            continue;
-        let content = "";
-        try {
-            content = await fs.readFile(hookPath, "utf8");
-        }
-        catch {
-            content = "";
-        }
-        if (!content.includes(GIT_HOOK_MANAGED_MARKER)) {
-            continue;
+    if (hooksDir) {
+        for (const hookName of ["pre-commit", "pre-push"]) {
+            const hookPath = path.join(hooksDir, hookName);
+            if (!(await exists(hookPath)))
+                continue;
+            let content = "";
+            try {
+                content = await fs.readFile(hookPath, "utf8");
+            }
+            catch {
+                content = "";
+            }
+            if (!content.includes(LEGACY_GIT_HOOK_MANAGED_MARKER))
+                continue;
+            await fs.rm(hookPath, { force: true });
         }
-        await fs.rm(hookPath, { force: true });
     }
-}
-async function syncManagedGitHooks(projectRoot, config) {
-    void config;
-    await removeManagedGitHookRelays(projectRoot);
     try {
-        await fs.rm(path.join(projectRoot, GIT_HOOK_RUNTIME_REL_DIR), { recursive: true, force: true });
+        await fs.rm(path.join(projectRoot, LEGACY_GIT_HOOK_RUNTIME_REL_DIR), { recursive: true, force: true });
     }
     catch {
         // best-effort cleanup
@@ -1021,6 +834,9 @@ async function cleanLegacyArtifacts(projectRoot) {
     for (const legacyFolder of DEPRECATED_STAGE_SKILL_FOLDERS) {
         await removeBestEffort(runtimePath(projectRoot, "skills", legacyFolder), true);
     }
+    for (const legacyFolder of DEPRECATED_SKILL_FOLDERS_FULL) {
+        await removeBestEffort(runtimePath(projectRoot, "skills", legacyFolder), true);
+    }
     for (const legacyAgentFile of DEPRECATED_AGENT_FILES) {
         await removeBestEffort(runtimePath(projectRoot, "agents", legacyAgentFile));
     }
@@ -1173,7 +989,7 @@ async function materializeRuntime(projectRoot, config, forceStateReset, operatio
         await ensureKnowledgeStore(projectRoot);
         await writeHooks(projectRoot, config);
         await syncDisabledHarnessArtifacts(projectRoot, harnesses);
-        await syncManagedGitHooks(projectRoot, config);
+        await cleanupLegacyManagedGitHookRelays(projectRoot);
         await syncHarnessShims(projectRoot, harnesses);
         await assertExpectedHarnessShims(projectRoot, harnesses);
         await writeCursorWorkflowRule(projectRoot, harnesses);
@@ -1401,7 +1217,7 @@ export async function uninstallCclaw(projectRoot) {
     }
     await removeCclawFromAgentsMd(projectRoot);
     await removeGitignorePatterns(projectRoot);
-    await removeManagedGitHookRelays(projectRoot);
+    await cleanupLegacyManagedGitHookRelays(projectRoot);
     const hookFiles = [
         ".claude/hooks/hooks.json",
         ".cursor/hooks.json",

package/dist/internal/advance-stage.js

@@ -14,7 +14,9 @@ import { parseAdvanceStageArgs, parseCancelRunArgs, parseHookArgs, parseRewindAr
 import { parseFlowStateRepairArgs, runFlowStateRepair } from "./flow-state-repair.js";
 import { parseWaiverGrantArgs, runWaiverGrant } from "./waiver-grant.js";
 import { FlowStateGuardMismatchError, verifyFlowStateGuard } from "../run-persistence.js";
-import { DelegationTimestampError, DispatchDuplicateError } from "../delegation.js";
+import { DelegationTimestampError, DispatchCapError, DispatchDuplicateError, DispatchOverlapError } from "../delegation.js";
+import { parseTddSliceRecordArgs, runTddSliceRecord } from "../tdd-slices.js";
+import { parsePlanSplitWavesArgs, runPlanSplitWaves } from "./plan-split-waves.js";
 /**
  * Subcommands that mutate or consult flow-state.json via the CLI runtime.
  * They all require the sha256 sidecar to match before continuing so a
@@ -32,7 +34,7 @@ const GUARD_ENFORCED_SUBCOMMANDS = new Set([
 export async function runInternalCommand(projectRoot, argv, io) {
     const [subcommand, ...tokens] = argv;
     if (!subcommand) {
-        io.stderr.write("cclaw internal requires a subcommand: advance-stage | start-flow | cancel-run | rewind | verify-flow-state-diff | verify-current-state | envelope-validate | tdd-red-evidence | tdd-loop-status | early-loop-status | compound-readiness | runtime-integrity | hook | flow-state-repair | waiver-grant\n");
+        io.stderr.write("cclaw internal requires a subcommand: advance-stage | start-flow | cancel-run | rewind | verify-flow-state-diff | verify-current-state | envelope-validate | tdd-red-evidence | tdd-loop-status | tdd-slice-record | early-loop-status | compound-readiness | runtime-integrity | hook | flow-state-repair | waiver-grant | plan-split-waves\n");
         return 1;
     }
     try {
@@ -84,7 +86,13 @@ export async function runInternalCommand(projectRoot, argv, io) {
         if (subcommand === "waiver-grant") {
             return await runWaiverGrant(projectRoot, parseWaiverGrantArgs(tokens), io);
         }
-        io.stderr.write(`Unknown internal subcommand: ${subcommand}. Expected advance-stage | start-flow | cancel-run | rewind | verify-flow-state-diff | verify-current-state | envelope-validate | tdd-red-evidence | tdd-loop-status | early-loop-status | compound-readiness | runtime-integrity | hook | flow-state-repair | waiver-grant\n`);
+        if (subcommand === "tdd-slice-record") {
+            return await runTddSliceRecord(projectRoot, parseTddSliceRecordArgs(tokens), io);
+        }
+        if (subcommand === "plan-split-waves") {
+            return await runPlanSplitWaves(projectRoot, parsePlanSplitWavesArgs(tokens), io);
+        }
+        io.stderr.write(`Unknown internal subcommand: ${subcommand}. Expected advance-stage | start-flow | cancel-run | rewind | verify-flow-state-diff | verify-current-state | envelope-validate | tdd-red-evidence | tdd-loop-status | tdd-slice-record | early-loop-status | compound-readiness | runtime-integrity | hook | flow-state-repair | waiver-grant | plan-split-waves\n`);
         return 1;
     }
     catch (err) {
@@ -100,6 +108,14 @@ export async function runInternalCommand(projectRoot, argv, io) {
             io.stderr.write(`error: dispatch_duplicate — ${err.message}\n`);
             return 2;
         }
+        if (err instanceof DispatchOverlapError) {
+            io.stderr.write(`error: dispatch_overlap — ${err.message}\n`);
+            return 2;
+        }
+        if (err instanceof DispatchCapError) {
+            io.stderr.write(`error: dispatch_cap — ${err.message}\n`);
+            return 2;
+        }
         io.stderr.write(`cclaw internal ${subcommand} failed: ${err instanceof Error ? err.message : String(err)}\n`);
         return 1;
     }

package/dist/internal/detect-supply-chain-changes.d.ts

@@ -0,0 +1,6 @@
+export interface SupplyChainChangeDetection {
+    triggered: boolean;
+    changedFiles: string[];
+    reasons: string[];
+}
+export declare function detectSupplyChainChanges(projectRoot: string): Promise<SupplyChainChangeDetection>;

package/dist/internal/detect-supply-chain-changes.js

@@ -0,0 +1,138 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const WORKFLOW_PATH = /(^|\/)\.github\/workflows\//u;
+const CURSOR_CONFIG_PATH = /(^|\/)\.cursor\//u;
+const PACKAGE_JSON_PATH = /(^|\/)package\.json$/u;
+const SUPPLY_CHAIN_DEP_KEYS = [
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies"
+];
+async function resolveDiffBase(projectRoot) {
+    try {
+        const { stdout } = await execFileAsync("git", ["rev-parse", "HEAD~1"], {
+            cwd: projectRoot
+        });
+        const base = stdout.trim();
+        return base.length > 0 ? base : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readFileAtRev(projectRoot, rev, filePath) {
+    try {
+        const { stdout } = await execFileAsync("git", ["show", `${rev}:${filePath}`], {
+            cwd: projectRoot,
+            maxBuffer: 32 * 1024 * 1024
+        });
+        return stdout;
+    }
+    catch {
+        return null;
+    }
+}
+function dependencyMapsDiffer(before, after) {
+    const beforeKeys = before ? Object.keys(before).sort() : [];
+    const afterKeys = after ? Object.keys(after).sort() : [];
+    if (beforeKeys.length !== afterKeys.length)
+        return true;
+    for (let i = 0; i < beforeKeys.length; i += 1) {
+        if (beforeKeys[i] !== afterKeys[i])
+            return true;
+        const k = beforeKeys[i];
+        if (before[k] !== after[k]) {
+            return true;
+        }
+    }
+    return false;
+}
+async function packageJsonHasDependencyDiff(projectRoot, base, filePath) {
+    const beforeRaw = await readFileAtRev(projectRoot, base, filePath);
+    const afterRaw = await readFileAtRev(projectRoot, "HEAD", filePath);
+    // If either side is missing or unparseable, treat as changed (be conservative).
+    if (beforeRaw === null || afterRaw === null)
+        return true;
+    let beforeJson;
+    let afterJson;
+    try {
+        beforeJson = JSON.parse(beforeRaw);
+    }
+    catch {
+        return true;
+    }
+    try {
+        afterJson = JSON.parse(afterRaw);
+    }
+    catch {
+        return true;
+    }
+    const beforeObj = beforeJson !== null && typeof beforeJson === "object"
+        ? beforeJson
+        : {};
+    const afterObj = afterJson !== null && typeof afterJson === "object"
+        ? afterJson
+        : {};
+    for (const key of SUPPLY_CHAIN_DEP_KEYS) {
+        const beforeMap = (beforeObj[key] !== null && typeof beforeObj[key] === "object")
+            ? beforeObj[key]
+            : undefined;
+        const afterMap = (afterObj[key] !== null && typeof afterObj[key] === "object")
+            ? afterObj[key]
+            : undefined;
+        if (dependencyMapsDiffer(beforeMap, afterMap)) {
+            return true;
+        }
+    }
+    return false;
+}
+export async function detectSupplyChainChanges(projectRoot) {
+    const base = await resolveDiffBase(projectRoot);
+    if (!base) {
+        return { triggered: false, changedFiles: [], reasons: [] };
+    }
+    let changed = [];
+    try {
+        const range = `${base}..HEAD`;
+        const { stdout } = await execFileAsync("git", ["diff", "--name-only", range], {
+            cwd: projectRoot
+        });
+        changed = stdout
+            .split(/\r?\n/gu)
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0);
+    }
+    catch {
+        return { triggered: false, changedFiles: [], reasons: [] };
+    }
+    const matchedFiles = [];
+    const reasons = [];
+    for (const filePath of changed) {
+        if (WORKFLOW_PATH.test(filePath)) {
+            matchedFiles.push(filePath);
+            reasons.push(`.github/workflows changed: ${filePath}`);
+            continue;
+        }
+        if (CURSOR_CONFIG_PATH.test(filePath)) {
+            matchedFiles.push(filePath);
+            reasons.push(`.cursor config changed: ${filePath}`);
+            continue;
+        }
+        if (PACKAGE_JSON_PATH.test(filePath)) {
+            // Only flag when supply-chain dependency keys differ.
+            const depDiffers = await packageJsonHasDependencyDiff(projectRoot, base, filePath);
+            if (depDiffers) {
+                matchedFiles.push(filePath);
+                reasons.push(`${filePath} dependencies/devDependencies/peerDependencies/optionalDependencies changed`);
+            }
+            continue;
+        }
+    }
+    return {
+        triggered: matchedFiles.length > 0,
+        changedFiles: matchedFiles,
+        reasons
+    };
+}

package/dist/internal/flow-state-repair.d.ts

@@ -7,6 +7,13 @@ export interface FlowStateRepairArgs {
     reason: string;
     json: boolean;
     quiet: boolean;
+    /**
+     * v6.9.0 — when true, normalize `state/early-loop.json` to the canonical
+     * shape derived from `early-loop-log.jsonl`. Lets operators recover from
+     * legacy hand-written `early-loop.json` files that drifted from the
+     * source-of-truth log.
+     */
+    earlyLoop: boolean;
 }
 export declare function parseFlowStateRepairArgs(tokens: string[]): FlowStateRepairArgs;
 export declare function runFlowStateRepair(projectRoot: string, args: FlowStateRepairArgs, io: InternalIo): Promise<number>;