codebyplan 1.13.49 → 1.13.51

package/dist/cli.js

@@ -39,7 +39,7 @@ var VERSION, PACKAGE_NAME;
 var init_version = __esm({
   "src/lib/version.ts"() {
     "use strict";
-    VERSION = "1.13.49";
+    VERSION = "1.13.51";
     PACKAGE_NAME = "codebyplan";
   }
 });
@@ -639,6 +639,7 @@ var init_gitignore_block = __esm({
       ".codebyplan/statusline.local.json",
       ".codebyplan/worktree.local.json",
       ".codebyplan/state/",
+      ".codebyplan/clear/",
       ".codebyplan/todo/",
       ".codebyplan/claude-status.local.json",
       ".codebyplan.local.json"
@@ -14279,8 +14280,8 @@ var require_RealtimeChannel = __commonJS({
       }
       /** @internal */
       _notThisChannelEvent(event, ref) {
-        const { close, error, leave, join: join46 } = constants_1.CHANNEL_EVENTS;
-        const events = [close, error, leave, join46];
+        const { close, error, leave, join: join48 } = constants_1.CHANNEL_EVENTS;
+        const events = [close, error, leave, join48];
         return ref && events.includes(event) && ref !== this.joinPush.ref;
       }
       /** @internal */
@@ -37931,8 +37932,242 @@ var init_validate_waves2 = __esm({
   }
 });
 
+// src/cli/worktree/path.ts
+import { dirname as dirname13, basename as basename4, join as join45 } from "node:path";
+function computeWorktreePath(cwd, checkpointNumber) {
+  const parent = dirname13(cwd);
+  const base = basename4(cwd);
+  const nnn = String(checkpointNumber).padStart(3, "0");
+  return join45(parent, `${base}-CHK-${nnn}`);
+}
+var init_path = __esm({
+  "src/cli/worktree/path.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/worktree/add.ts
+import { join as join46, basename as basename5 } from "node:path";
+import { mkdir as mkdir14, readFile as readFile30, writeFile as writeFile23 } from "node:fs/promises";
+import { spawnSync as spawnSync16 } from "node:child_process";
+async function defaultGetRepoId(cwd) {
+  const found = await findCodebyplanConfig(cwd);
+  return found?.contents.repo_id ?? null;
+}
+async function defaultLookupBranch(repoId, checkpointNumber) {
+  const checkpoints = await mcpCall("get_checkpoints", {
+    repo_id: repoId
+  });
+  const list = Array.isArray(checkpoints) ? checkpoints : [];
+  const chk = list.find((c) => c.number === checkpointNumber);
+  if (!chk) {
+    return {
+      found: false,
+      pending: false,
+      message: `No checkpoint found with number ${checkpointNumber} in this repo.`
+    };
+  }
+  if (!chk.branch_name) {
+    const nnn = String(checkpointNumber).padStart(3, "0");
+    return {
+      found: false,
+      pending: true,
+      message: `Branch not yet created for CHK-${nnn} \u2014 connect this repo to GitHub in Settings \u2192 Integrations.`
+    };
+  }
+  return { found: true, branch_name: chk.branch_name };
+}
+function defaultGitRun(args, cwd) {
+  const result = spawnSync16("git", args, {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  return {
+    status: result.status,
+    stdout: (result.stdout ?? "").toString(),
+    stderr: (result.stderr ?? "").toString(),
+    error: result.error
+  };
+}
+async function defaultCopyConfigStubs(srcCwd, destPath) {
+  await mkdir14(join46(destPath, ".codebyplan"), { recursive: true });
+  const topLevelStubs = [".mcp.json", ".env.local"];
+  for (const stub of topLevelStubs) {
+    try {
+      const content = await readFile30(join46(srcCwd, stub), "utf-8");
+      await writeFile23(join46(destPath, stub), content, "utf-8");
+    } catch {
+    }
+  }
+  try {
+    const content = await readFile30(
+      join46(srcCwd, ".codebyplan", "repo.json"),
+      "utf-8"
+    );
+    await writeFile23(
+      join46(destPath, ".codebyplan", "repo.json"),
+      content,
+      "utf-8"
+    );
+  } catch {
+  }
+}
+async function defaultRegisterWorktree(repoId, name, path16) {
+  const res = await apiPost("/worktrees", {
+    repo_id: repoId,
+    name,
+    path: path16,
+    status: "active"
+  });
+  return { worktree_id: res.data.id };
+}
+function parseCheckpointNumber(arg) {
+  const m = /^(?:CHK-)?(\d+)$/i.exec(arg.trim());
+  if (!m?.[1]) return null;
+  const n = parseInt(m[1], 10);
+  return isNaN(n) || n < 0 ? null : n;
+}
+async function runWorktreeAdd(args, deps = {}) {
+  const rawArg = args.find((a) => !a.startsWith("--"));
+  if (!rawArg) {
+    process.stderr.write(
+      JSON.stringify({
+        error: "usage: codebyplan worktree add <CHK-NNN>"
+      }) + "\n"
+    );
+    return 1;
+  }
+  const checkpointNumber = parseCheckpointNumber(rawArg);
+  if (checkpointNumber === null) {
+    process.stderr.write(
+      JSON.stringify({
+        error: `Invalid checkpoint identifier '${rawArg}'. Use CHK-NNN or a bare number (e.g. CHK-207 or 207).`
+      }) + "\n"
+    );
+    return 1;
+  }
+  const cwd = deps.cwd ?? process.cwd();
+  const getRepoId = deps.getRepoId ?? defaultGetRepoId;
+  const lookupBranch = deps.lookupBranch ?? defaultLookupBranch;
+  const gitRun = deps.gitRun ?? defaultGitRun;
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve11) => setTimeout(resolve11, ms)));
+  const copyConfigStubs = deps.copyConfigStubs ?? defaultCopyConfigStubs;
+  const registerWorktree = deps.registerWorktree ?? defaultRegisterWorktree;
+  try {
+    const repoId = await getRepoId(cwd);
+    if (!repoId) {
+      process.stderr.write(
+        JSON.stringify({
+          error: "Could not determine repo_id. Ensure .codebyplan/repo.json exists in the project root."
+        }) + "\n"
+      );
+      return 1;
+    }
+    const lookup = await lookupBranch(repoId, checkpointNumber);
+    if (!lookup.found) {
+      if (lookup.pending) {
+        const result = {
+          status: "branch_pending",
+          message: lookup.message
+        };
+        process.stdout.write(JSON.stringify(result) + "\n");
+        return 0;
+      }
+      process.stderr.write(JSON.stringify({ error: lookup.message }) + "\n");
+      return 1;
+    }
+    const branchName = lookup.branch_name;
+    const nnn = String(checkpointNumber).padStart(3, "0");
+    gitRun(["fetch", "origin", branchName], cwd);
+    let branchReady = false;
+    for (let attempt = 0; attempt < BRANCH_RETRY_COUNT; attempt++) {
+      if (attempt > 0) {
+        await sleep3(BRANCH_RETRY_DELAY_MS);
+      }
+      const lsResult = gitRun(
+        ["ls-remote", "--heads", "origin", branchName],
+        cwd
+      );
+      if (lsResult.status === 0 && lsResult.stdout.trim().length > 0) {
+        branchReady = true;
+        break;
+      }
+    }
+    if (!branchReady) {
+      const result = {
+        status: "branch_not_ready",
+        message: `Branch '${branchName}' not yet visible at origin after ${BRANCH_RETRY_COUNT} retries. Connect this repo to GitHub in Settings \u2192 Integrations.`
+      };
+      process.stdout.write(JSON.stringify(result) + "\n");
+      return 1;
+    }
+    const worktreePath = computeWorktreePath(cwd, checkpointNumber);
+    const worktreeName = `${basename5(cwd)}-CHK-${nnn}`;
+    const addResult = gitRun(
+      ["worktree", "add", worktreePath, branchName],
+      cwd
+    );
+    if (addResult.status !== 0) {
+      const errMsg = addResult.stderr.trim() || addResult.error?.message || "unknown error";
+      process.stderr.write(
+        JSON.stringify({ error: `git worktree add failed: ${errMsg}` }) + "\n"
+      );
+      return 1;
+    }
+    try {
+      await copyConfigStubs(cwd, worktreePath);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`Warning: failed to copy config stubs: ${msg}
+`);
+    }
+    try {
+      const { worktree_id } = await registerWorktree(
+        repoId,
+        worktreeName,
+        worktreePath
+      );
+      const result = {
+        status: "added",
+        worktree_path: worktreePath,
+        branch_name: branchName,
+        worktree_id
+      };
+      process.stdout.write(JSON.stringify(result) + "\n");
+      return 0;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const result = {
+        status: "added",
+        worktree_path: worktreePath,
+        branch_name: branchName,
+        warn: `Worktree created but registration failed: ${msg}`
+      };
+      process.stdout.write(JSON.stringify(result) + "\n");
+      return 0;
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(JSON.stringify({ error: msg }) + "\n");
+    return 1;
+  }
+}
+var BRANCH_RETRY_COUNT, BRANCH_RETRY_DELAY_MS;
+var init_add = __esm({
+  "src/cli/worktree/add.ts"() {
+    "use strict";
+    init_path();
+    init_flags();
+    init_mcp_client();
+    init_api();
+    BRANCH_RETRY_COUNT = 3;
+    BRANCH_RETRY_DELAY_MS = 2e3;
+  }
+});
+
 // src/cli/worktree/create.ts
-import { join as join45 } from "node:path";
+import { join as join47 } from "node:path";
 async function defaultGetRepoIdentity(cwd) {
   const found = await findCodebyplanConfig(cwd);
   const contents = found?.contents ?? null;
@@ -37944,7 +38179,7 @@ async function defaultGetRepoIdentity(cwd) {
     project_id: typeof contents?.["project_id"] === "string" ? contents["project_id"] : void 0
   };
 }
-async function defaultRegisterWorktree(repoId, name, path16) {
+async function defaultRegisterWorktree2(repoId, name, path16) {
   const res = await apiPost("/worktrees", {
     repo_id: repoId,
     name,
@@ -37976,7 +38211,7 @@ async function runWorktreeCreate(args, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const getRepoIdentity = deps.getRepoIdentity ?? defaultGetRepoIdentity;
   const getDeviceId = deps.getDeviceId ?? getOrCreateDeviceId;
-  const registerWorktree = deps.registerWorktree ?? defaultRegisterWorktree;
+  const registerWorktree = deps.registerWorktree ?? defaultRegisterWorktree2;
   const identity = await getRepoIdentity(cwd);
   const repoId = identity?.repo_id ?? null;
   if (!identity || !repoId) {
@@ -37987,7 +38222,7 @@ async function runWorktreeCreate(args, deps = {}) {
     );
     return 1;
   }
-  const worktreePath = explicitPath ?? join45(cwd, "..", name);
+  const worktreePath = explicitPath ?? join47(cwd, "..", name);
   const deviceId = await getDeviceId(cwd);
   let filesWritten = false;
   try {
@@ -38043,7 +38278,9 @@ var init_create = __esm({
 });
 
 // src/cli/worktree/remove.ts
-async function defaultGetRepoId(cwd) {
+import { basename as basename6 } from "node:path";
+import { spawnSync as spawnSync17 } from "node:child_process";
+async function defaultGetRepoId2(cwd) {
   const found = await findCodebyplanConfig(cwd);
   return found?.contents.repo_id ?? null;
 }
@@ -38063,6 +38300,192 @@ async function defaultFindWorktreeId(repoId, name) {
 async function defaultDeregisterWorktree(worktreeId) {
   await mcpCall("delete_worktree", { worktree_id: worktreeId });
 }
+function defaultGitRun2(args, cwd) {
+  const result = spawnSync17("git", args, {
+    cwd,
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  return {
+    status: result.status,
+    stdout: (result.stdout ?? "").toString(),
+    stderr: (result.stderr ?? "").toString(),
+    error: result.error
+  };
+}
+function defaultGetWorktreeBranchName(worktreePath) {
+  const result = spawnSync17("git", ["symbolic-ref", "--short", "HEAD"], {
+    cwd: worktreePath,
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  if (result.status === 0 && result.stdout) {
+    return result.stdout.trim() || null;
+  }
+  return null;
+}
+async function defaultDeleteSupabaseBranch(branchName, cwd) {
+  const token = process.env.SUPABASE_ACCESS_TOKEN;
+  if (!token) {
+    return {
+      deleted: false,
+      warn: "SUPABASE_ACCESS_TOKEN not set \u2014 skipping Supabase preview-branch teardown."
+    };
+  }
+  const shipment = readShipmentConfig(cwd);
+  const parentRef = shipment.parentRef;
+  if (!parentRef) {
+    return {
+      deleted: false,
+      warn: "Supabase project_ref not configured in .codebyplan/shipment.json \u2014 skipping teardown."
+    };
+  }
+  const gitCfg = readGitConfig(cwd);
+  if (branchName === gitCfg.production || gitCfg.protected.includes(branchName)) {
+    return {
+      deleted: false,
+      warn: `Skipping Supabase teardown for protected branch '${branchName}'.`
+    };
+  }
+  if (gitCfg.integration !== null && branchName === gitCfg.integration) {
+    return {
+      deleted: false,
+      warn: `Skipping Supabase teardown for integration branch '${branchName}'.`
+    };
+  }
+  try {
+    const listRes = await fetch(
+      `https://api.supabase.com/v1/projects/${parentRef}/branches`,
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json"
+        }
+      }
+    );
+    if (!listRes.ok) {
+      return {
+        deleted: false,
+        warn: `Supabase list_branches failed (HTTP ${listRes.status}) \u2014 verify the branch manually in the dashboard.`
+      };
+    }
+    const branches = await listRes.json();
+    if (!Array.isArray(branches)) {
+      return {
+        deleted: false,
+        warn: "Supabase list_branches returned unexpected shape \u2014 verify manually in the dashboard."
+      };
+    }
+    const match = branches.find((b) => b.name === branchName);
+    if (!match) {
+      return { deleted: true };
+    }
+    if (match.is_default === true) {
+      return {
+        deleted: false,
+        warn: `Refusing to delete is_default Supabase branch '${branchName}'.`
+      };
+    }
+    if (!match.id) {
+      return {
+        deleted: false,
+        warn: `Supabase branch '${branchName}' found but has no id \u2014 skipping.`
+      };
+    }
+    const deleteRes = await fetch(
+      `https://api.supabase.com/v1/projects/${parentRef}/branches/${match.id}`,
+      {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${token}` }
+      }
+    );
+    if (!deleteRes.ok) {
+      return {
+        deleted: false,
+        warn: `Supabase delete_branch failed (HTTP ${deleteRes.status}) \u2014 verify the branch manually in the dashboard.`
+      };
+    }
+    return { deleted: true };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      deleted: false,
+      warn: `Supabase teardown error: ${msg} \u2014 verify manually in the dashboard.`
+    };
+  }
+}
+function parseChkNumber(name) {
+  const chkMatch = /^CHK-(\d+)$/i.exec(name);
+  if (chkMatch?.[1]) {
+    const n = parseInt(chkMatch[1], 10);
+    return isNaN(n) ? null : n;
+  }
+  if (/^\d+$/.test(name)) {
+    const n = parseInt(name, 10);
+    return isNaN(n) ? null : n;
+  }
+  return null;
+}
+async function runWorktreeRemoveChk(checkpointNumber, deps) {
+  const cwd = deps.cwd ?? process.cwd();
+  const getRepoId = deps.getRepoId ?? defaultGetRepoId2;
+  const findWorktreeId = deps.findWorktreeId ?? defaultFindWorktreeId;
+  const deregisterWorktree = deps.deregisterWorktree ?? defaultDeregisterWorktree;
+  const gitRun = deps.gitRun ?? defaultGitRun2;
+  const getWorktreeBranchName = deps.getWorktreeBranchName ?? defaultGetWorktreeBranchName;
+  const deleteSupabaseBranch = deps.deleteSupabaseBranch ?? defaultDeleteSupabaseBranch;
+  const nnn = String(checkpointNumber).padStart(3, "0");
+  const worktreeName = `${basename6(cwd)}-CHK-${nnn}`;
+  const worktreePath = computeWorktreePath(cwd, checkpointNumber);
+  const warnings = [];
+  const branchName = getWorktreeBranchName(worktreePath);
+  const removeResult = gitRun(["worktree", "remove", worktreePath], cwd);
+  const git_removed = removeResult.status === 0;
+  if (!git_removed) {
+    const errMsg = removeResult.stderr.trim() || removeResult.error?.message || "unknown error";
+    warnings.push(`git worktree remove failed: ${errMsg}`);
+  }
+  let mcp_deregistered = false;
+  const repoId = await getRepoId(cwd);
+  if (repoId) {
+    const worktreeId = await findWorktreeId(repoId, worktreeName);
+    if (worktreeId) {
+      try {
+        await deregisterWorktree(worktreeId);
+        mcp_deregistered = true;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        warnings.push(`MCP deregistration failed: ${msg}`);
+      }
+    } else {
+      warnings.push(
+        `No registered worktree found with name '${worktreeName}' for this repo.`
+      );
+    }
+  } else {
+    warnings.push("Could not determine repo_id \u2014 worktree not deregistered.");
+  }
+  let supabase_torn_down = false;
+  if (branchName) {
+    const teardown = await deleteSupabaseBranch(branchName, cwd);
+    supabase_torn_down = teardown.deleted;
+    if (teardown.warn) {
+      warnings.push(teardown.warn);
+    }
+  } else {
+    warnings.push(
+      `Could not read the branch name for '${worktreePath}' (directory may already be deleted) \u2014 the Supabase preview branch was NOT torn down. Delete it manually in the Supabase dashboard if it still exists.`
+    );
+  }
+  const result = {
+    mcp_deregistered,
+    git_removed,
+    supabase_torn_down,
+    ...warnings.length > 0 ? { warn: warnings.join("; ") } : {}
+  };
+  process.stdout.write(JSON.stringify(result) + "\n");
+  return 0;
+}
 async function runWorktreeRemove(args, deps = {}) {
   const name = args.find((a) => !a.startsWith("--"));
   if (!name) {
@@ -38073,8 +38496,12 @@ async function runWorktreeRemove(args, deps = {}) {
     );
     return 1;
   }
+  const chkNumber = parseChkNumber(name);
+  if (chkNumber !== null) {
+    return runWorktreeRemoveChk(chkNumber, deps);
+  }
   const cwd = deps.cwd ?? process.cwd();
-  const getRepoId = deps.getRepoId ?? defaultGetRepoId;
+  const getRepoId = deps.getRepoId ?? defaultGetRepoId2;
   const findWorktreeId = deps.findWorktreeId ?? defaultFindWorktreeId;
   const deregisterWorktree = deps.deregisterWorktree ?? defaultDeregisterWorktree;
   const repoId = await getRepoId(cwd);
@@ -38113,9 +38540,11 @@ async function runWorktreeRemove(args, deps = {}) {
 var init_remove = __esm({
   "src/cli/worktree/remove.ts"() {
     "use strict";
+    init_path();
     init_api();
     init_mcp_client();
     init_flags();
+    init_supabase();
   }
 });
 
@@ -38126,6 +38555,9 @@ __export(worktree_exports, {
 });
 async function runWorktreeCommand(args) {
   const subcommand = args[0];
+  if (subcommand === "add") {
+    return runWorktreeAdd(args.slice(1));
+  }
   if (subcommand === "create") {
     return runWorktreeCreate(args.slice(1));
   }
@@ -38139,7 +38571,7 @@ async function runWorktreeCommand(args) {
   if (subcommand) {
     process.stderr.write(
       `Unknown subcommand: codebyplan worktree ${subcommand}
-Available: create, remove
+Available: add, create, remove
 `
     );
     return 1;
@@ -38149,12 +38581,13 @@ Available: create, remove
 }
 function printWorktreeHelp() {
   process.stdout.write(
-    "\n  codebyplan worktree <subcommand>\n\n  Subcommands:\n    create <name>   Write .codebyplan/ files and register the worktree in CodeByPlan\n    remove <name>   Deregister a worktree from CodeByPlan\n\n  create flags:\n    --path <abs>    Explicit absolute path to the worktree root (primary mechanism)\n\n  Output is JSON on stdout. Exit 0 on success or non-fatal failure; exit 1 on usage error.\n\n"
+    "\n  codebyplan worktree <subcommand>\n\n  Subcommands:\n    add <CHK-NNN>   Create a per-checkpoint git worktree on the checkpoint's feat branch and register it\n    create <name>   Write .codebyplan/ files and register the worktree in CodeByPlan\n    remove <name>   Deregister a worktree (or `remove CHK-NNN` to prune the per-checkpoint worktree + Supabase preview)\n\n  create flags:\n    --path <abs>    Explicit absolute path to the worktree root (primary mechanism)\n\n  Output is JSON on stdout. Exit 0 on success or non-fatal failure; exit 1 on usage error.\n\n"
   );
 }
 var init_worktree2 = __esm({
   "src/cli/worktree.ts"() {
     "use strict";
+    init_add();
     init_create();
     init_remove();
   }
@@ -38274,7 +38707,7 @@ var init_e2e = __esm({
 });
 
 // src/cli/e2e/verify-round.ts
-import { readFile as readFile30 } from "node:fs/promises";
+import { readFile as readFile31 } from "node:fs/promises";
 import { resolve as resolve9 } from "node:path";
 async function defaultFetchRounds(taskId) {
   return mcpCall("get_rounds", { task_id: taskId });
@@ -38282,7 +38715,7 @@ async function defaultFetchRounds(taskId) {
 async function defaultReadE2eConfig(cwd) {
   try {
     const p = resolve9(cwd, ".codebyplan", "e2e.json");
-    const raw = await readFile30(p, "utf-8");
+    const raw = await readFile31(p, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -39062,7 +39495,7 @@ void (async () => {
     codebyplan claude                Claude asset management (install/update/uninstall/generate/migrate-memory)
     codebyplan supabase              Preview-branch helpers (resolve-preview/teardown-preview/new-migration/preview-check)
     codebyplan session               Session helpers (home-ff/freshness-gate/infra-files)
-    codebyplan worktree              Worktree management (create/remove)
+    codebyplan worktree              Worktree management (add/create/remove)
     codebyplan e2e               E2E deterministic gates (verify-round)
     codebyplan statusline            Show or set the statusline renderer (bash/node/python)
     codebyplan resolve-worktree      Resolve active worktree UUID from device+path+branch tuple

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebyplan",
-  "version": "1.13.49",
+  "version": "1.13.51",
   "description": "CLI for CodeByPlan — AI-powered development planning and tracking",
   "type": "module",
   "bin": {

package/templates/agents/cbp-round-executor.md

@@ -239,18 +239,13 @@ When the executor received a `wave` input with a non-empty `wave.skill_preloads[
 For each entry in `wave.skill_preloads[]`, invoke the named skill via the Skill tool BEFORE Step 3 (Execute). Invoke in order:
 
 1. `cbp-frontend-design` — if present, invoke FIRST (aesthetic direction before code)
-2. `cbp-frontend-a11y` — if present, invoke AFTER `cbp-frontend-design` (accessibility obligations)
-3. Any other skill preload — invoke in list order
+2. Any other skill preload — invoke in list order
 
 Record completion:
 ```yaml
 round.context.frontend_design_loaded: true   # if cbp-frontend-design was preloaded
-round.context.frontend_a11y_loaded: true     # if cbp-frontend-a11y was preloaded
-round.context.frontend_a11y_checklist: [items from cbp-frontend-a11y/SKILL.md Phase 6 output]  # only when cbp-frontend-a11y was preloaded for this wave
 ```
 
-When cbp-frontend-a11y is preloaded, capture its Phase 6 per-component checklist output verbatim into `round.context.frontend_a11y_checklist`. Step 3 reads this for accessibility enforcement during code emission.
-
 If `wave` is absent or `wave.skill_preloads[]` is empty, skip this step — Step 2.7 handles the non-wave UI pre-read path.
 
 **Why step 2.6 and 2.7 coexist**: Step 2.7 fires for non-wave rounds when the executor detects UI files directly. Step 2.6 fires for wave rounds where the planner already determined the preloads. They cover the same skill but via different trigger paths; the round.context recording is identical so downstream steps behave uniformly.

package/templates/agents/cbp-task-planner.md

@@ -533,7 +533,7 @@ After Phase 5 (solution design) and before Phase 6 (context summary), decompose
 1. **Identify natural cut points**: look for cross-app boundaries (files in `apps/web/` vs `apps/backend/` vs `apps/desktop/`), packages with no shared state, or dependency ordering (DB migration must precede app code using the new schema).
 2. **Check disjoint-files invariant**: no file may appear in two waves. If a shared file is needed by two waves, assign it to the earlier wave and make the later wave `depends_on` the earlier.
 3. **Check DAG invariant**: `depends_on[]` must be acyclic. Any cycle is a plan error — resolve by merging the cyclic waves.
-4. **Populate `skill_preloads[]`**: for each wave whose `files[]` contains UI-bearing paths (`*.tsx`, `*.jsx`, `*.scss`, etc.), add `"frontend-design"` and `"frontend-a11y"` to `skill_preloads[]` (in that order).
+4. **Populate `skill_preloads[]`**: for each wave whose `files[]` contains UI-bearing paths (`*.tsx`, `*.jsx`, `*.scss`, etc.), add `"frontend-design"` to `skill_preloads[]`.
 5. **Single-wave default**: if no independence is found, produce ONE wave covering all files. Parallel waves add orchestration overhead — only decompose when the benefit is clear.
 6. **15-file cap**: after decomposition (including the single-wave default), count files in each wave. If any wave would exceed 15 files, auto-split it using the proximity-split algorithm in priority order: (a) **shared directory subtree** — split at the deepest common ancestor that produces two groups each ≥3 files; (b) **shared module** — split at the next directory level below the common ancestor; (c) **arbitrary boundary** — split at the 15-file boundary and add a one-line `note` on the continuation wave explaining the boundary. Split siblings are **independent**: do NOT add `depends_on` between them unless a real shared-file or data dependency requires ordering. **Tail rule**: choose boundaries so every resulting wave holds 3–15 files. A split must never leave a wave with <3 files; rebalance the boundary rather than absorbing a tail into a sibling in a way that pushes it above 15. The 3–15 range is a hard invariant — there is no exception above 15. **Apply the cap iteratively**: after a split, re-check each resulting wave and split again any that still exceeds 15 — a 40-file single-concern plan therefore yields ≥3 waves. When no natural boundary yields groups each ≥3 files, take the smallest ≥3-file prefix as one wave and apply the same procedure to the remainder. The single-wave default is itself subject to this cap. See `rules/parallel-waves.md` for the full algorithm and invariants.
 
@@ -559,7 +559,7 @@ printf '%s' "$PLAN_JSON" | codebyplan validate-waves --json
 
 (`$PLAN_JSON` is the `{ "waves": [...] }` structure; pass a file path as the first argument instead of stdin if preferred.) Exit 0 = invariants I–III satisfied. Exit non-zero = one or more violations — the `--json` `violations[]` array names the failing invariant (`I`/`II`/`III`) and offending wave/file; fix the decomposition and re-run before emitting the plan. The validator does NOT check invariant IV (UI skill preloads) — that remains a manual step:
 
-- [ ] UI-bearing waves have `frontend-design` + `frontend-a11y` in `skill_preloads[]` (invariant IV — not covered by `validate-waves`)
+- [ ] UI-bearing waves have `frontend-design` in `skill_preloads[]` (invariant IV — not covered by `validate-waves`)
 
 ### Phase 6: Build Context Summary
 

package/templates/hooks/cbp-skill-context-guard.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# @scope: org-shared
+# Hook: PreToolUse (Skill)
+# Purpose: Deny heavy close-out skills when context window > CBP_CONTEXT_WARN_TOKENS (default 200000).
+#          Reads transcript_path from stdin, sums the latest assistant message.usage — same logic
+#          as cbp-context-window-notify.sh. If total exceeds threshold AND the skill is in the
+#          heavy close-out allowlist, emits hookSpecificOutput.permissionDecision=deny directing
+#          Claude to run /cbp-clear-prep. Always exits 0 — fail-open.
+
+set -euo pipefail
+
+INPUT=$(cat)
+SKILL_NAME=$(echo "$INPUT" | jq -r '.tool_input.skill // .tool_input.skill_name // ""' 2>/dev/null) || SKILL_NAME=""
+TRANSCRIPT=$(echo "$INPUT" | jq -r '.transcript_path // ""' 2>/dev/null) || TRANSCRIPT=""
+
+# Fast-path: no transcript → pass through
+[ -z "$TRANSCRIPT" ] && exit 0
+[ ! -f "$TRANSCRIPT" ] && exit 0
+
+THRESHOLD="${CBP_CONTEXT_WARN_TOKENS:-200000}"
+
+# Heavy close-out allowlist (cbp-clear-prep + cbp-clear-continue deliberately excluded so
+# they always run even when context > threshold).
+HEAVY_SKILLS="cbp-round-execute cbp-task-testing cbp-standalone-task-testing cbp-checkpoint-check cbp-checkpoint-end"
+
+# Cheap allowlist check before summing tokens
+IS_HEAVY=false
+for heavy in $HEAVY_SKILLS; do
+  if [ "$SKILL_NAME" = "$heavy" ]; then
+    IS_HEAVY=true
+    break
+  fi
+done
+[ "$IS_HEAVY" = "false" ] && exit 0
+
+# Token sum — same logic as cbp-context-window-notify.sh
+TOTAL=$(tail -n 400 "$TRANSCRIPT" \
+  | jq -rR 'fromjson? | select(.message.usage != null)
+      | (.message.usage
+         | ((.input_tokens // 0) + (.cache_creation_input_tokens // 0) + (.cache_read_input_tokens // 0)))' \
+  2>/dev/null | tail -1) || TOTAL=0
+TOTAL="${TOTAL:-0}"
+
+if [ "$TOTAL" -ge "$THRESHOLD" ] 2>/dev/null; then
+  jq -n \
+    --argjson tokens "$TOTAL" \
+    --argjson threshold "$THRESHOLD" \
+    --arg skill "$SKILL_NAME" \
+    '{hookSpecificOutput:{permissionDecision:"deny",permissionDecisionReason:("Context window at \($tokens) tokens (threshold \($threshold)) is too large to safely run /\($skill). Run /cbp-clear-prep now to capture a handoff, then /clear, then /cbp-clear-continue to resume.")}}'
+fi
+
+exit 0