cowork-flow 1.1.0 → 1.1.4

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 1.1.4 - 2026-08-31
+
+### 修复
+
+- **Windows 启动修复**：`mcp-state` 子进程在 Windows 平台改为经 `cmd.exe` 启动（`shell: true`），与 npm shims 的启动方式保持一致——绕过 Node 24+ 直接 spawn `.cmd` 文件（如 `cowork-flow.cmd` 的 shell 入口）时抛出的 EINVAL 错误。
+
+## 1.1.3 - 2026-08-30
+
+> **版本内容载体说明**：1.1.1（守卫修复批次）与 1.1.2（Review 基线 diff）章节内容随本 1.1.3 首次进入 npm 分发——三个批次同属一个发布周期，章节按批次序号记录，包内容以最新版本号为载体（与 1.1.0 承载 1.0.0 章节内容同一惯例）。
+
+### 规则表数据化（scope-rules 单源）
+
+- 新增 `.cowork-flow/spec/runtime/scope-rules.json`：scope 过滤规则（allowedTypes/wildcardChars/rejectedSegments/driveLetterPattern/trailingSlashRejectedTypes）与 stage-contract 限制（budget/scopeLimit/specLimit/verifyLimit）从三份复制实现下沉为单一数据文件。
+- Python（context_paths/fact_view）与 zcode/opencode JS 镜像运行时消费同一文件；文件缺失/畸形降级到与默认内容逐字一致的内嵌默认（默认等价由 tests/test_scope_rules.py 与 selfcheck 锁定）。
+- 规则可真实改变行为：wildcardChars 置空 → 通配条目进入 Scope；budget 调小 → 预算降级路径触发。
+- 修复预算兜底 1 字节超限：裁剪切分与闭标签间的换行预留。
+- **CI 修复（delegated 注入崩溃）**：zcode delegated 分支不再以空输入对象重新发现项目根（`findProjectRoot({})`），改为复用 main 已解析的工作流根——在无 `.cowork-flow/` 的目录（干净 checkout、非项目目录）触发 delegated prompt 不再 `join(null)` 崩溃；对应的注入测试显式指定 spawn 工作目录，消除对测试运行 cwd 的隐式依赖（干净 checkout 下此前必红，实测 dev 推送 CI 双平台失败）。
+- **CI 修复（Windows git 降级）**：`git` 二进制不可用（PATH 缺失/未安装）时 `_run_git_command` 捕获 OSError 按 rc!=0 降级——`current_head` 视为无头（不写 baseline）、变更集收集降级 status-only，`task start` 不再崩溃（Windows 的 CreateProcess 在 PATH 缺失时不回退，清空环境的会话测试此前必红；macOS execvp 有默认 PATH 兜底故本地绿）。
+
+## 1.1.2 - 2026-08-30
+
+### Review 基线 diff（堵住提交绕行面）
+
+- **基线记录**：`task start`（进入 in_progress）在 task.json `meta.baselineCommit` 记录当前 HEAD，且永不滑动（重复/幂等 start 不覆盖）——任务期间的审查窗口从激活时刻起固定。
+- **变更集合并**：review 门禁以 `baseline..HEAD` diff 与 working-tree status 的并集去重作为变更集——agent 中途 `git commit` 越界文件后，review 的 `unlisted_changed_file` 仍会触发（此前提交即从 status 消失，形成无痕通道）。
+- **降级语义**：无 git 仓库 / HEAD 不存在 / 基线缺失 / diff 失败（如 rebase 孤儿化）→ 降级 status-only，与旧行为一致，不产生错误 blocker。
+- **契约重开**：task-review SKILL 输入语义写明基线变更集与降级行为；已审查任务的增量重审聚焦自基线以来的变化，证据要求不变。
+
+## 1.1.1 - 2026-08-30
+
+### 守卫修复批次（对抗评审后落地）
+
+- **hook 崩溃修复**：implement.jsonl 含 `./` 前缀条目时 zcode/opencode 双宿主 hook 从 `TypeError: Assignment to constant variable` 崩溃（整个上下文注入丢失）改为正常输出——`const`→`let` 两处 + 回归 fixture。
+- **stage-contract 预算降级**：超限输入不再产出未闭合的畸形块；按 Verify → Specs → Scope 条目（至少 1 条）逐级降级，收尾标签与 Gates 行恒在；三线同构算法。
+- **MCP 路径隔离**：`task_scope`/`task_specs` 拒绝仓库外路径（`../`、绝对路径）返回 `task-outside-repo`；无 id 的 JSON-RPC 通知（含 initialize/ping/tools/list）不再响应。
+- **JS 白名单语义对齐**：zcode/opencode 过滤规则与 Python `normalize_context_file_scope_entry` 一致（非法 type、`../`、绝对路径、盘符、通配符一律丢弃）——editScopeWarning 与 Scope 行不再对 gate 会标记越界的文件静默放行；spec 指针同规则过滤。
+- **delegated 只读 scope**：子代理注入包删除 `Scope: subagent` 行；stage-contract 以父任务 scope `[read-only]` 变体呈现，Gates 话术同步（不再暗示子代理可自声明 scope）。
+- **异常降级可诊断**：锚点文件非法 UTF-8 时 stage-contract 保留 Scope/Gates 仅丢 Verify（此前整块静默消失）；非例行异常在 stderr 留痕。
+- **review 门禁补洞**：implement.jsonl 缺失时 review 产生 `missing_implement_jsonl_file_scope` blocker（此前静默放行，删除 manifest 即绕过白名单）。
+- **矩阵化跨端测试**：`test/fixtures/stage-contract-matrix.json` 单一数据文件驱动三线（python/zcode/opencode）逐字节相等断言，覆盖规范/`./` 前缀/非法边界/超限/emoji/缺锚点/空 scope/delegated 8 类用例；zcode hooks.json matcher（Bash|Edit|Write|MultiEdit）由模板测试锁定；新增 Python 侧矩阵断言。
+- dev_type 畸形值（非字符串）在 task_specs 中按缺省降级；spec 指针忽略 directory 条目；normalizeScopePath 带 trim；zcode 生命周期刷新正则对齐 dsh（task|subagent|resume）。
+- 契约文档如实化：context-injection.md 不再声称三线结构恒等/always emitted，改为差异表 + 矩阵锁定范围 + 残余缺口清单（matcher 依赖 ZCode 运行时工具名、JS 过滤为规则移植）。
+
 ## 1.1.0 - 2026-08-29
 
 > **版本内容错位说明**：npm registry 上的 1.0.0 tarball 发布于 2026-08-26（仅含发版脚本修复之前的代码）。1.0.0 段下述的里程碑描述以本 1.1.0 为其实际发布载体——阶段 0-3 的全部内容自本版本起进入 npm 分发。
@@ -34,6 +77,7 @@
 - 注入结构化（阶段 1b）：`<workflow-state>` 升级为属性事实头（`task`/`status`/`source` 进开标签，body 保留人读面包屑），三线一致并在协议契约冻结；planning/in_progress/review 状态下三线注入紧凑 `<decision-anchor>` 决策要点块（Python 复用 fact_view 解析单源），completed 终态与缺文件不注入。
 - 多执行者语义（阶段 2）：task.json 增加 `executor` 归属（start 写入会话 key 或显式 `--executor`）；执行者冲突 fail-closed（`LIFECYCLE-EXECUTOR-001`，幂等重跑同样拦截），`--takeover` 显式接管并覆写归属（含已激活任务的幂等接管）；`--executor` 允许无会话 CI/无头 start（不建会话绑定）；子代理运行时上下文新增 `evidence` 证据位（`subagent evidence <id> --note [--artifact]`，CAS 保护、closed 可补记、不影响任务状态机）；`run state` 人读摘要透出 Executor。
 - 生态适配（阶段 3）：新增 `./.cowork-flow/run mcp-state`——无依赖 MCP stdio 只读服务（newline-delimited JSON-RPC 2.0），工具 `task_state`（事实视图）与 `task_list`（活动任务概览）；接入契约 `spec/contracts/fact-layer-access.md` 冻结只读保证与"不自创跨 agent 协议、adapter 保持薄"立场，写路径仍独占于 CLI 门禁链。
+- 实现阶段守卫三件套：MCP `task_scope`/`task_specs` 只读工具（越界判定与规范清单，宿主无关、Python 单源）；`<stage-contract>` 实现契约块三线注入（编辑白名单/规范入口/门禁预告/任务自声明验证命令，≤1200 字符，跨宿主逐字相等测试锁定）；zcode 编辑越界实时警告（PostToolUse Edit/Write/MultiEdit 短路径，能力矩阵声明 `editScopeWarning`，其余宿主 fallback 到静态预告）。
 - MCP 全局入口：npm CLI 新增 `cowork-flow mcp-state` 透传命令——从 cwd 向上定位最近 `.cowork-flow/` 并以继承 stdio exec 该项目的 `run mcp-state`；MCP 客户端全局注册一次（`cowork-flow mcp-state`）即可服务所有 cowork-flow 项目，无需逐项目配置。
 
 ## 0.0.52 - 2026-08-26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-flow",
-  "version": "1.1.0",
+  "version": "1.1.4",
   "description": "CLI for installing and maintaining cowork-flow collaboration templates.",
   "type": "module",
   "bin": {

package/src/commands/mcp-state.js

@@ -54,6 +54,9 @@ export async function runMcpState(args, options = {}) {
     const child = spawn(runner, ['mcp-state', ...args], {
       stdio: 'inherit',
       cwd: root,
+      // Windows: newer Node (v24+) throws EINVAL when spawning .cmd files
+      // directly; routing through cmd.exe matches how npm shims launch.
+      shell: process.platform === 'win32',
     });
     child.on('error', (error) => {
       io.writeErr(`Error: failed to launch ${runner}: ${error.message}\n`);

package/template/.cowork-flow/.version

@@ -1 +1 @@
-1.1.0
+1.1.4

package/template/.cowork-flow/adapters/claude-code/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
+  editScopeWarning: unsupported
 dispatch:
   primitive: subagent
   agentsPath: .claude/agents

package/template/.cowork-flow/adapters/codex/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
+  editScopeWarning: unsupported
 dispatch:
   primitive: spawn_agent
   forkTurns: none

package/template/.cowork-flow/adapters/dsh/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: shim
+  editScopeWarning: unsupported
 dispatch:
   primitive: subagent
   skillsPath: .agents/skills

package/template/.cowork-flow/adapters/opencode/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
+  editScopeWarning: unsupported
 dispatch:
   primitive: task
   agentsPath: .opencode/agents

package/template/.cowork-flow/adapters/zcode/adapter.yaml

@@ -13,6 +13,7 @@ capabilities:
   runtimeContextDispatch: native
   runtimeContextBinding: shim
   runtimeContextCleanup: native
+  editScopeWarning: plugin
 dispatch:
   primitive: subagent
   agentsPath: .zcode/agents

package/template/.cowork-flow/scripts/adapters/cli/task.py

@@ -12,15 +12,17 @@ if __package__:
 else:
     import _bootstrap  # noqa: F401
 
+from services.context_discovery import (
+    get_implement_backend,
+    get_implement_base,
+    get_implement_frontend,
+    get_implement_spec,
+)
 from services.task_context import (
     detect_installed_platforms as _detect_installed_platforms,
     discover_spec_files as _discover_spec_files,
     get_check_context,
     get_debug_context,
-    get_implement_backend,
-    get_implement_base,
-    get_implement_frontend,
-    get_implement_spec,
     is_skill_path as _is_skill_path,
     iter_jsonl_lines as _iter_jsonl_lines,
     skill_path as _skill_path,

package/template/.cowork-flow/scripts/adapters/host/workflow_state_hook.py

@@ -89,7 +89,6 @@ def build_hook_context(
         source = f"runtime-context-invalid:{runtime_context_id}"
         extra_lines = [
             f"Runtime context: {runtime_context_id}",
-            "Scope: subagent",
             (
                 "Runtime context is missing, closed, or invalid. "
                 "Do not run standalone lifecycle commands, resume, archive, commit, or spawn."
@@ -120,6 +119,9 @@ def build_hook_context(
     blocks = [*preamble, digest_block]
     if anchor_block:
         blocks.append(anchor_block)
+    contract_block = _stage_contract_block(root, task_path, status)
+    if contract_block:
+        blocks.append(contract_block)
     blocks.append(
         f"<workflow-state{_workflow_state_attrs(task_path, status, source)}>"
         f"\n{body}\n</workflow-state>"
@@ -148,13 +150,11 @@ def _session_has_started(root: Path, hook_input: dict[str, Any]) -> bool:
 
 
 def _xml_attr(value: Any) -> str:
-    return (
-        str(value)
-        .replace("&", "&amp;")
-        .replace("<", "&lt;")
-        .replace(">", "&gt;")
-        .replace('"', "&quot;")
-    )
+    # Delegates to the fact-view implementation: the escaping rules must stay
+    # identical across the decision-anchor and stage-contract blocks.
+    from services.fact_view import xml_attr
+
+    return xml_attr(value)
 
 
 def _workflow_state_attrs(
@@ -169,6 +169,24 @@ def _workflow_state_attrs(
 
 
 DECISION_ANCHOR_STATES = ("planning", "in_progress", "review")
+STAGE_CONTRACT_STATES = ("in_progress", "review")
+
+
+def _effective_task_status(
+    root: Path, task_path: str, status: str
+) -> str | None:
+    """Delegated subtasks read the underlying task's status; every other
+    status is already effective."""
+    if status != "delegated_subtask":
+        return status
+    try:
+        data = json.loads(
+            (root / task_path / "task.json").read_text(encoding="utf-8")
+        )
+        effective_status = data.get("status")
+    except (OSError, json.JSONDecodeError):
+        return None
+    return effective_status if isinstance(effective_status, str) else None
 
 
 def _decision_anchor_block(
@@ -180,17 +198,7 @@ def _decision_anchor_block(
     inject nothing."""
     if not task_path:
         return None
-    effective_status = status
-    if status == "delegated_subtask":
-        try:
-            data = json.loads(
-                (root / task_path / "task.json").read_text(encoding="utf-8")
-            )
-            effective_status = data.get("status")
-        except (OSError, json.JSONDecodeError):
-            return None
-        if not isinstance(effective_status, str):
-            return None
+    effective_status = _effective_task_status(root, task_path, status)
     if effective_status not in DECISION_ANCHOR_STATES:
         return None
     try:
@@ -200,7 +208,13 @@ def _decision_anchor_block(
             encoding="utf-8"
         )
         parsed = parse_decision_anchor(text)
-    except Exception:
+    except (OSError, UnicodeDecodeError):
+        # Absent or undecodable anchors are routine: no block, no noise.
+        return None
+    except Exception as error:
+        # Anything else leaves a trace so silent guard loss stays diagnosable
+        # (stdout is the injection channel, stderr is safe).
+        sys.stderr.write(f"decision-anchor degraded: {error}\n")
         return None
     if not parsed["goal"] and not parsed["acceptanceCriteria"]:
         return None
@@ -219,6 +233,59 @@ def _decision_anchor_block(
     return "\n".join(lines)
 
 
+def _stage_contract_block(
+    root: Path, task_path: str | None, status: str
+) -> str | None:
+    """Implementation contract (edit scope, specs to read, gates preview,
+    declared verification commands) for states where it steers execution.
+    Data comes from the frozen task artifacts via services.fact_view — the
+    single source shared with the MCP task_scope tool. Delegated subtasks
+    render the parent scope as a read-only reference."""
+    if not task_path:
+        return None
+    effective_status = _effective_task_status(root, task_path, status)
+    if effective_status not in STAGE_CONTRACT_STATES:
+        return None
+    try:
+        from services.context_paths import load_scope_rules
+        from services.fact_view import (
+            build_stage_contract,
+            file_scope_whitelist,
+            parse_decision_anchor,
+            spec_pointer_files,
+        )
+
+        task_dir = root / task_path
+        whitelist = file_scope_whitelist(root, task_dir)
+        spec_files = spec_pointer_files(task_dir)
+        rules = load_scope_rules(root)
+        anchor_path = task_dir / "decision-anchor.md"
+        try:
+            parsed = parse_decision_anchor(
+                anchor_path.read_text(encoding="utf-8")
+            )
+        except (OSError, UnicodeDecodeError):
+            # Absent or undecodable anchor: scope/gates still render; the
+            # verify line is dropped by the empty results.
+            parsed = {"validationCommands": []}
+        except Exception as error:
+            # Never silently kill the guard block: leave a degradation trace
+            # on stderr (stdout is the injection channel).
+            sys.stderr.write(f"stage-contract degraded: {error}\n")
+            return None
+        return build_stage_contract(
+            task_path,
+            whitelist,
+            spec_files,
+            parsed,
+            mutable=status != "delegated_subtask",
+            rules=rules,
+        )
+    except Exception as error:
+        sys.stderr.write(f"stage-contract degraded: {error}\n")
+        return None
+
+
 def _load_breadcrumbs(root: Path) -> dict[str, str]:
     path = (
         root
@@ -387,10 +454,12 @@ def _subagent_runtime_lines(context: dict[str, Any]) -> list[str]:
         if isinstance(context.get("assignment"), dict)
         else {}
     )
+    # No "Scope: subagent" line here: the stage-contract block owns the scope
+    # declaration and renders the parent task's scope as a read-only reference
+    # for delegated sessions (build_stage_contract(mutable=False)).
     lines = [
         f"Runtime context: {context.get('runtime_context_id')}",
         f"Agent: {context.get('agent_type') or 'unknown'}",
-        "Scope: subagent",
         "Do not run standalone lifecycle commands, resume, archive, commit, or spawn.",
     ]
     goal = assignment.get("goal")

package/template/.cowork-flow/scripts/adapters/mcp/state_server.py

@@ -56,6 +56,46 @@ TOOLS = [
         ),
         "inputSchema": {"type": "object", "properties": {}},
     },
+    {
+        "name": "task_specs",
+        "description": (
+            "Spec files the implementing agent should read for a task, "
+            "dispatched by its dev_type (base guides + domain skills + "
+            "backend/frontend/spec pointers). Read them before coding."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "task": {
+                    "type": "string",
+                    "description": "Task directory or name.",
+                },
+            },
+        },
+    },
+    {
+        "name": "task_scope",
+        "description": (
+            "Edit-scope verdict for a task. Without `path`: the file-scope "
+            "whitelist summary (only file/planned-file/deleted-file entries "
+            "authorize edits; directories authorize nothing). With `path`: "
+            "an inScope verdict for that one file. Edits outside the scope "
+            "are review blockers."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "task": {
+                    "type": "string",
+                    "description": "Task directory or name.",
+                },
+                "path": {
+                    "type": "string",
+                    "description": "Repo-relative file path to check.",
+                },
+            },
+        },
+    },
 ]
 
 
@@ -87,17 +127,76 @@ def _tool_task_list(root: Path, _arguments: dict) -> dict:
     return {"tasks": records, "count": len(records)}
 
 
+def _resolve_task_dir(root: Path, target: str | None) -> Path:
+    from runtime.session_state import get_active_task
+    from services.task_repository import TaskRepository, TaskRepositoryError
+
+    if not target:
+        target = get_active_task(root).task_path
+        if not target:
+            raise ValueError("no-active-task")
+    try:
+        task_dir = TaskRepository(root).resolve(target)
+    except TaskRepositoryError as error:
+        raise ValueError(str(error)) from error
+    try:
+        resolved = Path(task_dir).resolve()
+        resolved.relative_to(Path(root).resolve())
+    except ValueError as error:
+        raise ValueError("task-outside-repo") from error
+    if not (Path(task_dir) / "task.json").is_file():
+        raise ValueError(f"task.json not found under {task_dir}")
+    return Path(task_dir)
+
+
+def _tool_task_scope(root: Path, arguments: dict) -> dict:
+    from services.fact_view import file_scope_whitelist, path_in_scope
+
+    task_dir = _resolve_task_dir(root, arguments.get("task"))
+    whitelist = file_scope_whitelist(root, task_dir)
+    candidate = arguments.get("path")
+    if candidate:
+        verdict = path_in_scope(whitelist, str(candidate))
+        return {"taskDir": task_dir.name, **verdict}
+    return {
+        "taskDir": task_dir.name,
+        "whitelist": whitelist,
+        "count": len(whitelist),
+    }
+
+
+def _tool_task_specs(root: Path, arguments: dict) -> dict:
+    from services.context_discovery import implement_spec_entries
+    from services.fact_view import _read_json
+
+    task_dir = _resolve_task_dir(root, arguments.get("task"))
+    task = _read_json(task_dir / "task.json")
+    dev_type = task.get("dev_type") if isinstance(task, dict) else None
+    specs = implement_spec_entries(root, dev_type)
+    return {
+        "taskDir": task_dir.name,
+        "devType": dev_type,
+        "specs": specs,
+        "count": len(specs),
+    }
+
+
 TOOL_HANDLERS = {
     "task_state": _tool_task_state,
     "task_list": _tool_task_list,
+    "task_scope": _tool_task_scope,
+    "task_specs": _tool_task_specs,
 }
 
 
 def handle_request(root: Path, request: dict) -> dict | None:
-    """Dispatch one decoded JSON-RPC message. Notifications (no id) yield
-    None and are never answered."""
+    """Dispatch one decoded JSON-RPC message. Notifications (no id member)
+    yield None and are never answered — including initialize/ping/tools/list,
+    which are requests only when an id is present."""
     method = request.get("method")
     request_id = request.get("id")
+    if "id" not in request:
+        return None
     if method == "initialize":
         requested = (request.get("params") or {}).get("protocolVersion")
         return {

package/template/.cowork-flow/scripts/infra/git_snapshot.py

@@ -58,17 +58,56 @@ def collect_changed_paths(repo_root: Path) -> list[str]:
     return [changed.path for changed in collect_changed_files(repo_root)]
 
 
-def _run_git_command(args: list[str], cwd: Path | None = None) -> tuple[int, str, str]:
-    completed = subprocess.run(
-        ["git", *args],
-        cwd=cwd,
-        text=True,
-        encoding="utf-8",
-        errors="replace",
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-        check=False,
+def collect_changed_paths_since(
+    repo_root: Path, base_commit: str | None
+) -> tuple[list[str], bool]:
+    """Merge the baseline..HEAD diff with the working-tree status:
+    (paths, degraded). Committing during a task no longer hides changed
+    files from review.
+
+    degraded=True when there is no baseline, HEAD does not exist, or the
+    diff fails (e.g. a rebase orphaned the baseline) — callers fall back to
+    status-only, which is exactly the pre-baseline behavior."""
+    status_paths = collect_changed_paths(repo_root)
+    if not base_commit:
+        return status_paths, True
+    rc, stdout, _ = _run_git_command(
+        ["diff", "--name-only", f"{base_commit}..HEAD"],
+        cwd=repo_root,
     )
+    if rc != 0:
+        return status_paths, True
+    diff_paths = [line.strip() for line in stdout.splitlines() if line.strip()]
+    merged = sorted(set(status_paths) | set(diff_paths))
+    return merged, False
+
+
+def current_head(repo_root: Path) -> str | None:
+    """Full HEAD sha of the repo, or None when no commits exist yet."""
+    rc, stdout, _ = _run_git_command(["rev-parse", "HEAD"], cwd=repo_root)
+    if rc != 0:
+        return None
+    value = stdout.strip()
+    return value or None
+
+
+def _run_git_command(args: list[str], cwd: Path | None = None) -> tuple[int, str, str]:
+    try:
+        completed = subprocess.run(
+            ["git", *args],
+            cwd=cwd,
+            text=True,
+            encoding="utf-8",
+            errors="replace",
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            check=False,
+        )
+    except OSError:
+        # git unavailable (not installed, or PATH stripped): callers degrade
+        # through the existing rc!=0 paths — no HEAD means no baseline, no
+        # changes means status-only review.
+        return 127, "", "git unavailable"
     return completed.returncode, completed.stdout, completed.stderr
 
 

package/template/.cowork-flow/scripts/infra/skill_manifest.py

@@ -414,7 +414,9 @@ def context_entries(
     paths: tuple[str, ...] = (),
     include_wildcard: bool = True,
 ) -> list[dict[str, str]]:
-    normalized_dev_type = (dev_type or "").strip()
+    normalized_dev_type = (
+        dev_type if isinstance(dev_type, str) else ""
+    ).strip()
     normalized_paths = tuple(
         str(path).replace("\\", "/").removeprefix("./") for path in paths
     )

package/template/.cowork-flow/scripts/services/context_discovery.py

@@ -110,6 +110,32 @@ def get_domain_skill_context(
     )
 
 
+def implement_spec_entries(
+    repo_root: Path,
+    dev_type: str | None,
+) -> list[dict]:
+    """Single source of the implement-context dispatch (base + domain skills
+    + dev-type spec pointers). Consumed by task context init and by the MCP
+    task_specs tool, so both agree on what an agent should read."""
+    entries = list(get_implement_base(repo_root))
+    entries.extend(
+        get_domain_skill_context(
+            repo_root,
+            dev_type=dev_type,
+        )
+    )
+    if dev_type in ("backend", "test"):
+        entries.extend(get_implement_backend())
+    elif dev_type == "frontend":
+        entries.extend(get_implement_frontend())
+    elif dev_type == "fullstack":
+        entries.extend(get_implement_backend())
+        entries.extend(get_implement_frontend())
+    elif dev_type == "spec":
+        entries.extend(get_implement_spec())
+    return entries
+
+
 def is_skill_path(file_path: str) -> bool:
     return (
         file_path.startswith(f"{DIR_AGENTS}/skills/")