devrites 3.2.8 → 3.2.9

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to DevRites are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and DevRites adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Releases are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from Conventional Commits on `main`.
 
+## [3.2.9](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.8...v3.2.9) (2026-07-26)
+
+### Fixed
+
+* **devrites:** unblock retained reconcile checks ([c1093b0](https://github.com/ViktorsBaikers/DevRites/commit/c1093b00c3e32ba3cc22e0b9a2da548618ead621))
+
 ## [3.2.8](https://github.com/ViktorsBaikers/DevRites/compare/v3.2.7...v3.2.8) (2026-07-26)
 
 ### Fixed

package/README.md

@@ -25,7 +25,7 @@ final commit, push, and tag, and it requires a typed `GO` confirmation.
 Unattended runs may create local WIP checkpoint commits along the way, but only
 Ship collapses and pushes them.
 
-**Status:** [`v3.2.8`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.8): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
+**Status:** [`v3.2.9`](https://github.com/ViktorsBaikers/DevRites/releases/tag/v3.2.9): see [`CHANGELOG.md`](CHANGELOG.md) for release notes.
 
 ## Quick start
 

package/docs/orchestration.md

@@ -69,6 +69,14 @@ Each dispatch follows the retained-baseline sequence:
 5. After proof and decision checks pass, `reconcile close` retires the private
    window; only then does the root write canonical records.
 
+An ordinary `reconcile check` may revalidate an existing retained window
+without a fresh current-turn wright receipt; it does not retire or widen that
+window. `reconcile close` still requires the confirmed, awaited wright result
+bound to the active snapshot. While the window is armed, the root guard permits
+inspectable writes only under `.devrites` or at an absolute scratch path outside
+the project; source-tree writes, relative escapes, and opaque execution remain
+blocked.
+
 The canonical-state fingerprint excludes root-owned operational records:
 `timeline.jsonl`, feature `events.jsonl`, a valid `recovery-attempts.jsonl`,
 the redwatch sentinel, automatic handoff snapshots, and hidden hook observation

package/engine/hooks_agent_dispatch.go

@@ -33,7 +33,7 @@ var (
 	devritesAgentPathRe = regexp.MustCompile(`\.codex/agents/(devrites-[a-z0-9-]+)\.toml`)
 	devritesAgentNameRe = regexp.MustCompile(`^devrites-[a-z0-9-]+$`)
 	skillInvocationRe   = regexp.MustCompile(`(?i)(?:^|[^a-z0-9_./-])(?:\$|/)([a-z][a-z0-9-]*)\b`)
-	reconcileTerminalRe = regexp.MustCompile(`(?m)(?:^|[;&|]\s*)(?:rtk\s+)?(?:[A-Za-z0-9_./-]+/)?devrites-engine\s+reconcile\s+(?:check|close)\b`)
+	reconcileCloseRe    = regexp.MustCompile(`(?m)(?:^|[;&|]\s*)(?:rtk\s+)?(?:[A-Za-z0-9_./-]+/)?devrites-engine\s+reconcile\s+close\b`)
 )
 
 type agentDispatchHookInput struct {
@@ -1163,7 +1163,7 @@ func hookAgentDispatchPreTool(h harness.Harness, root string, in agentDispatchHo
 		return exitOK
 	}
 
-	if isShellTool(in.ToolName) && reconcileTerminalRe.MatchString(in.ToolInput.Command) {
+	if isShellTool(in.ToolName) && reconcileCloseRe.MatchString(in.ToolInput.Command) {
 		windowID := currentReconcileWindowID()
 		if windowID == "" {
 			return exitOK
@@ -1177,7 +1177,7 @@ func hookAgentDispatchPreTool(h harness.Harness, root string, in agentDispatchHo
 			}
 			attempts = append(attempts, durable...)
 			if !roleSatisfied("devrites-slice-wright", windowID, attempts) {
-				return preToolDeny(h, "DevRites reconcile check/close requires a confirmed, awaited devrites-slice-wright result bound to the active reconcile snapshot.", stdout, stderr)
+				return preToolDeny(h, "DevRites reconcile close requires a confirmed, awaited devrites-slice-wright result bound to the active reconcile snapshot.", stdout, stderr)
 			}
 			for _, attempt := range durable {
 				if attempt.Role != "devrites-slice-wright" || attempt.WindowID != windowID ||

package/engine/hooks_workspace.go

@@ -1024,8 +1024,9 @@ func guardRootBuildWindow(h harness.Harness, data []byte, in harness.GuardInput,
 	}
 	targets, suspicious := rootMutationTargets(data, in)
 	for _, target := range targets {
+		absoluteTarget := filepath.IsAbs(target)
 		abs := target
-		if !filepath.IsAbs(abs) {
+		if !absoluteTarget {
 			abs = filepath.Join(projectDir, abs)
 		}
 		abs = filepath.Clean(abs)
@@ -1033,7 +1034,9 @@ func guardRootBuildWindow(h harness.Harness, data []byte, in harness.GuardInput,
 		if err != nil {
 			return denyWright(h, stdout, stderr, a1DenyReason, drvreason.HookA1Denied), true
 		}
-		if !underDevrites(resolved, root) {
+		insideProject := pathWithin(resolved, projectDir)
+		if (insideProject && !underDevrites(resolved, root)) ||
+			(!insideProject && !absoluteTarget) {
 			return denyWright(h, stdout, stderr, a1DenyReason, drvreason.HookA1Denied), true
 		}
 	}

package/engine/tests/hook_test.go

@@ -583,6 +583,11 @@ func TestHookWrightScopeRequiresSpawnedCodexWorkerForSourceWrites(t *testing.T)
 	runGuard(`{"tool_name":"spawn_agent","tool_input":{"agent_type":"worker"}}`, false)
 	runGuard(`{"tool_name":"spawn_agent","tool_input":{"agent_type":"explorer"}}`, false)
 	runGuard(`{"tool_name":"Write","tool_input":{"file_path":".devrites/features/auth-tokens/state.md"}}`, false)
+	runGuard(hookPayload(t, map[string]any{
+		"tool_name":  "Write",
+		"tool_input": map[string]any{"file_path": filepath.Join(t.TempDir(), "agent-packet.yaml")},
+	}), false)
+	runGuard(`{"tool_name":"Write","tool_input":{"file_path":"../outside.txt"}}`, true)
 	runGuard(`{"tool_name":"Write","tool_input":{"file_path":"src/app.go"}}`, true)
 	runGuard(`{"tool_name":"Bash","tool_input":{"command":"printf x > src/app.go"}}`, true)
 	runGuard(`{"tool_name":"js","tool_input":{"code":"writeFile()"}}`, true)
@@ -1695,7 +1700,7 @@ func TestCodexAgentDispatchRejectsIncompleteDurableV2(t *testing.T) {
 	}
 }
 
-func TestCodexAgentDispatchGatesReconcileOnBoundWrightResult(t *testing.T) {
+func TestCodexAgentDispatchGatesReconcileCloseOnBoundWrightResult(t *testing.T) {
 	root := newWorkspace(t)
 	writeActive(t, root, "auth-tokens")
 	workspace := filepath.Join(root, "features", "auth-tokens")
@@ -1714,14 +1719,26 @@ func TestCodexAgentDispatchGatesReconcileOnBoundWrightResult(t *testing.T) {
 		"prompt":          "$rite-build",
 	}), nil, "hook", "agent-dispatch", "--harness=codex")
 
-	reconcile := hookPayload(t, map[string]any{
+	check := hookPayload(t, map[string]any{
+		"hook_event_name": "PreToolUse",
+		"session_id":      sessionID,
+		"turn_id":         turnID,
+		"tool_name":       "Bash",
+		"tool_input":      map[string]any{"command": "rtk devrites-engine reconcile check"},
+	})
+	if out, stderr, code := runDevritesIO(t, root, check, nil,
+		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
+		t.Fatalf("ordinary reconcile check exit=%d out=%s stderr=%s", code, out, stderr)
+	}
+
+	closeWindow := hookPayload(t, map[string]any{
 		"hook_event_name": "PreToolUse",
 		"session_id":      sessionID,
 		"turn_id":         turnID,
 		"tool_name":       "Bash",
 		"tool_input":      map[string]any{"command": "rtk devrites-engine reconcile close"},
 	})
-	out, _, _ := runDevritesIO(t, root, reconcile, nil,
+	out, _, _ := runDevritesIO(t, root, closeWindow, nil,
 		"hook", "agent-dispatch", "--harness=codex")
 	if decision, reason := parsePermissionDecision(t, out); decision != "deny" ||
 		!strings.Contains(reason, "confirmed") {
@@ -1774,7 +1791,7 @@ func TestCodexAgentDispatchGatesReconcileOnBoundWrightResult(t *testing.T) {
 		}
 	}
 
-	if out, stderr, code := runDevritesIO(t, root, reconcile, nil,
+	if out, stderr, code := runDevritesIO(t, root, closeWindow, nil,
 		"hook", "agent-dispatch", "--harness=codex"); code != 0 || strings.TrimSpace(out) != "" {
 		t.Fatalf("completed wright reconcile exit=%d out=%s stderr=%s", code, out, stderr)
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.8",
+  "version": "3.2.9",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",