gossipcat 0.4.26 → 0.4.28

package/dist-mcp/mcp-server.js

@@ -10033,7 +10033,7 @@ function coerceStatus(raw) {
   }
   return "pending";
 }
-var import_fs9, import_crypto8, import_path10, SAFE_NAME, __SKILL_ENGINE_TEST_HOOK, VALID_STATUSES, KNOWN_CATEGORIES, CATEGORY_KEYWORDS, REQUIRED_SECTIONS, BUNDLED_TEMPLATE, SkillEngine;
+var import_fs9, import_crypto8, import_path10, SAFE_NAME, __SKILL_ENGINE_TEST_HOOK, VALID_STATUSES, TECH_STACK_MIN_DEPS, MANIFEST_HINTS, KNOWN_CATEGORIES, CATEGORY_KEYWORDS, REQUIRED_SECTIONS, BUNDLED_TEMPLATE, SkillEngine;
 var init_skill_engine = __esm({
   "packages/orchestrator/src/skill-engine.ts"() {
     "use strict";
@@ -10056,6 +10056,17 @@ var init_skill_engine = __esm({
       "silent_skill",
       "insufficient_evidence"
     ];
+    TECH_STACK_MIN_DEPS = 3;
+    MANIFEST_HINTS = [
+      ["Cargo.toml", "Rust"],
+      ["pyproject.toml", "Python"],
+      ["requirements.txt", "Python"],
+      ["go.mod", "Go"],
+      ["foundry.toml", "Solidity/Foundry"],
+      ["Move.toml", "Move/Aptos/Sui"],
+      ["Gemfile", "Ruby"],
+      ["composer.json", "PHP"]
+    ];
     KNOWN_CATEGORIES = /* @__PURE__ */ new Set([
       "trust_boundaries",
       "injection_vectors",
@@ -10356,7 +10367,7 @@ NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST.
           projectContext = (0, import_fs9.readFileSync)(bootstrapPath, "utf-8").slice(0, 1500);
         }
         if (this.techStackCache === void 0) {
-          this.techStackCache = await this.detectTechStack();
+          this.techStackCache = this.readTechStackOverride() ?? await this.detectTechStack();
         }
         const techStack = this.techStackCache;
         if (techStack) {
@@ -10531,6 +10542,7 @@ ${fm}
        */
       async detectTechStack() {
         const inputs = [];
+        let totalDepCount = 0;
         const pkgPaths = [(0, import_path10.join)(this.projectRoot, "package.json")];
         try {
           const packagesDir = (0, import_path10.join)(this.projectRoot, "packages");
@@ -10546,6 +10558,7 @@ ${fm}
           try {
             const pkg = JSON.parse((0, import_fs9.readFileSync)(p, "utf-8"));
             const deps = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies });
+            totalDepCount += deps.length;
             if (deps.length > 0) {
               inputs.push(`${p.replace(this.projectRoot + "/", "")}: ${deps.join(", ")}`);
             }
@@ -10557,7 +10570,59 @@ ${fm}
           inputs.push(`Source dirs: ${srcDirs.join(", ") || "root"}`);
         } catch {
         }
-        if (inputs.length === 0) return null;
+        let manifestCount = 0;
+        for (const [filename, language] of MANIFEST_HINTS) {
+          if ((0, import_fs9.existsSync)((0, import_path10.join)(this.projectRoot, filename))) {
+            inputs.push(`Manifest: ${filename} (${language})`);
+            manifestCount++;
+          }
+        }
+        const READMES = ["README.md", "README", "readme.md"];
+        let readmeFound = false;
+        for (const name of READMES) {
+          const p = (0, import_path10.join)(this.projectRoot, name);
+          if ((0, import_fs9.existsSync)(p)) {
+            try {
+              const content = (0, import_fs9.readFileSync)(p, "utf-8");
+              const lines = content.split("\n").slice(0, 30).join("\n");
+              const clamped = lines.slice(0, 2e3);
+              if (clamped.trim()) {
+                inputs.push(`README (${name}, first ${Math.min(30, content.split("\n").length)} lines):
+${clamped}`);
+                readmeFound = true;
+                break;
+              }
+            } catch {
+            }
+          }
+        }
+        const EXCLUDED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".gossip", "dist", "build", "out", "coverage"]);
+        const EXCLUDED_EXTS = /* @__PURE__ */ new Set([".json", ".md", ".yaml", ".yml", ".toml", ".lock", ".txt", ".xml", ".ini", ".cfg", ".env", ".gitignore", ".gitattributes", ".editorconfig", ".npmrc", ".nvmrc", ".prettierrc", ".eslintrc", ".babelrc", ".dockerignore", ".flowconfig"]);
+        let extensionSignal = false;
+        try {
+          const entries = (0, import_fs9.readdirSync)(this.projectRoot, { withFileTypes: true });
+          const extCounts = /* @__PURE__ */ new Map();
+          for (const entry of entries) {
+            if (EXCLUDED_DIRS.has(entry.name)) continue;
+            if (entry.isFile()) {
+              const dotIdx = entry.name.lastIndexOf(".");
+              if (dotIdx > 0) {
+                const ext = entry.name.slice(dotIdx).toLowerCase();
+                if (!EXCLUDED_EXTS.has(ext)) {
+                  extCounts.set(ext, (extCounts.get(ext) ?? 0) + 1);
+                }
+              }
+            }
+          }
+          if (extCounts.size > 0) {
+            const sorted = Array.from(extCounts.entries()).sort((a, b) => b[1] - a[1]).slice(0, 10).map(([ext, count]) => `${ext}(${count})`).join(", ");
+            inputs.push(`Root file extensions: ${sorted}`);
+            extensionSignal = true;
+          }
+        } catch {
+        }
+        const hasNonNodeSignal = manifestCount > 0 || readmeFound || extensionSignal;
+        if (totalDepCount < TECH_STACK_MIN_DEPS && !hasNonNodeSignal) return null;
         try {
           const messages = [{
             role: "user",
@@ -10579,6 +10644,35 @@ ${inputs.join("\n")}
           return inputs.join("\n").slice(0, 500);
         }
       }
+      /**
+       * Reads `.gossip/tech-stack.md` as a user-authored override for tech-stack
+       * detection. Returns the file content (clamped to 2000 chars) if present and
+       * non-empty, or null to fall through to auto-detect.
+       *
+       * Operator escape hatch for non-Node host projects (Solidity, Rust, Move, etc.)
+       * where the LLM hallucinates a Node.js stack from thin npm dep signal.
+       * Cache is session-stable via techStackCache — restart the MCP server to pick
+       * up edits to this file.
+       */
+      readTechStackOverride() {
+        const overridePath = (0, import_path10.join)(this.projectRoot, ".gossip", "tech-stack.md");
+        if (!(0, import_fs9.existsSync)(overridePath)) return null;
+        try {
+          const { size } = (0, import_fs9.statSync)(overridePath);
+          if (size > 2048) {
+            process.stderr.write(`[skill-engine] tech-stack.md override is ${size} bytes, clamping to 2000 chars
+`);
+          }
+          const content = (0, import_fs9.readFileSync)(overridePath, "utf-8").slice(0, 2e3).trim();
+          if (!content) return null;
+          return content;
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          process.stderr.write(`[skill-engine] tech-stack.md override read failed: ${msg}
+`);
+          return null;
+        }
+      }
       loadCategoryFindings(category) {
         const filePath = (0, import_path10.join)(this.projectRoot, ".gossip", "agent-performance.jsonl");
         if (!(0, import_fs9.existsSync)(filePath)) return [];
@@ -16468,7 +16562,7 @@ var init_parse_findings = __esm({
     TYPE_ATTR_PATTERN = /type="([a-zA-Z]+)"/;
     SEVERITY_ATTR_PATTERN = /severity="(critical|high|medium|low)"/;
     CATEGORY_ATTR_PATTERN = /category="([a-z_]+)"/;
-    ANCHOR_PATTERN = /[\w./-]+\.(ts|js|tsx|jsx|py|go|rs|java|rb|md|json|yaml|yml|toml|sh):\d+/;
+    ANCHOR_PATTERN = /(?:[a-zA-Z]:\/)?[\w./-]+\.(ts|js|tsx|jsx|py|go|rs|java|rb|md|json|yaml|yml|toml|sh):\d+/;
     CANONICAL_TYPES = /* @__PURE__ */ new Set(["finding", "suggestion", "insight"]);
     HTML_ENTITY_OPEN_PATTERN = /&lt;agent_finding\b/gi;
     HTML_ENTITY_CLOSE_PATTERN = /&lt;\/agent_finding&gt;/gi;
@@ -16642,7 +16736,7 @@ var init_consensus_engine = __esm({
     };
     MIN_FINDINGS_PER_PEER = 2;
     VALID_ACTIONS = /* @__PURE__ */ new Set(["agree", "disagree", "unverified", "new"]);
-    ANCHOR_PATTERN2 = /[\w./-]+\.(ts|js|tsx|jsx|py|go|rs|java|rb|md|json|yaml|yml|toml|sh):\d+/;
+    ANCHOR_PATTERN2 = /(?:[a-zA-Z]:\/)?[\w./-]+\.(ts|js|tsx|jsx|py|go|rs|java|rb|md|json|yaml|yml|toml|sh):\d+/;
     MAX_VERIFIER_TURNS = 7;
     VERIFIER_TOOLS = [
       { name: "file_read", description: "Read file contents", parameters: { type: "object", properties: { path: { type: "string", description: "Absolute or project-relative file path" }, startLine: { type: "number", description: "First line to read (1-based)" }, endLine: { type: "number", description: "Last line to read (inclusive)" } }, required: ["path"] } },
@@ -17668,7 +17762,7 @@ Return only valid JSON.${skillsBlock}`;
        */
       async snippetsForFinding(findingText, maxSnippets = 3) {
         if (!this.config.projectRoot && this.currentWorktreeRoots.size === 0) return "";
-        const citationPattern = /((?:[\w./-]+\/)?([a-zA-Z][\w.-]+\.[a-z]{1,6})):(\d+)/g;
+        const citationPattern = /((?:[a-zA-Z]:\/)?(?:[\w./-]+\/)?([a-zA-Z][\w.-]+\.[a-z]{1,6})):(\d+)/g;
         const CONTEXT_LINES = 2;
         const MAX_FILE_SIZE2 = 10 * 1024 * 1024;
         const anchors = [];
@@ -17689,7 +17783,7 @@ Return only valid JSON.${skillsBlock}`;
               anchors.push(`\u26A0 Agent cited \`${safeRef}:${lineNum}\` but file not found`);
               continue;
             }
-            const resolvedFromProjectRoot = this.currentWorktreeRoots.size > 0 && this.config.projectRoot && filePath.startsWith((0, import_path28.resolve)(this.config.projectRoot) + "/");
+            const resolvedFromProjectRoot = this.isResolvedFromProjectRootOnly(filePath);
             const fileStat = await (0, import_promises3.stat)(filePath);
             if (fileStat.size > MAX_FILE_SIZE2) continue;
             const content = await this.cachedRead(filePath);
@@ -17723,7 +17817,7 @@ ${safeSnippet}
             const trimmed = value.trim();
             if (!trimmed || trimmed.length > 80) continue;
             if (tag === "file") {
-              const fileMatch = trimmed.match(/^((?:[\w./-]+\/)?([a-zA-Z][\w.-]+\.[a-z]{1,6})):(\d+)$/);
+              const fileMatch = trimmed.match(/^((?:[a-zA-Z]:\/)?(?:[\w./-]+\/)?([a-zA-Z][\w.-]+\.[a-z]{1,6})):(\d+)$/);
               if (fileMatch && !seen.has(trimmed)) {
                 seen.add(trimmed);
                 const fullRef = fileMatch[1];
@@ -17733,7 +17827,7 @@ ${safeSnippet}
                   const safeRef = fullRef.replace(/["<>]/g, "");
                   const filePath = await this.cachedResolveForAnchor(fullRef) ?? await this.cachedResolveForAnchor(bareFile);
                   if (filePath) {
-                    const resolvedFromProjectRoot = this.currentWorktreeRoots.size > 0 && this.config.projectRoot && filePath.startsWith((0, import_path28.resolve)(this.config.projectRoot) + "/");
+                    const resolvedFromProjectRoot = this.isResolvedFromProjectRootOnly(filePath);
                     const content = await this.cachedRead(filePath);
                     if (content) {
                       const fileLines = content.split("\n");
@@ -17813,7 +17907,7 @@ ${safeSnippet}
           return false;
         }
         const stripped = evidence.replace(/```[\s\S]*?```/g, "").replace(/`[^`\n]*`/g, "").replace(/<example>[\s\S]*?<\/example>/gi, "").replace(/"[^"\n]*"/g, "").replace(/'[^'\n]*'/g, "");
-        const citationPattern = /(?:[\w./-]+\/)?([a-zA-Z][\w.-]+\.[a-z]{1,6}):(\d+)/g;
+        const citationPattern = /(?:(?:[a-zA-Z]:\/)?(?:[\w./-]+\/)?)?([a-zA-Z][\w.-]+\.[a-z]{1,6}):(\d+)/g;
         const rawCitations = [];
         let match;
         while ((match = citationPattern.exec(stripped)) !== null) {
@@ -17859,6 +17953,28 @@ ${safeSnippet}
        * worktree can still be auto-anchored when consensus runs back in the main
        * MCP process).
        */
+      /**
+       * Returns true when filePath falls under projectRoot but NOT inside any
+       * active worktree root.  This is the condition that warrants the
+       * "⚠ resolved against project root, NOT worktree" attribute — the file
+       * was found via the projectRoot fallback, meaning it reflects master HEAD,
+       * not the branch under review.
+       *
+       * The previous inline check used only a startsWith(projectRoot) test, which
+       * produced a false-positive when the worktree itself is nested under
+       * projectRoot (the standard `.claude/worktrees/agent-X` layout): a worktree
+       * file like /x/.claude/worktrees/agent-Y/foo.ts passes startsWith(/x/)
+       * even though it was correctly resolved via the worktree priority root.
+       *
+       * Fix: additionally verify the path is NOT inside any currentWorktreeRoot
+       * via isInsideAnyRoot, which applies realpath-safe containment checks.
+       */
+      isResolvedFromProjectRootOnly(filePath) {
+        if (this.currentWorktreeRoots.size === 0) return false;
+        if (!this.config.projectRoot) return false;
+        if (!filePath.startsWith((0, import_path28.resolve)(this.config.projectRoot) + "/")) return false;
+        return !this.isInsideAnyRoot(filePath, [...this.currentWorktreeRoots]);
+      }
       /**
        * Guard: resolved path must stay inside one of the valid roots, with
        * symlink-safe containment.
@@ -19063,7 +19179,7 @@ function detectFormatCompliance(result) {
   const tags_dropped_unknown_type = Object.values(parseRes.droppedUnknownType).reduce((a, b) => a + b, 0) + parseRes.droppedMissingType;
   const tags_dropped_short_content = parseRes.droppedShortContent;
   const findingCount = (body.match(/<agent_finding[\s>]/g) ?? []).length;
-  const citationCount = (body.match(/\b[\w./-]+\.\w+:\d+\b/g) ?? []).length;
+  const citationCount = (body.match(/\b(?:[a-zA-Z]:\/)?[\w./-]+\.\w+:\d+\b/g) ?? []).length;
   const formatCompliant = tags_accepted > 0 && citationCount >= tags_accepted;
   const diagnostics = [...parseRes.diagnostics];
   if (truncated) {
@@ -23313,7 +23429,7 @@ var init_dedupe_key = __esm({
   "packages/orchestrator/src/dedupe-key.ts"() {
     "use strict";
     import_crypto15 = require("crypto");
-    ANCHOR_PATTERN3 = /[\w./-]+\.(ts|js|tsx|jsx|py|go|rs|java|rb|md|json|yaml|yml|toml|sh):\d+/;
+    ANCHOR_PATTERN3 = /(?:[a-zA-Z]:\/)?[\w./-]+\.(ts|js|tsx|jsx|py|go|rs|java|rb|md|json|yaml|yml|toml|sh):\d+/;
     MIN_NORMALIZED_CONTENT_LENGTH = 32;
     DEDUPE_KEY_INTERNALS = {
       MIN_NORMALIZED_CONTENT_LENGTH,
@@ -31022,11 +31138,11 @@ var init_routes = __esm({
         }
         if (!existsSync68(reportsDir)) return { reports: [], totalReports: 0, page, pageSize, retractedConsensusIds, roundRetractions };
         try {
-          const { statSync: statSync32 } = require("fs");
+          const { statSync: statSync33 } = require("fs");
           const allFiles = readdirSync22(reportsDir).filter((f) => f.endsWith(".json")).sort((a, b) => {
             try {
-              const aTime = statSync32((0, import_path68.join)(reportsDir, a)).mtimeMs;
-              const bTime = statSync32((0, import_path68.join)(reportsDir, b)).mtimeMs;
+              const aTime = statSync33((0, import_path68.join)(reportsDir, a)).mtimeMs;
+              const bTime = statSync33((0, import_path68.join)(reportsDir, b)).mtimeMs;
               return bTime - aTime;
             } catch {
               return 0;
@@ -49337,7 +49453,10 @@ async function resolveDispatchResolutionRoots(dispatchResolutionRoots) {
         );
       }
       if (discovered.length > 0) {
-        effectiveRoots = discovered;
+        const hashedPaths = discovered.map((d) => hashPath(d));
+        warnings.push(
+          `autoDiscoverWorktrees: ${discovered.length} sibling worktree(s) discovered but auto-promotion is disabled. Pass resolutionRoots to gossip_dispatch to pin cross-reviewers to a specific worktree. Discovered (hashed): ${hashedPaths.join(", ")}`
+        );
       } else if (rejected.length > 0) {
         warnings.push(
           `autoDiscoverWorktrees: ${rejected.length} candidate(s) failed validation; cross-review will use projectRoot only. See stderr for rejection reasons.`
@@ -50046,10 +50165,10 @@ ${t.skillWarnings.map((w) => `  - ${w}`).join("\n")}`;
       if (!mainLlm) {
         return { content: [{ type: "text", text: "Error: No LLM configured for consensus. Check gossip_setup." }] };
       }
-      const { PerformanceReader: PerformanceReader3, discoverGitWorktrees: discoverGitWorktrees2 } = await Promise.resolve().then(() => (init_src4(), src_exports3));
+      const { PerformanceReader: PerformanceReader3, discoverGitWorktrees: discoverGitWorktrees2, hashPath: hashPath2 } = await Promise.resolve().then(() => (init_src4(), src_exports3));
       const performanceReader = new PerformanceReader3(process.cwd());
       const explicitRoots = resolutionRoots ?? [];
-      let effectiveRoots = explicitRoots;
+      const effectiveRoots = explicitRoots;
       try {
         const { findConfigPath: findConfigPath2, loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
         const cfgPath = findConfigPath2(process.cwd());
@@ -50062,7 +50181,13 @@ ${t.skillWarnings.map((w) => `  - ${w}`).join("\n")}`;
 `
             );
           }
-          effectiveRoots = [...explicitRoots, ...discovered];
+          if (discovered.length > 0) {
+            const hashedPaths = discovered.map((d) => hashPath2(d));
+            process.stderr.write(
+              `[consensus] autoDiscoverWorktrees: ${discovered.length} sibling worktree(s) discovered but auto-promotion is disabled (issue #402). Pass resolutionRoots to gossip_collect to pin cross-reviewers. Discovered (hashed): ${hashedPaths.join(", ")}
+`
+            );
+          }
         }
       } catch (err) {
         process.stderr.write(`[consensus] auto-discovery failed: ${err.message}
@@ -52109,7 +52234,7 @@ Note: write-mode classification unavailable on this native-only install \u2014 a
       } catch {
       }
       try {
-        const { readdirSync: readdirSync22, statSync: statSync32 } = await import("fs");
+        const { readdirSync: readdirSync22, statSync: statSync33 } = await import("fs");
         const { readJsonlWithRotated: readJsonlRotated1506 } = await Promise.resolve().then(() => (init_src4(), src_exports3));
         const reportsDir = (0, import_path84.join)(process.cwd(), ".gossip", "consensus-reports");
         const perfPath = (0, import_path84.join)(process.cwd(), ".gossip", "agent-performance.jsonl");
@@ -52120,7 +52245,7 @@ Note: write-mode classification unavailable on this native-only install \u2014 a
           for (const fname of readdirSync22(reportsDir)) {
             if (!fname.endsWith(".json")) continue;
             const fpath = (0, import_path84.join)(reportsDir, fname);
-            const st = statSync32(fpath);
+            const st = statSync33(fpath);
             if (now - st.mtimeMs > WINDOW_MS2) continue;
             recentReports.push({ id: fname.replace(/\.json$/, ""), mtimeMs: st.mtimeMs });
           }

package/docs/HANDBOOK.md

@@ -228,6 +228,12 @@ If `format_compliance` signals a sudden drop for an agent that was fine last rou
 
 When blocked, the error message shows age + remaining cooldown + override instruction. Pass `force: true` to bypass; every override is appended to `.gossip/forced-skill-develops.jsonl` for auditability. Chronic override patterns on an agent+category pair are a signal that the skill prompt is ineffective or `MIN_EVIDENCE` is miscalibrated for that category — investigate before reflexively forcing.
 
+### Tech-stack override
+
+Drop a `.gossip/tech-stack.md` at the project root to bypass auto-detection on `gossip_skills(action: "develop")`. Content (max 2000 chars after trim) is injected verbatim into the skill-develop prompt's `<tech_stack>` block, replacing the auto-detected description. Useful for non-Node host projects (Solidity, Rust, Move, audit workspaces) where the LLM hallucinates a Node.js stack from thin npm dep signal (issue #410, PR #411 floor + this override). Cache is session-stable — restart the MCP server to pick up edits. Empty file or read errors fall through to auto-detect (with stderr warning on errors). Files over 2 KB are clamped with a stderr warning.
+
+**Tech-stack auto-detection.** When no override is present and the npm dep count is below `TECH_STACK_MIN_DEPS=3` OR the project is non-Node, `detectTechStack` scans the project root for known manifests (Cargo.toml, pyproject.toml, requirements.txt, go.mod, foundry.toml, Move.toml, Gemfile, composer.json), the README first 30 lines / 2 KB, and a shallow file-extension census (root only, excluding `node_modules`/`.git`/`.gossip`/`dist`/`build`/`out`/`coverage`, capped at 10 extension types; Config/docs extensions (`.json`, `.md`, `.yaml`, `.toml`, `.lock`, common dotfiles like `.prettierrc`/`.eslintrc`/`.dockerignore`/etc.) are excluded from the census — they're either ubiquitous across project types (carrying no toolchain signal) or already covered elsewhere (npm deps via `package.json`, language via manifests). Trade-off: Kubernetes / Ansible projects whose primary source is `.yaml` will receive less detection signal from the census; use `.gossip/tech-stack.md` for those). Any non-Node signal — manifest match, README content, or extension census — bypasses the `MIN_DEPS=3` floor so polyglot projects don't need the override file. Workspace-level manifests (e.g., `packages/contracts/foundry.toml`) are NOT scanned in this MVP; place the manifest at root or use `.gossip/tech-stack.md` for those cases.
+
 ### Verifying UNVERIFIED findings
 
 When a consensus report has `UNVERIFIED` findings (cross-reviewer couldn't check), **you must verify them yourself before presenting results**. UNVERIFIED means "the peer didn't have the tools or context to check" — you do. Read the cited files, grep for the identifiers, confirm or reject. Do not show raw consensus output with unexamined UNVERIFIED findings.
@@ -246,7 +252,7 @@ gossip_collect({
 
 Without `resolutionRoots`, citations to files that only exist in the worktree resolve against `projectRoot` → `⚠ file not found` → every cross-reviewer marks UNVERIFIED → the round produces zero verified findings. `resolutionRoots` runs each path through a validator (NUL reject, `..` reject, realpath, ownership check, git-common-dir match, `git worktree list` membership) before adding it to the citation-resolver trust zone.
 
-Secondary: `consensus.autoDiscoverWorktrees: true` in `.gossip/config.json` auto-discovers all git worktrees at round start (opt-in, default off) — convenience for users who routinely run consensus on feature branches. Same validator applies.
+Secondary: `consensus.autoDiscoverWorktrees: true` in `.gossip/config.json` is DISCOVERY-ONLY (opt-in, default off). When enabled, it logs a warning listing hashed paths of sibling git worktrees so operators know which branches exist — but it does NOT auto-route cross-reviewers to any of them. You must still pass explicit `resolutionRoots` to `gossip_dispatch` (or `gossip_collect`) to pin cross-reviewers to a specific worktree. Per consensus c6b8580d-595e48d2 + issue #402, prior auto-promotion behaviour was a foot-gun: it silently routed reviews to the wrong branch when multiple worktrees existed. Same validator applies to anything you do pass explicitly.
 
 See spec `docs/specs/2026-04-17-issue-126.md` for the full design.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gossipcat",
-  "version": "0.4.26",
+  "version": "0.4.28",
   "description": "Multi-agent orchestration for Claude Code — parallel review, consensus, adaptive dispatch",
   "mcpName": "io.github.ataberk-xyz/gossipcat",
   "repository": {