jules-orchestrator-kit 0.32.5 → 0.32.6

package/JULES_RULES_TEMPLATE.md

@@ -92,8 +92,9 @@ To maximize the ratio of mergeable PRs vs. failed or hallucinated sessions, adhe
 
 - **Multi-Agent Mutex Lock Protocol**: Prevent concurrent file modification collisions. Check and acquire locks before modifying paths:
   ```bash
-  node scripts/lock-manager.mjs acquire <agent_name> <task_id> <file_paths...> --unattended
+  agentctl lock acquire <agent_name> <task_id> <file_path...>
   ```
+  Inspect holders with `agentctl lock status` and hand back with `agentctl lock release <task_id>`. A conflicting acquire exits `1` and names the current holder.
 - **The Baton Pass Protocol**: Write handover documents when a session pauses or hands off work (e.g. `.agent/history/YYYY-MM-DD-handover-[task_id].md`).
 
 ### Standard Jules Guardrails Footer

package/README.md

@@ -88,7 +88,7 @@ Autonomous coding agents can write software at 100× human speed—but unconstra
 
 `jules-orchestrator-kit` provides the missing **Safety, Orchestration, and Verification Kernel** for high-reliability AI agent deployments:
 
-* **🔥 Warm Multi-Turn Session Resumption (`v0.31.0`):** Streams OODA repair prompts directly into active Google Jules session streams via `POST /v1alpha/sessions/{id}:sendMessage`, saving 60–80% context tokens while preserving reasoning context.
+* **🔥 Warm Multi-Turn Session Resumption (`v0.31.0`):** `agentctl resume <sessionId> --response "<reply>"` streams an engineer's reply directly into an active Google Jules session via `POST /v1alpha/sessions/{id}:sendMessage`, preserving reasoning context instead of paying to rebuild it, with fail-soft cold-dispatch fallback on HTTP 400/404. This is the asynchronous HITL unblocking path; the automatic OODA repair loop currently opens a fresh session per attempt (see [architecture.md](docs/architecture.md#on-warm-session-resumption)).
 
 * **🧪 Automated TDD Red-to-Green Harness (`agentctl test-gen`):** Scaffolds falsifiable unit tests from bug specs, verifies **RED** failure state, locks the test file in `scope.deny`, and tasks Jules with making it pass (**GREEN** state).
 
@@ -102,7 +102,7 @@ Autonomous coding agents can write software at 100× human speed—but unconstra
 
 * **🔒 Zero Runtime Dependencies:** Built exclusively on Node.js 20+ built-ins (`node:fs`, `node:child_process`, `node:crypto`, `node:path`, `node:http`, `node:tty`, `node:test`). Zero third-party npm packages mean zero supply-chain CVE risk.
 
-* **🛡️ Fail-Closed Security Gatekeeper:** Unconditionally evaluates explicit Deny rules *before* Allow rules, redacts high-entropy secrets and PII from dry-runs and git diffs, blocks unsupported Node.js native module imports in Edge environments (Cloudflare Workers, Vercel Edge, Netlify Edge), and rejects PRs exceeding the 75 KB Diff Payload governor.
+* **🛡️ Fail-Closed Security Gatekeeper:** Unconditionally evaluates explicit Deny rules *before* Allow rules, matching against **canonicalised, case-folded paths** so `./`, `..`, mixed separators or a `.GitHub/` spelling cannot walk past a rule (the same repo is checked out on case-insensitive macOS and Windows filesystems). Redacts high-entropy secrets and PII from dry-runs and git diffs, blocks unsupported Node.js native module imports in Edge environments (Cloudflare Workers, Vercel Edge, Netlify Edge), and rejects PRs exceeding the 75 KB Diff Payload governor.
 
 * **🔄 Autonomous OODA Self-Healing:** Captures test stderr/stdout, normalizes failure fingerprints, and feeds structured error contexts back into repair iterations (up to 3 automatic attempts) before human escalation.
 
@@ -120,7 +120,7 @@ Autonomous coding agents can write software at 100× human speed—but unconstra
 
 * **🚀 Zero-Test Bootstrapping (`agentctl bootstrap`):** Synthesizes deterministic syntax-check and smoke-test verification oracles for untested legacy repositories so agents always operate against a falsifiable feedback loop.
 
-* **📈 Proven Scale & Reliability:** Empirically tested with **421 unit tests across 59 suites passing in < 8.0s**, supporting 300+ daily agent sessions per repository.
+* **📈 Proven Scale & Reliability:** Empirically tested with **458 unit tests across 66 suites passing in < 10.0s**, supporting 300+ daily agent sessions per repository. An adversarial red-team suite (`test/adversarial-claims.test.mjs`) continuously attempts to falsify the safety guarantees documented above — including cross-platform probes for the case-insensitive filesystems on macOS and Windows — and a documentation-sync gate (`scripts/doc-sync-check.mjs`) blocks any release whose docs have drifted from the code.
 
 <br/>
 
@@ -470,8 +470,8 @@ npx jules-orchestrator-kit mcp
 
 | Feature | Module / Command | Architectural Description | Target Release |
 | :--- | :--- | :--- | :---: |
-| **Dynamic Complexity & Cost Router** | `src/router.mjs`, `router:` in `.agent/config.yml` | Provider-agnostic, zero-dependency heuristic classifier routing trivial tasks to a fast/cheap provider (`gemini-flash` preset included) and complex/safety-sensitive tasks to the primary provider; opt-in, `--tier` override. | **Unreleased** *(main)* |
-| **DAG Task Queue, Specialist Roles & Evidence Ledger** | `src/dag-engine.mjs`, `src/evidence.mjs`, `agentctl evidence` | Kahn's-algorithm dependency-ordered queue execution (`queue --dag`), `--role` specialist prompt resolution, and SHA-256 cryptographic evidence manifests with test-tamper locking. | **Unreleased** *(main)* |
+| **Dynamic Complexity & Cost Router** | `src/router.mjs`, `router:` in `.agent/config.yml` | Provider-agnostic, zero-dependency heuristic classifier routing trivial tasks to a fast/cheap provider (`gemini-flash` preset included) and complex/safety-sensitive tasks to the primary provider; opt-in, `--tier` override. | **v0.32.5** *(Shipped)* |
+| **DAG Task Queue, Specialist Roles & Evidence Ledger** | `src/dag-engine.mjs`, `src/evidence.mjs`, `agentctl evidence` | Kahn's-algorithm dependency-ordered queue execution (`queue --dag`), `--role` specialist prompt resolution, and SHA-256 cryptographic evidence manifests with test-tamper locking. | **v0.32.5** *(Shipped)* |
 | **Warm Session Resumption & PR Bundler** | `src/provider.mjs`, `src/engine.mjs` | Multi-turn warm session context streaming via `POST /v1alpha/sessions/{id}:sendMessage` & evidence PR descriptions. | **v0.31.0** *(Shipped)* |
 | **TDD Harness & Prompt Falsifiability Linter** | `agentctl test-gen`, `agentctl task optimize` | Automated RED-state test generator, `scope.deny` test locking, and prompt testability linter with fuzzy path resolution. | **v0.31.0** *(Shipped)* |
 | **Atomic Git Checkpoint & Rollback** | `agentctl rollback` (`src/ops/checkpoint.mjs`) | Pre-flight git HEAD/stash snapshotting, atomic rollback restoration, and 10-session pruning rotation. | **v0.31.0** *(Shipped)* |

package/bin/agentctl.mjs

@@ -12,11 +12,11 @@ import { reapOrphanedIntents, reapStaleMutexDirs } from "../src/journal.mjs";
 const args = process.argv.slice(2);
 const command = args[0];
 
-export const VERSION = "0.32.5";
+export const VERSION = "0.32.6";
 
 export function printHelp() {
   console.log(`
-🚀 agentctl v0.32.5 — Universal Agent Orchestrator & Safety Gatekeeper
+🚀 agentctl v0.32.6 — Universal Agent Orchestrator & Safety Gatekeeper
 
 Usage: agentctl <command> [options]
 
@@ -69,7 +69,7 @@ async function main() {
   }
 
   if (command === "version" || command === "--version" || command === "-v") {
-    console.log("agentctl v0.32.5");
+    console.log("agentctl v0.32.6");
     process.exit(0);
   }
 

package/index.mjs

@@ -5,7 +5,7 @@
  * security auditing, repo gating, and state operations.
  */
 
-export { loadConfig, parseYaml, detectStack, resolveVerify, resolveRoot, normalizePath, TIER_PRESETS } from "./src/config.mjs";
+export { loadConfig, parseYaml, detectStack, resolveVerify, resolveRoot, normalizePath, canonicalizePath, TIER_PRESETS } from "./src/config.mjs";
 export {
   shannonEntropy,
   redactSecrets,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.32.5",
+  "version": "0.32.6",
   "description": "Orchestration kit for running Google Jules autonomous agents.",
   "repository": {
     "type": "git",
@@ -53,6 +53,7 @@
     "jules:check-asset-integrity": "node scripts/asset-integrity-check.mjs",
     "jules:risk-tier": "node scripts/risk-tier.mjs",
     "jules:rules-lint": "node scripts/rules-lint.mjs",
+    "jules:doc-sync": "node scripts/doc-sync-check.mjs",
     "release": "node scripts/release.mjs",
     "lint": "eslint ."
   },

package/scripts/doc-sync-check.mjs

@@ -0,0 +1,234 @@
+#!/usr/bin/env node
+
+/**
+ * Documentation / version consistency gate.
+ *
+ * Implements the `doc-sync-sentinel` preset advertised in src/wizard-init.mjs:
+ * asserts that package.json, bin/agentctl.mjs, README.md, ROADMAP_V1.md and
+ * CHANGELOG.md all agree on the current version, and that README's advertised
+ * test counts match what the suite actually reports.
+ *
+ * Runs as a blocking step in scripts/release.mjs. Standalone usage:
+ *   node scripts/doc-sync-check.mjs                 # runs the suite for counts
+ *   node scripts/doc-sync-check.mjs --tests 429 --suites 59
+ *   node scripts/doc-sync-check.mjs --json
+ *
+ * Exit codes: 0 = in sync, 1 = drift detected.
+ */
+
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { execSync } from "node:child_process";
+import { resolveRoot } from "../src/config.mjs";
+
+/**
+ * Runs the unit suite and extracts the authoritative counts.
+ *
+ * README advertises *passing* tests, so `pass` — not `tests` — is the number
+ * the documentation claim is compared against. The two diverge as soon as the
+ * adversarial suite records a `todo` probe for a known gap.
+ *
+ * @param {string} root
+ * @returns {{ tests: number|null, pass: number|null, suites: number|null, todo: number|null }}
+ */
+export function measureTestCounts(root = process.cwd()) {
+  let out = "";
+  try {
+    out = execSync("npm test", { cwd: root, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+  } catch (err) {
+    // A failing suite still prints its summary; parse whatever we got.
+    out = `${err.stdout || ""}${err.stderr || ""}`;
+  }
+  return parseTestCounts(out);
+}
+
+/**
+ * Parses node:test summary counters out of an already-captured run.
+ * Accepts both the spec reporter ("ℹ tests 452") and tap ("# tests 452").
+ * @param {string} out
+ * @returns {{ tests: number|null, pass: number|null, suites: number|null, todo: number|null }}
+ */
+export function parseTestCounts(out = "") {
+  const num = (key) => {
+    const m = String(out).match(new RegExp(`^[^\\n]*?(?:ℹ|#)\\s*${key}\\s+(\\d+)\\s*$`, "m"));
+    return m ? Number(m[1]) : null;
+  };
+  return { tests: num("tests"), pass: num("pass"), suites: num("suites"), todo: num("todo") };
+}
+
+function readIfExists(path) {
+  return existsSync(path) ? readFileSync(path, "utf-8") : null;
+}
+
+/**
+ * Verifies documentation is in sync with package.json and the real test counts.
+ * @param {string} [root]
+ * @param {object} [opts]
+ * @param {number} [opts.tests] Actual passing test count (measured if omitted).
+ * @param {number} [opts.suites] Actual suite count (measured if omitted).
+ * @returns {{ ok: boolean, version: string, checks: Array<{name: string, ok: boolean, detail: string}> }}
+ */
+export function checkDocSync(root = process.cwd(), opts = {}) {
+  const checks = [];
+  const add = (name, ok, detail) => checks.push({ name, ok, detail });
+
+  const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf-8"));
+  const version = pkg.version;
+
+  // 1. bin/agentctl.mjs — VERSION const, help banner, `version` command output.
+  const cli = readIfExists(join(root, "bin", "agentctl.mjs"));
+  if (cli === null) {
+    add("agentctl present", false, "bin/agentctl.mjs not found");
+  } else {
+    const constMatch = cli.match(/export const VERSION\s*=\s*"([^"]+)"/);
+    add(
+      "agentctl VERSION const",
+      constMatch?.[1] === version,
+      constMatch ? `found "${constMatch[1]}", expected "${version}"` : "no `export const VERSION` found"
+    );
+
+    const stale = [...cli.matchAll(/agentctl v(\d+\.\d+\.\d+)/g)].map((m) => m[1]).filter((v) => v !== version);
+    add(
+      "agentctl banner/version strings",
+      stale.length === 0,
+      stale.length ? `stale version string(s): ${[...new Set(stale)].join(", ")}` : `all reference v${version}`
+    );
+  }
+
+  // 2. ROADMAP_V1.md — milestone header must name the shipped version, and no
+  //    already-released version may still be labelled "(Unreleased)".
+  const roadmap = readIfExists(join(root, "ROADMAP_V1.md"));
+  if (roadmap === null) {
+    add("ROADMAP present", false, "ROADMAP_V1.md not found");
+  } else {
+    const current = roadmap.match(/v(\d+\.\d+\.\d+)\s*\(Current Stable\)/);
+    add(
+      "ROADMAP Current Stable",
+      current?.[1] === version,
+      current ? `found v${current[1]}, expected v${version}` : "no `(Current Stable)` marker found"
+    );
+
+    const shipped = roadmap.match(/Shipped Milestones\s*\(v[\d.]+\s*[–-]\s*v(\d+\.\d+\.\d+)\)/);
+    add(
+      "ROADMAP Shipped range",
+      shipped?.[1] === version,
+      shipped ? `ends at v${shipped[1]}, expected v${version}` : "no `Shipped Milestones (…)` range found"
+    );
+
+    const unreleased = [...roadmap.matchAll(/v(\d+\.\d+\.\d+)\s*\(Unreleased\)/g)]
+      .map((m) => m[1])
+      .filter((v) => compareSemver(v, version) <= 0);
+    add(
+      "ROADMAP no stale (Unreleased)",
+      unreleased.length === 0,
+      unreleased.length
+        ? `v${unreleased.join(", v")} marked (Unreleased) but <= shipped v${version}`
+        : "no released version left marked (Unreleased)"
+    );
+  }
+
+  // 3. CHANGELOG.md — a released version needs a matching entry (release.mjs
+  //    extracts its notes from here, and silently falls back if it is missing).
+  const changelog = readIfExists(join(root, "CHANGELOG.md"));
+  if (changelog === null) {
+    add("CHANGELOG present", false, "CHANGELOG.md not found");
+  } else {
+    add(
+      "CHANGELOG entry",
+      changelog.includes(`## [${version}]`),
+      changelog.includes(`## [${version}]`) ? `## [${version}] found` : `no "## [${version}]" section`
+    );
+  }
+
+  // 4. README.md — advertised test counts and roadmap-table release labels.
+  const readme = readIfExists(join(root, "README.md"));
+  if (readme === null) {
+    add("README present", false, "README.md not found");
+  } else {
+    const claim = readme.match(/(\d+)\s+unit tests across\s+(\d+)\s+suites/);
+    const claimedTests = claim ? Number(claim[1]) : null;
+    const claimedSuites = claim ? Number(claim[2]) : null;
+
+    let { tests, suites } = opts;
+    if (tests === undefined || suites === undefined) {
+      const measured = measureTestCounts(root);
+      tests = tests ?? measured.pass;
+      suites = suites ?? measured.suites;
+    }
+
+    if (claimedTests === null) {
+      add("README test count", false, "no `N unit tests across M suites` claim found");
+    } else if (tests === null || suites === null) {
+      add("README test count", false, "could not measure actual test counts");
+    } else {
+      add(
+        "README test count",
+        claimedTests === tests && claimedSuites === suites,
+        `README claims ${claimedTests}/${claimedSuites} passing, suite reports ${tests}/${suites}`
+      );
+    }
+
+    const unreleasedRows = (readme.match(/\|\s*\*\*Unreleased\*\*\s*\*\(main\)\*\s*\|/g) || []).length;
+    add(
+      "README roadmap table labels",
+      unreleasedRows === 0,
+      unreleasedRows ? `${unreleasedRows} row(s) still labelled "Unreleased (main)"` : "no stale Unreleased rows"
+    );
+  }
+
+  // 5. Agent rule-file budgets. rules-lint has existed unwired, which is how
+  //    AGENTS.md silently drifted past its 10k character budget — agent rule
+  //    files are truncated by the model host, so an over-budget file loses
+  //    directives from the end without any error surfacing.
+  if (opts.skipRulesLint !== true) {
+    try {
+      execSync("node scripts/rules-lint.mjs", { cwd: root, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+      add("agent rule budgets", true, "AGENTS.md and .agent/rules/ within char/line budgets");
+    } catch (err) {
+      const detail = `${err.stdout || ""}${err.stderr || ""}`
+        .split("\n")
+        .filter((l) => l.trim().startsWith("-"))
+        .map((l) => l.trim().replace(/^-\s*/, ""))
+        .join("; ");
+      add("agent rule budgets", false, detail || "rules-lint reported violations");
+    }
+  }
+
+  return { ok: checks.every((c) => c.ok), version, checks };
+}
+
+function compareSemver(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) - (pb[i] || 0);
+  }
+  return 0;
+}
+
+// ---- CLI ----
+const isMain = process.argv[1] && process.argv[1].endsWith("doc-sync-check.mjs");
+if (isMain) {
+  const argv = process.argv.slice(2);
+  const flag = (name) => {
+    const i = argv.indexOf(`--${name}`);
+    return i !== -1 && argv[i + 1] ? Number(argv[i + 1]) : undefined;
+  };
+
+  const root = resolveRoot();
+  const res = checkDocSync(root, { tests: flag("tests"), suites: flag("suites") });
+
+  if (argv.includes("--json")) {
+    console.log(JSON.stringify(res, null, 2));
+  } else {
+    console.log(`\n📐 Documentation Sync Gate (v${res.version})`);
+    console.log("-------------------------------------------------------");
+    for (const c of res.checks) {
+      console.log(`  ${c.ok ? "✅" : "❌"} ${c.name.padEnd(32)} ${c.detail}`);
+    }
+    console.log("-------------------------------------------------------");
+    console.log(res.ok ? "✅ Documentation is in sync.\n" : "❌ DOC SYNC GATE FAIL: documentation has drifted from package.json / test suite.\n");
+  }
+
+  process.exit(res.ok ? 0 : 1);
+}

package/scripts/release.mjs

@@ -26,16 +26,37 @@ const tagName = `v${version}`;
 console.log(`🚀 Automated Release Pipeline for ${pkg.name} (${tagName})`);
 console.log("-------------------------------------------------------");
 
-// 1. Verify test suite
+// 1. Verify test suite. Output is captured (not inherited) so the doc-sync gate
+//    below can reuse the counts instead of running the suite a second time.
 console.log("1. Running unit test verification suite...");
+let testOutput = "";
 try {
-  execSync("npm test", { cwd: root, stdio: "inherit" });
+  testOutput = execSync("npm test", { cwd: root, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+  const summary = testOutput.match(/^[^\n]*?ℹ\s*(?:tests|suites|pass|fail|todo)\s+\d+\s*$/gm) || [];
+  summary.forEach((l) => console.log(`   ${l.trim()}`));
   console.log("   ✅ Test suite passed cleanly.\n");
 } catch (err) {
+  console.error(`${err.stdout || ""}${err.stderr || ""}`);
   console.error("❌ Release Aborted: Test suite failed.");
   process.exit(1);
 }
 
+// 1b. Documentation / version consistency gate (blocking).
+console.log("1b. Verifying documentation is in sync with package.json & test suite...");
+{
+  const { checkDocSync, parseTestCounts } = await import("./doc-sync-check.mjs");
+  const counts = parseTestCounts(testOutput);
+  const docRes = checkDocSync(root, { tests: counts.pass, suites: counts.suites });
+  for (const c of docRes.checks) {
+    console.log(`   ${c.ok ? "✅" : "❌"} ${c.name.padEnd(32)} ${c.detail}`);
+  }
+  if (!docRes.ok) {
+    console.error("\n❌ Release Aborted: documentation has drifted. Fix the ❌ rows above and re-run.");
+    process.exit(1);
+  }
+  console.log("   ✅ Documentation is in sync.\n");
+}
+
 // 2. Extract release notes from CHANGELOG.md
 console.log(`2. Extracting release notes for ${tagName} from CHANGELOG.md...`);
 let notes = "";

package/src/config.mjs

@@ -68,6 +68,41 @@ export function normalizePath(p) {
   return p.split(sep).join("/").replace(/\\/g, "/");
 }
 
+/**
+ * Reduces a repo-relative path to a canonical form for pattern matching:
+ * separators normalised, duplicate slashes collapsed, `.` segments dropped,
+ * `..` segments resolved, and any leading `./` or trailing `/` removed.
+ *
+ * Purely lexical — it never touches the filesystem, because the paths being
+ * matched may not exist locally (they can come from a diff or a task envelope).
+ * Leading `..` segments that would escape the repo root are preserved so the
+ * caller can still recognise and reject them.
+ *
+ * @param {string} p
+ * @returns {string}
+ */
+export function canonicalizePath(p) {
+  const normalized = normalizePath(p).replace(/\/+/g, "/");
+  if (!normalized) return "";
+
+  const isAbsolutePosix = normalized.startsWith("/");
+  const out = [];
+  for (const segment of normalized.split("/")) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") {
+      if (out.length > 0 && out[out.length - 1] !== "..") {
+        out.pop();
+      } else if (!isAbsolutePosix) {
+        out.push("..");
+      }
+      continue;
+    }
+    out.push(segment);
+  }
+
+  return (isAbsolutePosix ? "/" : "") + out.join("/");
+}
+
 export function resolveRoot(cwd = process.cwd()) {
   try {
     return execSync("git rev-parse --show-toplevel", { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();

package/src/router.mjs

@@ -73,7 +73,12 @@ const SENSITIVE_PATH_PATTERNS = [
 ];
 
 function collectReferencedPaths(task) {
-  const fromPrompt = extractPathTokens(task.prompt || "");
+  // extractPathTokens only recognises "/" as a separator, but a Windows author
+  // naturally writes "src\auth\session.mjs" in a prompt. Without this the
+  // sensitive-path guard below never sees the path and the task can be routed
+  // to the cheap tier. targetFiles are separately normalised by normalizePath.
+  const promptText = String(task.prompt || "").replace(/\\/g, "/");
+  const fromPrompt = extractPathTokens(promptText);
   const explicit = Array.isArray(task.targetFiles)
     ? task.targetFiles
     : Array.isArray(task.referenced_paths)

package/src/security.mjs

@@ -1,7 +1,7 @@
 import { openSync, writeSync, fsyncSync, closeSync, renameSync, realpathSync, existsSync, lstatSync, unlinkSync } from "node:fs";
 import { dirname, join, basename } from "node:path";
 import { randomBytes } from "node:crypto";
-import { normalizePath } from "./config.mjs";
+import { canonicalizePath } from "./config.mjs";
 import { detectCrossPackageBoundaryViolations } from "./stack-detector.mjs";
 
 export const HIGH_CONFIDENCE_PATTERNS = [
@@ -165,12 +165,28 @@ export function anonymizePii(text) {
   return sanitized;
 }
 
-export function matchesGlob(filePath, globPattern) {
+/**
+ * Glob matcher.
+ *
+ * `caseInsensitive` exists because the same repository is checked out on
+ * Linux, macOS and Windows. On APFS and NTFS, `.GitHub/` and `.github/` are
+ * the *same directory*, but git records whichever case was committed — so a
+ * case-sensitive deny rule can be walked straight past on two of the three
+ * target platforms. Deny and protect matching therefore folds case; allow
+ * matching deliberately does not, so that a case mismatch fails closed
+ * (unmatched by allow = violation) rather than opening a hole.
+ *
+ * @param {string} filePath
+ * @param {string} globPattern
+ * @param {{ caseInsensitive?: boolean }} [opts]
+ */
+export function matchesGlob(filePath, globPattern, opts = {}) {
   if (!filePath || !globPattern) return false;
-  const file = normalizePath(filePath);
-  const pattern = normalizePath(globPattern);
+  const file = canonicalizePath(filePath);
+  const pattern = canonicalizePath(globPattern);
+  const flags = opts.caseInsensitive ? "i" : "";
 
-  if (file === pattern) return true;
+  if (opts.caseInsensitive ? file.toLowerCase() === pattern.toLowerCase() : file === pattern) return true;
 
   const parts = pattern.split("/");
   const regexParts = parts.map((part) => {
@@ -188,16 +204,16 @@ export function matchesGlob(filePath, globPattern) {
     .replace(/___GLOBSTAR___/g, ".*");
 
   try {
-    return new RegExp(`^${regexStr}$`).test(file);
+    return new RegExp(`^${regexStr}$`, flags).test(file);
   } catch (_) {
     return false;
   }
 }
 
 export function isForbiddenPath(filePath, config = {}) {
-  const normFile = normalizePath(filePath);
+  const normFile = canonicalizePath(filePath);
   const forbidden = config.scope?.deny || config.forbidden_paths || [];
-  return forbidden.some((pattern) => matchesGlob(normFile, pattern));
+  return forbidden.some((pattern) => matchesGlob(normFile, pattern, { caseInsensitive: true }));
 }
 
 export function checkScope(files = [], scope = {}, opts = {}) {
@@ -207,14 +223,27 @@ export function checkScope(files = [], scope = {}, opts = {}) {
   const protect = scope.protect || [];
 
   for (const rawFile of files) {
-    const file = normalizePath(rawFile);
+    // Canonicalised so that "./x", "a/../x" and "a//x" cannot present the same
+    // file under a spelling the deny patterns do not literally match.
+    const file = canonicalizePath(rawFile);
+
+    // A path that climbs out of the repository root can never be legitimate and
+    // must not be silently pattern-matched against repo-relative rules.
+    if (file === ".." || file.startsWith("../") || file.startsWith("/")) {
+      violations.push({ file, reason: "Path escapes the repository root", rule: "deny", pattern: "<traversal>" });
+      continue;
+    }
 
-    const matchedDeny = deny.find((pat) => matchesGlob(file, pat));
+    // Deny folds case: on macOS/Windows ".GitHub/" resolves to the same
+    // directory as ".github/", so a case-sensitive deny is bypassable there.
+    const matchedDeny = deny.find((pat) => matchesGlob(file, pat, { caseInsensitive: true }));
     if (matchedDeny) {
       violations.push({ file, reason: `Forbidden path restriction matched pattern "${matchedDeny}"`, rule: "deny", pattern: matchedDeny });
       continue;
     }
 
+    // Allow stays case-sensitive on purpose: a case mismatch here yields "not
+    // allowed" (a violation), which is the fail-closed direction.
     if (allow.length > 0) {
       const isExplicitlyAllowed = allow.some((pat) => matchesGlob(file, pat));
       if (!isExplicitlyAllowed) {
@@ -224,7 +253,7 @@ export function checkScope(files = [], scope = {}, opts = {}) {
     }
 
     if (!opts.allowProtected) {
-      const matchedProtect = protect.find((pat) => matchesGlob(file, pat));
+      const matchedProtect = protect.find((pat) => matchesGlob(file, pat, { caseInsensitive: true }));
       if (matchedProtect) {
         violations.push({ file, reason: `Protected file modification restriction matched pattern "${matchedProtect}"`, rule: "protect", pattern: matchedProtect });
       }
@@ -332,6 +361,29 @@ export function checkCrossPackageImports(diffOrText = "", root = process.cwd(),
   };
 }
 
+// Zero-width and bidi-control characters. Inserting one mid-token defeats a
+// regex without changing how the value renders, copies, or authenticates.
+const INVISIBLE_CHARS = /[\u00AD\u200B-\u200F\u2028\u2029\u202A-\u202E\u2060-\u2064\uFEFF]/g;
+
+// A credential split across a source-level string concatenation is invisible to
+// a line-oriented scanner. This is not only an evasion technique — formatters
+// wrap long string literals exactly this way, so it also happens by accident.
+const STRING_CONCAT_JOIN = /(["'`])\s*\+\s*(["'`])/g;
+
+/**
+ * Produces the variants of the added-line text that secret patterns are run
+ * against: as-written, with invisible characters stripped, and with
+ * source-level string concatenation collapsed.
+ * @param {string} addedLines
+ * @returns {string[]}
+ */
+function secretScanVariants(addedLines) {
+  const stripped = addedLines.replace(INVISIBLE_CHARS, "");
+  // Collapse `"AAA" +\n  "BBB"` into `"AAABBB"` before matching.
+  const dejoined = stripped.replace(/\s*\n\s*/g, " ").replace(STRING_CONCAT_JOIN, "");
+  return [...new Set([addedLines, stripped, dejoined])];
+}
+
 export function scanDiff(diffTextStr = "", options = {}) {
   if (!diffTextStr) return { ok: true, findings: [] };
   const addedLines = diffTextStr
@@ -340,8 +392,9 @@ export function scanDiff(diffTextStr = "", options = {}) {
     .map((line) => line.slice(1))
     .join("\n");
 
-  const hasHigh = hasHighConfidenceSecret(addedLines);
-  const hasLow = !hasHigh && hasLowConfidenceSecret(addedLines);
+  const variants = secretScanVariants(addedLines);
+  const hasHigh = variants.some((v) => hasHighConfidenceSecret(v));
+  const hasLow = !hasHigh && variants.some((v) => hasLowConfidenceSecret(v));
   const findings = [];
 
   if (hasHigh) {