jules-orchestrator-kit 0.52.3 → 0.52.5

package/README.md

@@ -143,7 +143,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **809 unit tests across 91 suites passing in < 10.0s**.
+* **Verified Test Suite:** Tested with **828 unit tests across 91 suites passing in < 10.0s**.
 
 <br/>
 

package/bin/agentctl.mjs

@@ -427,7 +427,10 @@ async function main() {
           } else if (res.flakyVerdict?.verdict === "QUARANTINED") {
             console.log(`💡 Remediation Hint (Exit 8 Flaky Test Quarantined):`);
             console.log(`   • This command has alternated between pass and fail across recent runs.`);
-            console.log(`   • Fix the test's non-determinism — re-running will not clear the verdict.\n`);
+          } else if (res.code === 188) {
+            console.log(`💡 Remediation Hint (Exit 188 Offline Network Violation / Infrastructure):`);
+            console.log(`   • An unmocked network request was blocked by the preload network guard during verification.`);
+            console.log(`   • Ensure dependencies are installed locally (run: npm install) and all network calls in tests are mocked.\n`);
           } else if (failedPhase === "verify" || failedPhase === "evidence") {
             console.log(`💡 Remediation Hint (Exit ${res.code} Verification Failed):`);
             console.log(`   • The stage above exited non-zero. Reproduce it locally, then re-run the gate.`);

package/index.mjs

@@ -14,6 +14,7 @@ export {
   checkScope,
   scanDiff,
   hasEncodedSecret,
+  hasHighEntropyToken,
   checkEdgeRuntimeImports,
   checkCrossPackageImports,
   checkTestTampering,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.52.3",
+  "version": "0.52.5",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for Google Jules (jules) autonomous agents.",
   "repository": {
     "type": "git",

package/src/config.mjs

@@ -35,13 +35,13 @@ export const BUILTIN_DENY = [
   "**/*.pem",
   "**/*.key",
   "**/id_rsa*",
-  ".agent/config.yml",
-  ".agent/jules.yml",
   ".agent/jules-queue/**",
   ".github/**",
 ];
 
 export const BUILTIN_PROTECT = [
+  ".agent/config.yml",
+  ".agent/jules.yml",
   ".agent/rules/**",
   ".agent/SYSTEM_LEARNINGS.md",
   ".agent/knowledge/**",

package/src/engine.mjs

@@ -173,6 +173,7 @@ export async function gate(opts = {}) {
   // Phase 1: Scope Guard (Fetch trusted config strictly from origin/base using single normalizeScope)
   let trustedScope = config.scope;
   let trustedVerify = config.verify;
+  let trustedDiffKb = 75;
 
   const trustedConfigRaw = showFromOrigin(root, base, ".agent/config.yml") || showFromOrigin(root, base, ".agent/jules.yml");
   if (trustedConfigRaw) {
@@ -180,6 +181,9 @@ export async function gate(opts = {}) {
       const parsed = parseYaml(trustedConfigRaw);
       // CRITICAL B1 FIX: normalizeScope ensures BUILTIN_DENY is ALWAYS merged with user deny rules
       trustedScope = normalizeScope(parsed);
+      if (parsed.limits?.diff_kb || parsed.limits?.diffKb) {
+        trustedDiffKb = Number(parsed.limits.diff_kb || parsed.limits.diffKb) || 75;
+      }
       if (parsed.verify || parsed.test_cmd || parsed.build_cmd) {
         trustedVerify = {
           setup: parsed.verify?.setup || config.verify.setup,
@@ -200,6 +204,9 @@ export async function gate(opts = {}) {
   } else {
     // CRITICAL H-c FIX: Fall back strictly to normalizeScope({}) (built-ins only), never HEAD config
     trustedScope = normalizeScope({});
+    if (opts.config?.limits?.diffKb || opts.config?.limits?.diff_kb) {
+      trustedDiffKb = Number(opts.config.limits.diffKb || opts.config.limits.diff_kb) || 75;
+    }
   }
 
   const scopeResult = checkScope(files, trustedScope, {
@@ -218,7 +225,8 @@ export async function gate(opts = {}) {
   }
 
   // Phase 2: Diff Payload Governor
-  const limitBytes = (config.limits.diffKb || 75) * 1024;
+  // Bound to trusted base commit config strictly; uncommitted disk config cannot raise limit in committed mode.
+  const limitBytes = trustedDiffKb * 1024;
   const payloadOk = bytes <= limitBytes;
   phases.push({ phase: "payload", ok: payloadOk, bytes, limitBytes });
   appendTelemetry(root, "gate_phase", { phase: "payload", ok: payloadOk });
@@ -433,6 +441,14 @@ export async function gate(opts = {}) {
   // the one gate failure the operator is expected to fix themselves was the
   // only one that told them nothing about how. Both streams are already
   // redacted at the point they were captured.
+  const isNetViolation = failingCmd?.status === 188;
+  const netViolationDiagnostics = isNetViolation
+    ? [
+        "Offline Network Guard: Outbound network request was blocked (Exit 188).",
+        "Ensure dependencies are installed locally (run npm install) and tests do not perform unmocked network access.",
+      ]
+    : [];
+
   const verifyFailure = failingCmd
     ? {
         stageId: failingCmd.stageId || failingCmd.phase || "verify",
@@ -440,7 +456,7 @@ export async function gate(opts = {}) {
         exitCode: failingCmd.status ?? null,
         stdout: failingCmd.stdout || "",
         stderr: failingCmd.stderr || "",
-        diagnostics: failingCmd.diagnostics || [],
+        diagnostics: [...netViolationDiagnostics, ...(failingCmd.diagnostics || [])],
       }
     : testTampered
       ? {
@@ -510,6 +526,10 @@ export async function gate(opts = {}) {
   }
 
   if (!verifyOk && opts.fix && failingCmd) {
+    if (isNetViolation) {
+      appendTelemetry(root, "gate_finished", { ok: false, code: 188, networkViolation: true });
+      return { ok: false, code: 188, phases, evidence: evidenceManifest };
+    }
     const repairs = await repair(failingCmd, { config, root, signal: opts.signal, progressBus, progressToken });
     const finalOk = repairs.ok;
     const finalCode = repairs.ok ? 0 : 4;
@@ -520,7 +540,7 @@ export async function gate(opts = {}) {
     return { ok: false, code: 4, phases, repairs, evidence: evidenceManifest };
   }
 
-  const code = verifyOk ? 0 : testTampered ? 3 : 4;
+  const code = verifyOk ? 0 : isNetViolation ? 188 : testTampered ? 3 : 4;
   appendTelemetry(root, "gate_finished", { ok: verifyOk, code });
   return { ok: verifyOk, code, phases, evidence: evidenceManifest };
 }

package/src/git.mjs

@@ -306,7 +306,10 @@ export function ensureBaseFetched(root = process.cwd(), baseRef = "main") {
 }
 
 export function resolveBase(root = process.cwd(), baseRef = "main") {
-  const candidates = [`origin/${baseRef}`, `refs/remotes/origin/${baseRef}`, baseRef];
+  const isHeadRef = baseRef === "HEAD" || baseRef.startsWith("HEAD~") || baseRef.startsWith("HEAD^") || baseRef.startsWith("HEAD@");
+  const candidates = isHeadRef
+    ? [baseRef]
+    : [`origin/${baseRef}`, `refs/remotes/origin/${baseRef}`, baseRef];
   for (const ref of candidates) {
     try {
       const res = execFileSync("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
@@ -321,20 +324,22 @@ export function resolveBase(root = process.cwd(), baseRef = "main") {
     } catch (_) {}
   }
 
-  ensureBaseFetched(root, baseRef);
+  if (!isHeadRef) {
+    ensureBaseFetched(root, baseRef);
 
-  for (const ref of candidates) {
-    try {
-      const res = execFileSync("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
-        cwd: root,
-        encoding: "utf-8",
-        shell: false,
-        stdio: ["ignore", "pipe", "ignore"],
-      });
-      if (res && res.trim()) {
-        return res.trim();
-      }
-    } catch (_) {}
+    for (const ref of candidates) {
+      try {
+        const res = execFileSync("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
+          cwd: root,
+          encoding: "utf-8",
+          shell: false,
+          stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (res && res.trim()) {
+          return res.trim();
+        }
+      } catch (_) {}
+    }
   }
 
   throw new GateError(

package/src/security.mjs

@@ -588,6 +588,11 @@ function secretScanVariants(addedLines) {
   // Collapse method concatenations like .concat("...") or .join("")
   dejoined = dejoined.replace(/\.concat\(\s*["'`]/g, "").replace(/\.join\(\s*["'`]{2}\s*\)/g, "");
 
+  // Collapse whitespace/newlines between adjacent base64 characters (including line-wrapped PEM/base64, template literals, and quoted string chunks)
+  const base64Dejoined = stripped
+    .replace(/([A-Za-z0-9+/=_-])\s*[\r\n]+\s*(?=[A-Za-z0-9+/=_-])/g, "$1")
+    .replace(/([A-Za-z0-9+/=_-])["'`]\s*(?:\+\s*)?[\r\n]+\s*["'`]?([A-Za-z0-9+/=_-])/g, "$1$2");
+
   const hexDecoded = tryHexDecodeTokens(dejoined);
   const pctDecoded = tryPercentDecode(dejoined);
   // Confusable / NFKD normalisation runs over both the raw text and the
@@ -597,8 +602,9 @@ function secretScanVariants(addedLines) {
   const confusableDejoined = normalizeSecretText(dejoined);
 
   return {
-    all: [...new Set([addedLines, stripped, dejoined, hexDecoded, pctDecoded, confusable, confusableDejoined])],
+    all: [...new Set([addedLines, stripped, dejoined, base64Dejoined, hexDecoded, pctDecoded, confusable, confusableDejoined])],
     normalized: dejoined,
+    base64Normalized: base64Dejoined,
   };
 }
 
@@ -725,9 +731,22 @@ function decodeBase64Blobs(text, onDecoded) {
  * @returns {boolean}
  */
 export function hasEncodedSecret(text) {
+  if (!text) return false;
   const result = decodeBase64Blobs(text);
   if (result.capped) return true; // Fail closed if cap exceeded
-  return result.decoded.some((plain) => hasHighConfidenceSecret(plain));
+  if (result.decoded.some((plain) => hasHighConfidenceSecret(plain))) return true;
+
+  if (text.includes("\n") || text.includes("\r")) {
+    const collapsed = text
+      .replace(/([A-Za-z0-9+/=_-])\s*[\r\n]+\s*(?=[A-Za-z0-9+/=_-])/g, "$1")
+      .replace(/([A-Za-z0-9+/=_-])["'`]\s*(?:\+\s*)?[\r\n]+\s*["'`]?([A-Za-z0-9+/=_-])/g, "$1$2");
+    if (collapsed !== text) {
+      const collapsedResult = decodeBase64Blobs(collapsed);
+      if (collapsedResult.capped) return true;
+      if (collapsedResult.decoded.some((plain) => hasHighConfidenceSecret(plain))) return true;
+    }
+  }
+  return false;
 }
 
 /**
@@ -776,22 +795,93 @@ function splitDiffByFile(diffText) {
   return [...byFile.values()].filter((s) => s.lines.length > 0);
 }
 
+const CANDIDATE_TOKEN_REGEX = /[A-Za-z0-9_-]{24,}/g;
+
+/**
+ * Checks for high-entropy continuous tokens (>= 24 chars, entropy > 4.5) on added lines.
+ * Filters out URLs, SRI hashes (sha512-, sha256-, sha384-), and lockfiles to eliminate false positives.
+ *
+ * @param {string} text - Text to scan
+ * @param {string|null} [file=null] - File path associated with the text
+ * @returns {boolean}
+ */
+export function hasHighEntropyToken(text = "", file = null) {
+  if (!text || typeof text !== "string") return false;
+  if (
+    file &&
+    (file.endsWith(".lock") ||
+      file.endsWith(".lockb") ||
+      file.includes("package-lock.json") ||
+      file.includes("pnpm-lock.yaml") ||
+      file.includes("yarn.lock") ||
+      file.includes("Cargo.lock") ||
+      file.includes("composer.lock"))
+  ) {
+    return false;
+  }
+
+  const lines = text.split("\n");
+  for (const rawLine of lines) {
+    if (
+      rawLine.includes("://") ||
+      rawLine.includes("data:image/") ||
+      rawLine.includes("sha512-") ||
+      rawLine.includes("sha256-") ||
+      rawLine.includes("sha384-")
+    ) {
+      continue;
+    }
+
+    CANDIDATE_TOKEN_REGEX.lastIndex = 0;
+    let match;
+    while ((match = CANDIDATE_TOKEN_REGEX.exec(rawLine)) !== null) {
+      const token = match[0];
+      if (token.startsWith("sha512-") || token.startsWith("sha256-")) continue;
+      if (token.length >= 24) {
+        // If the token is a formatted base64 blob, distinguish binary assets and plain prose
+        if (token.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(token)) {
+          try {
+            const plain = Buffer.from(token, "base64").toString("utf-8");
+            const pr = printableRatio(plain);
+            if (pr < 0.9) {
+              // Ordinary binary asset (e.g. icon/font/wasm) - do not trip on binary entropy
+              continue;
+            }
+            // If it decodes to text, check decoded plain text entropy
+            if (shannonEntropy(plain) > 4.5) {
+              return true;
+            }
+            continue;
+          } catch (_) {}
+        }
+
+        const ent = shannonEntropy(token);
+        if (ent > 4.5) {
+          return true;
+        }
+      }
+    }
+  }
+  return false;
+}
+
 /**
  * Classify a block of added lines. Returns the single most severe finding, or
  * null when the block is clean.
  *
  * @param {string} addedLines
+ * @param {string|null} [file=null]
  * @returns {{ severity: string, type: string, description: string, encoded: boolean }|null}
  */
-function classifyAddedLines(addedLines) {
-  const { all: variants, normalized } = secretScanVariants(addedLines);
+function classifyAddedLines(addedLines, file = null) {
+  const { all: variants, normalized, base64Normalized } = secretScanVariants(addedLines);
   if (variants.some((v) => hasHighConfidenceSecret(v))) {
     return { severity: "CRITICAL", type: "HIGH_CONFIDENCE_SECRET", encoded: false, description: "High-confidence secret pattern detected in added diff lines" };
   }
   // Only worth decoding when nothing was found in the clear, and only against
   // the fully-normalised text: decoding is the expensive step, and the
   // intermediate variants differ from it in ways base64 blobs do not care about.
-  if (hasEncodedSecret(normalized)) {
+  if (hasEncodedSecret(normalized) || (base64Normalized && hasEncodedSecret(base64Normalized))) {
     // Same type as the cleartext case: every gate that blocks on
     // HIGH_CONFIDENCE_SECRET should block on this too, and a new type would
     // have silently passed through the ones not updated. The description
@@ -801,6 +891,9 @@ function classifyAddedLines(addedLines) {
   if (variants.some((v) => hasLowConfidenceSecret(v))) {
     return { severity: "HIGH", type: "LOW_CONFIDENCE_SECRET", encoded: false, description: "Low-confidence secret or authorization token detected in added diff lines" };
   }
+  if (hasHighEntropyToken(addedLines, file)) {
+    return { severity: "HIGH", type: "HIGH_ENTROPY_TOKEN", encoded: false, description: "High-entropy token detected in added diff lines (potential unstructured secret or API key)" };
+  }
   return null;
 }
 
@@ -815,12 +908,13 @@ function classifyAddedLines(addedLines) {
  *
  * @param {Array<{ text: string, no: number|null }>} lines
  * @param {string} type
+ * @param {string|null} [file=null]
  * @returns {number|null}
  */
-function locateFindingLine(lines, type) {
+function locateFindingLine(lines, type, file = null) {
   for (const line of lines) {
     if (line.no === null) continue;
-    const hit = classifyAddedLines(line.text);
+    const hit = classifyAddedLines(line.text, file);
     if (hit && hit.type === type) return line.no;
   }
   return null;
@@ -840,8 +934,10 @@ export function checkTestTampering(diffOrText = "", options = {}) {
 
   const violations = [];
   const lines = diffOrText.split("\n");
+  let lastOldFile = null;
   let currentFile = null;
-  let currentLineNo = null;
+  let currentOldLineNo = null;
+  let currentNewLineNo = null;
 
   const isTestFile = (f) => {
     if (!f) return false;
@@ -868,18 +964,43 @@ export function checkTestTampering(diffOrText = "", options = {}) {
 
   const COMMENTED_ASSERTION = /^\+\s*(?:\/\/|\/\*)\s*(?:expect\(|assert\.|assert\(|t\.expect|t\.assert)/i;
 
+  const VACUOUS_ASSERTIONS = [
+    { pattern: /\bassert(?:\.ok)?\s*\(\s*true\s*(?:,[^)]*)?\)/i, desc: "Vacuous truth assertion (assert.ok(true))" },
+    { pattern: /\bassert\.(?:strictEqual|deepStrictEqual|equal|deepEqual)\s*\(\s*([^,]+?)\s*,\s*\1\s*(?:,[^)]*)?\)/i, desc: "Vacuous identity assertion (assert.equal(X, X))" },
+    { pattern: /\bexpect\s*\(\s*true\s*\)\s*\.(?:toBe|toEqual)\s*\(\s*true\s*\)/i, desc: "Vacuous truth expectation (expect(true).toBe(true))" },
+    { pattern: /\bexpect\s*\(\s*([^)]+?)\s*\)\s*\.(?:toBe|toEqual)\s*\(\s*\1\s*\)/i, desc: "Vacuous identity expectation (expect(X).toBe(X))" },
+    { pattern: /\bexpect\s*\(\s*true\s*\)\s*\.toBeTruthy\s*\(/i, desc: "Vacuous truth expectation (expect(true).toBeTruthy())" },
+    { pattern: /\bexpect\s*\(\s*false\s*\)\s*\.toBeFalsy\s*\(/i, desc: "Vacuous falsity expectation (expect(false).toBeFalsy())" },
+    { pattern: /\bassert\.(?:isTrue|isOk)\s*\(\s*true\s*(?:,[^)]*)?\)/i, desc: "Vacuous truth assertion (assert.isTrue(true))" },
+    { pattern: /\bassert\.(?:isFalse|isNotOk)\s*\(\s*false\s*(?:,[^)]*)?\)/i, desc: "Vacuous falsity assertion (assert.isFalse(false))" },
+  ];
+
+  const ASSERTION_PATTERN = /(?:\b(?:assert(?:\.[a-zA-Z0-9_$]+)?|expect|t\.(?:assert|expect|is|equal|true|false|Errorf|Fatalf)|require\.[a-zA-Z0-9_$]+)\b|assert!|assert_eq!|assert_ne!)/i;
+  const isCommentLine = (str) => /^\s*(?:\/\/|\/\*|\*|#|--|;)/.test(str);
+
+  const fileAssertions = new Map();
+
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
+
+    if ((line.startsWith("--- ") || line.startsWith("--- a/")) && !line.startsWith("----")) {
+      const orig = line.slice(3).split("\t")[0].trim().replace(/^a\//, "");
+      lastOldFile = orig && orig !== "/dev/null" ? orig : null;
+      continue;
+    }
+
     if ((line.startsWith("+++ ") || line.startsWith("+++ b/") || line.startsWith("+++ /dev/null")) && !line.startsWith("++++")) {
       const target = line.slice(3).split("\t")[0].trim().replace(/^b\//, "");
-      currentFile = target && target !== "/dev/null" ? target : null;
-      currentLineNo = null;
+      currentFile = target && target !== "/dev/null" ? target : lastOldFile;
+      currentOldLineNo = null;
+      currentNewLineNo = null;
       continue;
     }
 
-    const hunkMatch = /^@@ -\d+(?:,\d+)? \+(\d+)/.exec(line);
+    const hunkMatch = /^@@ -(\d+)(?:,\d+)? \+(\d+)/.exec(line);
     if (hunkMatch) {
-      currentLineNo = Number(hunkMatch[1]);
+      currentOldLineNo = Number(hunkMatch[1]);
+      currentNewLineNo = Number(hunkMatch[2]);
       continue;
     }
 
@@ -887,34 +1008,81 @@ export function checkTestTampering(diffOrText = "", options = {}) {
       continue;
     }
 
-    if (line.startsWith("+") && !line.startsWith("+++")) {
+    if (!fileAssertions.has(currentFile)) {
+      fileAssertions.set(currentFile, { removed: [], added: 0 });
+    }
+    const fileStats = fileAssertions.get(currentFile);
+
+    if (line.startsWith("-") && !line.startsWith("---")) {
+      const deletedText = line.slice(1);
+      if (!isCommentLine(deletedText) && ASSERTION_PATTERN.test(deletedText)) {
+        fileStats.removed.push({ line: currentOldLineNo, text: deletedText });
+      }
+      if (currentOldLineNo !== null) currentOldLineNo++;
+    } else if (line.startsWith("+") && !line.startsWith("+++")) {
       const addedText = line.slice(1);
+      let isVacuous = false;
 
       // Check skip injections
       for (const skipRule of SKIP_INJECTIONS) {
         if (skipRule.pattern.test(addedText)) {
           violations.push({
             file: currentFile,
-            line: currentLineNo,
+            line: currentNewLineNo,
             type: "TEST_SKIP_INJECTION",
-            reason: `Test Tamper Guard: ${skipRule.desc} found in ${currentFile}${currentLineNo ? `:${currentLineNo}` : ""}`,
+            reason: `Test Tamper Guard: ${skipRule.desc} found in ${currentFile}${currentNewLineNo ? `:${currentNewLineNo}` : ""}`,
+          });
+        }
+      }
+
+      // Check vacuous assertions
+      for (const vacuousRule of VACUOUS_ASSERTIONS) {
+        if (vacuousRule.pattern.test(addedText)) {
+          isVacuous = true;
+          violations.push({
+            file: currentFile,
+            line: currentNewLineNo,
+            type: "VACUOUS_ASSERTION",
+            reason: `Test Tamper Guard: ${vacuousRule.desc} detected in ${currentFile}${currentNewLineNo ? `:${currentNewLineNo}` : ""}`,
           });
         }
       }
 
       // Check commented-out assertions
+      let isCommented = false;
       if (COMMENTED_ASSERTION.test(line)) {
+        isCommented = true;
         violations.push({
           file: currentFile,
-          line: currentLineNo,
+          line: currentNewLineNo,
           type: "COMMENTED_ASSERTION",
-          reason: `Test Tamper Guard: Commented-out test assertion detected in ${currentFile}${currentLineNo ? `:${currentLineNo}` : ""}`,
+          reason: `Test Tamper Guard: Commented-out test assertion detected in ${currentFile}${currentNewLineNo ? `:${currentNewLineNo}` : ""}`,
         });
       }
 
-      if (currentLineNo !== null) currentLineNo++;
-    } else if (currentLineNo !== null && !line.startsWith("-") && !line.startsWith("\\")) {
-      currentLineNo++;
+      // If valid non-vacuous, non-commented assertion is added, increment added count
+      if (!isVacuous && !isCommented && !isCommentLine(addedText) && ASSERTION_PATTERN.test(addedText)) {
+        fileStats.added++;
+      }
+
+      if (currentNewLineNo !== null) currentNewLineNo++;
+    } else if (!line.startsWith("\\")) {
+      if (currentOldLineNo !== null) currentOldLineNo++;
+      if (currentNewLineNo !== null) currentNewLineNo++;
+    }
+  }
+
+  for (const [file, stats] of fileAssertions.entries()) {
+    if (stats.removed.length > stats.added) {
+      const unreplaced = stats.removed.slice(stats.added);
+      for (const item of unreplaced) {
+        violations.push({
+          file,
+          line: item.line,
+          type: "ASSERTION_REMOVAL",
+          reason: `Test Tamper Guard: Assertion removed without replacement in ${file}${item.line ? `:${item.line}` : ""}: "${item.text.trim()}"`,
+        });
+      }
     }
   }
 
@@ -931,9 +1099,9 @@ export function scanDiff(diffTextStr = "", options = {}) {
   const findings = [];
 
   for (const segment of segments) {
-    const hit = classifyAddedLines(segment.lines.map((l) => l.text).join("\n"));
+    const hit = classifyAddedLines(segment.lines.map((l) => l.text).join("\n"), segment.file);
     if (!hit) continue;
-    const line = segment.file ? locateFindingLine(segment.lines, hit.type) : null;
+    const line = segment.file ? locateFindingLine(segment.lines, hit.type, segment.file) : null;
     const at = segment.file ? ` (${segment.file}${line ? `:${line}` : ""})` : "";
     findings.push({
       severity: hit.severity,
@@ -949,7 +1117,7 @@ export function scanDiff(diffTextStr = "", options = {}) {
   // detection for attribution, fall back to the joined text when every file
   // came back clean — the cost lands only on diffs with nothing to report.
   if (findings.length === 0 && segments.length > 1) {
-    const hit = classifyAddedLines(segments.flatMap((s) => s.lines.map((l) => l.text)).join("\n"));
+    const hit = classifyAddedLines(segments.flatMap((s) => s.lines.map((l) => l.text)).join("\n"), null);
     if (hit) {
       findings.push({
         severity: hit.severity,

package/src/wizard-init.mjs

@@ -123,7 +123,7 @@ export function planInit(root = process.cwd(), options = {}) {
   const tierName = options.tier || FALLBACK_TIER;
   // An unrecognised name resolves the same way loadConfig() resolves it, so the
   // scaffolded limits always match what the runtime will later enforce.
-  const limits = TIER_PROFILES[tierName] || TIER_PROFILES[FALLBACK_TIER];
+  const tierPresetLimits = TIER_PROFILES[tierName] || TIER_PROFILES[FALLBACK_TIER];
 
   // Preserve existing config if present
   let existingConfig = {};
@@ -134,6 +134,21 @@ export function planInit(root = process.cwd(), options = {}) {
     } catch (_) {}
   }
 
+  // Preserve existing jules.yml if present
+  let existingJules = {};
+  const existingJulesPath = join(root, ".agent", "jules.yml");
+  if (existsSync(existingJulesPath)) {
+    try {
+      existingJules = parseYaml(readFileSync(existingJulesPath, "utf-8")) || {};
+    } catch (_) {}
+  }
+
+  const customLimits = options.limits || existingConfig.limits;
+  const isCustomLimits = customLimits && Object.entries(customLimits).some(
+    ([k, v]) => v !== undefined && tierPresetLimits[k] !== undefined && Number(v) !== Number(tierPresetLimits[k])
+  );
+  const limits = isCustomLimits ? { ...tierPresetLimits, ...customLimits } : tierPresetLimits;
+
   const verify = {
     test: options.testCmd || existingConfig.verify?.test || oracle.candidates.testCmd || "",
     build: options.buildCmd || existingConfig.verify?.build || oracle.candidates.buildCmd || "",
@@ -143,19 +158,17 @@ export function planInit(root = process.cwd(), options = {}) {
 
   const selectedPresets = options.presets || existingConfig.presets || ["nightly-security-audit", "flaky-test-quarantine"];
 
+  const limitsBlock = isCustomLimits
+    ? `\nlimits:\n  concurrency: ${limits.concurrency}\n  daily_tasks: ${limits.daily_tasks}\n  stagger_ms: ${limits.stagger_ms}\n  diff_kb: ${limits.diff_kb}\n`
+    : "";
+
   const configYaml = `# Google Jules Orchestrator Kit Config (v${KIT_VERSION})
 version: 1
 provider: ${existingConfig.provider || "jules"}
 tier: ${tierName}
 base_branch: ${options.baseBranch || existingConfig.base_branch || "main"}
 branch_prefix: ${existingConfig.branch_prefix || "agent/"}
-
-limits:
-  concurrency: ${limits.concurrency}
-  daily_tasks: ${limits.daily_tasks}
-  stagger_ms: ${limits.stagger_ms}
-  diff_kb: ${limits.diff_kb}
-
+${limitsBlock}
 verify:
   test: "${verify.test}"
   build: "${verify.build}"
@@ -166,10 +179,23 @@ presets:
 ${selectedPresets.map((p) => `  - ${p}`).join("\n")}
 `;
 
-  const julesYaml = `# Google Jules Agent Compatibility Manifest
-version: 1
+  const forbiddenPaths = options.forbiddenPaths || existingJules.forbidden_paths || [
+    ".github/**",
+    "**/secrets/**",
+    "**/*.pem",
+    "**/lock-manager/**",
+    "scripts/jules-self-audit.mjs",
+    ".agent/jules.yml",
+  ];
+  const allowPaths = options.allowPaths || existingJules.allow_paths || [];
+
+  const julesYaml = `# Google Jules Repository Configuration (Version 2)
+version: 2
 test_cmd: "${verify.test}"
 build_cmd: "${verify.build}"
+forbidden_paths:
+${forbiddenPaths.map((p) => `  - "${p}"`).join("\n")}
+allow_paths: ${allowPaths.length > 0 ? "\n" + allowPaths.map((p) => `  - "${p}"`).join("\n") : "[]"}
 `;
 
   return {