jules-orchestrator-kit 0.72.0 → 0.72.1

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.72.1] - 2026-09-08
+*A diff cannot judge what it cannot see.*
+
+Fixes staged-mode diff extraction and cross-language dead-guard detection uncovered during polyglot trial execution on Python/Make repositories:
+- **Staged Mode Diff Fidelity (`src/git.mjs`)**: `diffText(root, base, "staged")` failed to query the git index, falling through to `git diff <base>...HEAD`. Consequently, staged modifications (`git add`) on feature branches were omitted from the diff passed to the secret scanner and anti-tamper guard. `diffText` now queries `git diff --cached <base>` in staged mode, ensuring cached index additions are fully inspected.
+- **Indentation-Aware Dead Guard Tamper Detection (`src/security.mjs`)**: Extended `DEAD_GUARD_CONDITION` to recognize literal boolean and zero falsities (`if False:`, `if (false)`, `if 0:`). Replaced brace-only block tracking with indentation-aware block traversal, enabling Python, YAML, and brace-less test suites to detect assertions and failure calls shielded inside dead logic.
+- **Assertion Coverage in Dead Conditions (`src/security.mjs`)**: `VACUOUS_ASSERTION` now detects both failure calls (`FAILURE_CALL`) and test assertions (`ASSERTION_PATTERN`) inside dead blocks.
+
 ## [0.72.0] - 2026-09-08
 *A guard is not a policy if the diff under review can rewrite the rules.*
 

package/README.md

@@ -208,7 +208,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **1399 unit tests across 195 suites**, green on every supported platform.
+* **Verified Test Suite:** Tested with **1403 unit tests across 196 suites**, green on every supported platform.
 
 <br/>
 
@@ -448,6 +448,7 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 
 | Feature | Module / Command | Architectural Description | Status |
 | :--- | :--- | :--- | :---: |
+| **Staged Diff Fidelity & Indentation Dead Guards** | `src/git.mjs`, `src/security.mjs` | Query cached index in staged mode (`git diff --cached <base>`), detect literal falsity dead guards (`if False:`, `if (false)`, `if 0:`), and support indentation-aware block traversal for Python test suites. | **v0.72.1** *(Shipped)* |
 | **Cold-Start Hardened Kernel & Tamper Defense** | `src/config.mjs`, `src/engine.mjs`, `src/git.mjs`, `src/security.mjs` | Full remediation of 22 cold-start audit findings (F01–F22): authoritative base policy resolution, ephemeral snapshot worktree isolation, canonical root test tamper guard, conditional assertion defense, multi-target Cargo test aggregation, Python src-layout injection, and complete repository uninstall documentation. | **v0.72.0** *(Shipped)* |
 | **Silence Is Not A Suite & Scaffolding Linter Fixes** | `src/ops/test-collection.mjs`, `src/wizard-init.mjs`, `src/config.mjs` | Reject zero-output test suite commands, quote-aware YAML parser with scalar emission, test de-registration detection (`TEST_DEREGISTERED`), and active waiver telemetry banner. | **v0.71.0** *(Shipped)* |
 | **Diagnostics That Reach the Operator** | `src/security.mjs`, `src/engine.mjs`, `bin/agentctl.mjs` | Secret findings name the file and line, a failed verify stage reports its command, exit code and output, and `queue`/`swarm` name each failed task and exit `1` rather than reporting success for a run that dispatched nothing. | **v0.41.1** *(Shipped)* |

package/ROADMAP_V1.md

@@ -11,14 +11,19 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 ## 📌 Release Milestones Overview
 
 ```
- v0.72.0 (Current Stable) ──► v0.73.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
- (Cold-Start Hardened Kernel) (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
+ v0.72.1 (Current Stable) ──► v0.73.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
+ (Staged Diff & Dead Guards)  (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
 ```
 
 ---
 
-## ✅ Shipped Milestones (v0.20.0 – v0.72.0)
+## ✅ Shipped Milestones (v0.20.0 – v0.72.1)
 
+### v0.72.1: Staged Mode Diff Fidelity & Indentation-Aware Tamper Defense
+- [x] **Staged Mode Diff Fidelity (`src/git.mjs`)** — `diffText` in staged mode queries `git diff --cached <base>`, ensuring staged additions on feature branches are visible to secret and tamper scanners.
+- [x] **Universal Dead Guard Detection (`src/security.mjs`)** — extended `DEAD_GUARD_CONDITION` to recognize literal falsities (`if False:`, `if (false)`, `if 0:`).
+- [x] **Indentation-Aware Block Traversal (`src/security.mjs`)** — detects dead-guard assertions and failure calls in indentation-based languages (Python) without requiring `{}` braces.
+- [x] **Comprehensive Guard Call Detection (`src/security.mjs`)** — `VACUOUS_ASSERTION` now covers both failure calls and test assertions.
 
 ### v0.72.0: Cold-Start Hardened Kernel & Tamper Defense
 - [x] **Canonical Root Test Guard (F01)** — `test.js` at repository root is inside the tamper guard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.72.0",
+  "version": "0.72.1",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/src/git.mjs

@@ -453,6 +453,8 @@ export function diffText(root = process.cwd(), base = "main", mode = "committed"
       } catch (_) {}
     }
     return [committed, uncommitted, untrackedDiff].filter(Boolean).join("\n");
+  } else if (mode === "staged" || mode === "index") {
+    return git(["diff", "--cached", resolvedRef], { cwd: root, raw: true });
   }
   return git(["diff", `${resolvedRef}...HEAD`], { cwd: root, raw: true });
 }

package/src/security.mjs

@@ -2395,7 +2395,7 @@ export const TAMPER_KIND_NAMES = Object.freeze([...new Set(TAMPER_KINDS.values()
  * branch behind real state) is not guessable and is deliberately left alone.
  */
 const DEAD_GUARD_CONDITION =
-  /\bif\b[^;{}]*\b(?:len|len\s+of|count|size|length|num\w*|total)\s*\([^)]*\)\s*(?:<\s*0|<\s*-0\b)|<=\s*-1\b/i;
+  /\bif\b[^;{}]*\b(?:len|len\s+of|count|size|length|num\w*|total)\s*\([^)]*\)\s*(?:<\s*0|<\s*-0\b|<=\s*-1\b)|\bif\s+(?:False|false|0)\s*(?::|\{|$|\b)|\bif\s*\(\s*(?:False|false|0)\s*\)/;
 
 /**
  * The calls a test uses to say "this failed": the assertion's actual teeth.
@@ -2983,24 +2983,49 @@ export function checkTestTampering(diffOrText = "", options = {}) {
         if (L.kind !== "+" || !DEAD_GUARD_CONDITION.test(L.text)) continue;
         const guardLineNo = L.newNo;
         const guardText = L.text;
-                let depth = (guardText.match(/\{/g) || []).length - (guardText.match(/\}/g) || []).length;
-        let found = depth > 0 && FAILURE_CALL.test(guardText.slice(guardText.indexOf("{")));
-        for (let k = i + 1; k < hunk.lines.length && depth > 0; k++) {
-          const t = hunk.lines[k].text || "";
-          const opens = (t.match(/\{/g) || []).length;
-          const closes = (t.match(/\}/g) || []).length;
-          if (depth > 0 && FAILURE_CALL.test(t)) { found = true; break; }
-          depth += opens - closes;
+        const isFailureOrAssertion = (text) => FAILURE_CALL.test(text) || ASSERTION_PATTERN.test(text);
+        let found = false;
+
+        if (guardText.includes("{")) {
+          let depth = (guardText.match(/\{/g) || []).length - (guardText.match(/\}/g) || []).length;
+          if (depth > 0 && isFailureOrAssertion(guardText.slice(guardText.indexOf("{")))) {
+            found = true;
+          }
+          for (let k = i + 1; k < hunk.lines.length && depth > 0; k++) {
+            const t = hunk.lines[k].text || "";
+            const opens = (t.match(/\{/g) || []).length;
+            const closes = (t.match(/\}/g) || []).length;
+            if (depth > 0 && isFailureOrAssertion(t)) { found = true; break; }
+            depth += opens - closes;
+          }
+        } else {
+          // Indentation-based block (Python, etc.) or single-line guard without braces
+          const colonIdx = guardText.indexOf(":");
+          const parenIdx = guardText.lastIndexOf(")");
+          const afterGuard = colonIdx !== -1 ? guardText.slice(colonIdx + 1) : (parenIdx !== -1 ? guardText.slice(parenIdx + 1) : "");
+          if (afterGuard && isFailureOrAssertion(afterGuard)) {
+            found = true;
+          } else {
+            const guardIndent = (guardText.match(/^\s*/)?.[0] || "").length;
+            for (let k = i + 1; k < hunk.lines.length; k++) {
+              const t = hunk.lines[k].text || "";
+              if (!t.trim() || isCommentLine(t)) continue;
+              const lineIndent = (t.match(/^\s*/)?.[0] || "").length;
+              if (lineIndent <= guardIndent) break;
+              if (isFailureOrAssertion(t)) { found = true; break; }
+            }
+          }
         }
+
         if (found) {
           violations.push({
             file,
             line: guardLineNo,
             type: "VACUOUS_ASSERTION",
             reason:
-              `Test Tamper Guard: the failure call in ${file}${guardLineNo ? `:${guardLineNo}` : ""} ` +
+              `Test Tamper Guard: the assertion or failure call in ${file}${guardLineNo ? `:${guardLineNo}` : ""} ` +
               `is guarded by a condition that can never be true ("${collapseWhitespace(guardText).trim()}"), so the ` +
-              `assertion cannot fail. Keeping the failure call in dead logic is not preservation of verification.`,
+              `assertion cannot fail. Keeping the assertion in dead logic is not preservation of verification.`,
           });
         }
       }