jules-orchestrator-kit 0.72.0 → 0.72.2

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.72.2] - 2026-09-08
+*A test suite that writes to stderr did not write silence.*
+
+Fixes stream preservation in child process execution, stack-detection build defaults, and CLI flag parity uncovered during Bun + TypeScript trial execution:
+- **Child Process Stream Fidelity & Stderr Preservation (`src/git.mjs`)**: `runCmd()` used `execSync`/`execFileSync` which hardcoded `stderr: ""` on zero exit status. Test runners that print progress and summary statistics to `stderr` (notably `bun test`) had their results silenced, causing `parseCollectedTests` to report unverified test counts. `runCmd()` now invokes `spawnSync` natively, capturing both `stdout` and `stderr` streams regardless of exit status.
+- **Conditional Build Command Resolution (`src/stack-detector.mjs`)**: Bun and Deno detectors previously assigned `buildCmd: "bun run build"` and `buildCmd: "deno task build"` unconditionally upon discovering `bunfig.toml` or `deno.json`. In pure zero-dependency projects lacking a `build` script/task, `agentctl gate` failed in the build stage. `detectPolyglotStack()` now checks `package.json` (or `deno.json`) for explicit build scripts before populating `buildCmd`.
+- **CLI Ergonomics & Alias Parity (`bin/agentctl.mjs`)**: Added `--verify` as a first-class alias for `--verify-cmd` across `agentctl task create`, `task template`, and `task optimize`.
+
+## [0.72.1] - 2026-09-08
+*A diff cannot judge what it cannot see.*
+
+Fixes staged-mode diff extraction and cross-language dead-guard detection uncovered during polyglot trial execution on Python/Make repositories:
+- **Staged Mode Diff Fidelity (`src/git.mjs`)**: `diffText(root, base, "staged")` failed to query the git index, falling through to `git diff <base>...HEAD`. Consequently, staged modifications (`git add`) on feature branches were omitted from the diff passed to the secret scanner and anti-tamper guard. `diffText` now queries `git diff --cached <base>` in staged mode, ensuring cached index additions are fully inspected.
+- **Indentation-Aware Dead Guard Tamper Detection (`src/security.mjs`)**: Extended `DEAD_GUARD_CONDITION` to recognize literal boolean and zero falsities (`if False:`, `if (false)`, `if 0:`). Replaced brace-only block tracking with indentation-aware block traversal, enabling Python, YAML, and brace-less test suites to detect assertions and failure calls shielded inside dead logic.
+- **Assertion Coverage in Dead Conditions (`src/security.mjs`)**: `VACUOUS_ASSERTION` now detects both failure calls (`FAILURE_CALL`) and test assertions (`ASSERTION_PATTERN`) inside dead blocks.
+
 ## [0.72.0] - 2026-09-08
 *A guard is not a policy if the diff under review can rewrite the rules.*
 

package/README.md

@@ -208,7 +208,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **1399 unit tests across 195 suites**, green on every supported platform.
+* **Verified Test Suite:** Tested with **1403 unit tests across 196 suites**, green on every supported platform.
 
 <br/>
 
@@ -448,6 +448,8 @@ const result = await fast.dispatch({ prompt: "Fix a typo." }, { root: process.cw
 
 | Feature | Module / Command | Architectural Description | Status |
 | :--- | :--- | :--- | :---: |
+| **Child Streams & Polyglot Build Detection** | `src/git.mjs`, `src/stack-detector.mjs`, `bin/agentctl.mjs` | Native `spawnSync` execution in `runCmd()` preserving stderr stream on status 0 (supporting Bun test output), conditional `buildCmd` resolution for Bun/Deno scripts, and `--verify` alias parity. | **v0.72.2** *(Shipped)* |
+| **Staged Diff Fidelity & Indentation Dead Guards** | `src/git.mjs`, `src/security.mjs` | Query cached index in staged mode (`git diff --cached <base>`), detect literal falsity dead guards (`if False:`, `if (false)`, `if 0:`), and support indentation-aware block traversal for Python test suites. | **v0.72.1** *(Shipped)* |
 | **Cold-Start Hardened Kernel & Tamper Defense** | `src/config.mjs`, `src/engine.mjs`, `src/git.mjs`, `src/security.mjs` | Full remediation of 22 cold-start audit findings (F01–F22): authoritative base policy resolution, ephemeral snapshot worktree isolation, canonical root test tamper guard, conditional assertion defense, multi-target Cargo test aggregation, Python src-layout injection, and complete repository uninstall documentation. | **v0.72.0** *(Shipped)* |
 | **Silence Is Not A Suite & Scaffolding Linter Fixes** | `src/ops/test-collection.mjs`, `src/wizard-init.mjs`, `src/config.mjs` | Reject zero-output test suite commands, quote-aware YAML parser with scalar emission, test de-registration detection (`TEST_DEREGISTERED`), and active waiver telemetry banner. | **v0.71.0** *(Shipped)* |
 | **Diagnostics That Reach the Operator** | `src/security.mjs`, `src/engine.mjs`, `bin/agentctl.mjs` | Secret findings name the file and line, a failed verify stage reports its command, exit code and output, and `queue`/`swarm` name each failed task and exit `1` rather than reporting success for a run that dispatched nothing. | **v0.41.1** *(Shipped)* |

package/ROADMAP_V1.md

@@ -11,14 +11,24 @@ The **jules-orchestrator-kit** is the zero-dependency safety gatekeeper and self
 ## 📌 Release Milestones Overview
 
 ```
- v0.72.0 (Current Stable) ──► v0.73.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
- (Cold-Start Hardened Kernel) (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
+ v0.72.2 (Current Stable) ──► v0.73.0 (Distributed Swarms & Leases) ──► v1.0.0 (Production Hardened Kernel)
+ (Child Streams & Bun/Deno)   (Multi-Agent DAG & Resource Locks)       (Enterprise Telemetry & SLA)
 ```
 
 ---
 
-## ✅ Shipped Milestones (v0.20.0 – v0.72.0)
+## ✅ Shipped Milestones (v0.20.0 – v0.72.2)
 
+### v0.72.2: Child Process Stream Fidelity & Polyglot Build Detection
+- [x] **Child Process Stream Fidelity (`src/git.mjs`)** — `runCmd()` invokes native `spawnSync`, preserving both `stdout` and `stderr` streams on exit 0 so test runners emitting summaries to stderr (`bun test`) are fully recognized by `parseCollectedTests`.
+- [x] **Conditional Polyglot Build Resolution (`src/stack-detector.mjs`)** — Bun and Deno projects without declared build scripts default to `buildCmd: ""`, preventing `agentctl gate` false reds during pure script verification.
+- [x] **CLI Flag Parity (`bin/agentctl.mjs`)** — `--verify` supported alongside `--verify-cmd` across `agentctl task create`, `task template`, and `task optimize`.
+
+### v0.72.1: Staged Mode Diff Fidelity & Indentation-Aware Tamper Defense
+- [x] **Staged Mode Diff Fidelity (`src/git.mjs`)** — `diffText` in staged mode queries `git diff --cached <base>`, ensuring staged additions on feature branches are visible to secret and tamper scanners.
+- [x] **Universal Dead Guard Detection (`src/security.mjs`)** — extended `DEAD_GUARD_CONDITION` to recognize literal falsities (`if False:`, `if (false)`, `if 0:`).
+- [x] **Indentation-Aware Block Traversal (`src/security.mjs`)** — detects dead-guard assertions and failure calls in indentation-based languages (Python) without requiring `{}` braces.
+- [x] **Comprehensive Guard Call Detection (`src/security.mjs`)** — `VACUOUS_ASSERTION` now covers both failure calls and test assertions.
 
 ### v0.72.0: Cold-Start Hardened Kernel & Tamper Defense
 - [x] **Canonical Root Test Guard (F01)** — `test.js` at repository root is inside the tamper guard.

package/bin/agentctl.mjs

@@ -1854,6 +1854,7 @@ async function main() {
             template: { type: "string" },
             depends: { type: "string" },
             "depends-on": { type: "string" },
+            verify: { type: "string" },
             "verify-cmd": { type: "string", short: "v" },
             "auto-pr": { type: "boolean" },
             "require-plan-approval": { type: "boolean" },
@@ -1886,7 +1887,7 @@ async function main() {
           tier: values.tier,
           template: values.template,
           dependsOn: values["depends-on"] || values.depends,
-          verifyCmd: values["verify-cmd"],
+          verifyCmd: values["verify-cmd"] || values.verify,
           autoPr: values["auto-pr"],
           requirePlanApproval: values["require-plan-approval"],
           repoless: values.repoless,
@@ -1916,6 +1917,7 @@ async function main() {
           options: {
             list: { type: "boolean", short: "l" },
             json: { type: "boolean", short: "j" },
+            verify: { type: "string" },
             "verify-cmd": { type: "string", short: "v" },
             "dry-run": { type: "boolean", short: "d" },
           },
@@ -1949,7 +1951,7 @@ async function main() {
           process.exit(1);
         }
 
-        const envelope = synthesizeWebEnvelope(templateName, {}, { verifyCmd: values["verify-cmd"] });
+        const envelope = synthesizeWebEnvelope(templateName, {}, { verifyCmd: values["verify-cmd"] || values.verify });
         if (values.json) {
           console.log(JSON.stringify({ ok: true, ...envelope }, null, 2));
         } else {
@@ -1971,6 +1973,7 @@ async function main() {
             dir: { type: "string", short: "d" },
             web: { type: "boolean", short: "w" },
             json: { type: "boolean", short: "j" },
+            verify: { type: "string" },
             "verify-cmd": { type: "string", short: "v" },
             "dry-run": { type: "boolean" },
           },
@@ -1982,7 +1985,7 @@ async function main() {
         const promptText = resolvePromptInput(values, positionals);
 
         if (values.fix) {
-          const opt = optimizeTaskPrompt(promptText, { rootDir: targetDir, verifyCmd: values["verify-cmd"], web: values.web });
+          const opt = optimizeTaskPrompt(promptText, { rootDir: targetDir, verifyCmd: values["verify-cmd"] || values.verify, web: values.web });
           if (values.json) {
             console.log(JSON.stringify(opt, null, 2));
           } else {
@@ -1991,7 +1994,7 @@ async function main() {
           process.exit(0);
         }
 
-        const analysis = scorePromptFalsifiability(promptText, { rootDir: targetDir, verifyCmd: values["verify-cmd"] });
+        const analysis = scorePromptFalsifiability(promptText, { rootDir: targetDir, verifyCmd: values["verify-cmd"] || values.verify });
         if (values.json) {
           console.log(JSON.stringify(analysis, null, 2));
         } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.72.0",
+  "version": "0.72.2",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/src/git.mjs

@@ -1,4 +1,4 @@
-import { execFileSync, execSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { readFileSync, existsSync, statSync, lstatSync, readlinkSync, mkdtempSync, rmSync, symlinkSync } from "node:fs";
 import { join, delimiter } from "node:path";
 import { tmpdir } from "node:os";
@@ -216,16 +216,17 @@ export function runCmd(command, opts = {}) {
   }
 
   try {
-    const stdout = useShell
-      ? execSync(shellCmd, {
+    const ret = useShell
+      ? spawnSync(shellCmd, {
           cwd,
           encoding: "utf-8",
+          shell: true,
           stdio: ["ignore", "pipe", "pipe"],
           env: childEnv,
           timeout,
           maxBuffer,
         })
-      : execFileSync(winSpawn ? winSpawn.file : binary, winSpawn ? winSpawn.args : args, {
+      : spawnSync(winSpawn ? winSpawn.file : binary, winSpawn ? winSpawn.args : args, {
           cwd,
           encoding: "utf-8",
           shell: winShim,
@@ -236,20 +237,14 @@ export function runCmd(command, opts = {}) {
           maxBuffer,
         });
 
-    return { status: 0, stdout: String(stdout || "").trim(), stderr: "" };
-  } catch (err) {
-    const isTimeout = err.code === "ETIMEDOUT" || (err.signal === "SIGTERM" && err.killed);
-    const isNobufs = err.code === "ENOBUFS" || (err.message && err.message.includes("maxBuffer"));
+    const isTimeout = Boolean(ret.error && (ret.error.code === "ETIMEDOUT" || (ret.signal === "SIGTERM" && ret.error.killed)));
+    const isNobufs = Boolean(ret.error && (ret.error.code === "ENOBUFS" || (ret.error.message && ret.error.message.includes("maxBuffer"))));
 
-    const status = err.status || (isTimeout ? 124 : 1);
-    let stdout = (err.stdout || "").toString().trim();
-    let stderr = (err.stderr || err.message || "").toString().trim();
+    const status = typeof ret.status === "number" ? ret.status : (isTimeout ? 124 : 1);
+    let stdout = (ret.stdout || "").toString().trim();
+    let stderr = (ret.stderr || (ret.error && ret.error.message) || "").toString().trim();
 
     if (isTimeout) {
-      // Node's own message for this is `spawnSync sh ETIMEDOUT`, which already
-      // contains the token the old guard tested for — so the explanation was
-      // skipped exactly when it was needed, and the user was left with five
-      // words that name neither the limit nor the way to raise it.
       stderr =
         `Command execution timed out after ${timeout}ms (ETIMEDOUT). ` +
         `The command was killed, not failed: raise verify.timeout_ms in ` +
@@ -260,17 +255,31 @@ export function runCmd(command, opts = {}) {
       stderr = `Command output buffer exceeded limit of ${maxBuffer} bytes (ENOBUFS)${stderr ? "\n" + stderr : ""}`;
     }
 
-    if (opts.ignoreError) {
-      return { status, stdout, stderr };
-    }
+    if (ret.error || status !== 0) {
+      if (opts.ignoreError) {
+        return { status, stdout, stderr };
+      }
 
-    if (isTimeout) {
-      throw new GateError(`Command execution timed out (ETIMEDOUT): ${useShell ? shellCmd : binary}`, { code: status });
-    }
-    if (isNobufs) {
-      throw new GateError(`Command output buffer exceeded limit (ENOBUFS): ${useShell ? shellCmd : binary}`, { code: status });
+      if (isTimeout) {
+        throw new GateError(`Command execution timed out (ETIMEDOUT): ${useShell ? shellCmd : binary}`, { code: status });
+      }
+      if (isNobufs) {
+        throw new GateError(`Command output buffer exceeded limit (ENOBUFS): ${useShell ? shellCmd : binary}`, { code: status });
+      }
+
+      const err = ret.error || new Error(`Command failed with status ${status}: ${useShell ? shellCmd : binary}`);
+      err.status = status;
+      err.code = status;
+      err.stdout = stdout;
+      err.stderr = stderr;
+      throw err;
     }
 
+    return { status: 0, stdout, stderr };
+  } catch (err) {
+    if (opts.ignoreError && !(err instanceof GateError)) {
+      return { status: err.status || 1, stdout: (err.stdout || "").toString().trim(), stderr: (err.stderr || err.message || "").toString().trim() };
+    }
     throw err;
   }
 }
@@ -453,6 +462,8 @@ export function diffText(root = process.cwd(), base = "main", mode = "committed"
       } catch (_) {}
     }
     return [committed, uncommitted, untrackedDiff].filter(Boolean).join("\n");
+  } else if (mode === "staged" || mode === "index") {
+    return git(["diff", "--cached", resolvedRef], { cwd: root, raw: true });
   }
   return git(["diff", `${resolvedRef}...HEAD`], { cwd: root, raw: true });
 }

package/src/security.mjs

@@ -2395,7 +2395,7 @@ export const TAMPER_KIND_NAMES = Object.freeze([...new Set(TAMPER_KINDS.values()
  * branch behind real state) is not guessable and is deliberately left alone.
  */
 const DEAD_GUARD_CONDITION =
-  /\bif\b[^;{}]*\b(?:len|len\s+of|count|size|length|num\w*|total)\s*\([^)]*\)\s*(?:<\s*0|<\s*-0\b)|<=\s*-1\b/i;
+  /\bif\b[^;{}]*\b(?:len|len\s+of|count|size|length|num\w*|total)\s*\([^)]*\)\s*(?:<\s*0|<\s*-0\b|<=\s*-1\b)|\bif\s+(?:False|false|0)\s*(?::|\{|$|\b)|\bif\s*\(\s*(?:False|false|0)\s*\)/;
 
 /**
  * The calls a test uses to say "this failed": the assertion's actual teeth.
@@ -2983,24 +2983,49 @@ export function checkTestTampering(diffOrText = "", options = {}) {
         if (L.kind !== "+" || !DEAD_GUARD_CONDITION.test(L.text)) continue;
         const guardLineNo = L.newNo;
         const guardText = L.text;
-                let depth = (guardText.match(/\{/g) || []).length - (guardText.match(/\}/g) || []).length;
-        let found = depth > 0 && FAILURE_CALL.test(guardText.slice(guardText.indexOf("{")));
-        for (let k = i + 1; k < hunk.lines.length && depth > 0; k++) {
-          const t = hunk.lines[k].text || "";
-          const opens = (t.match(/\{/g) || []).length;
-          const closes = (t.match(/\}/g) || []).length;
-          if (depth > 0 && FAILURE_CALL.test(t)) { found = true; break; }
-          depth += opens - closes;
+        const isFailureOrAssertion = (text) => FAILURE_CALL.test(text) || ASSERTION_PATTERN.test(text);
+        let found = false;
+
+        if (guardText.includes("{")) {
+          let depth = (guardText.match(/\{/g) || []).length - (guardText.match(/\}/g) || []).length;
+          if (depth > 0 && isFailureOrAssertion(guardText.slice(guardText.indexOf("{")))) {
+            found = true;
+          }
+          for (let k = i + 1; k < hunk.lines.length && depth > 0; k++) {
+            const t = hunk.lines[k].text || "";
+            const opens = (t.match(/\{/g) || []).length;
+            const closes = (t.match(/\}/g) || []).length;
+            if (depth > 0 && isFailureOrAssertion(t)) { found = true; break; }
+            depth += opens - closes;
+          }
+        } else {
+          // Indentation-based block (Python, etc.) or single-line guard without braces
+          const colonIdx = guardText.indexOf(":");
+          const parenIdx = guardText.lastIndexOf(")");
+          const afterGuard = colonIdx !== -1 ? guardText.slice(colonIdx + 1) : (parenIdx !== -1 ? guardText.slice(parenIdx + 1) : "");
+          if (afterGuard && isFailureOrAssertion(afterGuard)) {
+            found = true;
+          } else {
+            const guardIndent = (guardText.match(/^\s*/)?.[0] || "").length;
+            for (let k = i + 1; k < hunk.lines.length; k++) {
+              const t = hunk.lines[k].text || "";
+              if (!t.trim() || isCommentLine(t)) continue;
+              const lineIndent = (t.match(/^\s*/)?.[0] || "").length;
+              if (lineIndent <= guardIndent) break;
+              if (isFailureOrAssertion(t)) { found = true; break; }
+            }
+          }
         }
+
         if (found) {
           violations.push({
             file,
             line: guardLineNo,
             type: "VACUOUS_ASSERTION",
             reason:
-              `Test Tamper Guard: the failure call in ${file}${guardLineNo ? `:${guardLineNo}` : ""} ` +
+              `Test Tamper Guard: the assertion or failure call in ${file}${guardLineNo ? `:${guardLineNo}` : ""} ` +
               `is guarded by a condition that can never be true ("${collapseWhitespace(guardText).trim()}"), so the ` +
-              `assertion cannot fail. Keeping the failure call in dead logic is not preservation of verification.`,
+              `assertion cannot fail. Keeping the assertion in dead logic is not preservation of verification.`,
           });
         }
       }

package/src/stack-detector.mjs

@@ -475,11 +475,27 @@ export function detectPolyglotStack(projectRoot = process.cwd()) {
       : existsSync(join(projectRoot, "bun.lockb"))
       ? "bun.lockb"
       : "bun.lock";
-    return { ...container, stack: "bun", setupCmd, testCmd: "bun test", buildCmd: "bun run build", triggerFile };
+    let buildCmd = "";
+    if (existsSync(join(projectRoot, "package.json"))) {
+      try {
+        const pkg = JSON.parse(readFileSync(join(projectRoot, "package.json"), "utf-8"));
+        if (pkg && typeof pkg === "object" && pkg.scripts && pkg.scripts.build) {
+          buildCmd = "bun run build";
+        }
+      } catch (_) {}
+    }
+    return { ...container, stack: "bun", setupCmd, testCmd: "bun test", buildCmd, triggerFile };
   }
   if (existsSync(join(projectRoot, "deno.json")) || existsSync(join(projectRoot, "deno.jsonc"))) {
     const triggerFile = existsSync(join(projectRoot, "deno.json")) ? "deno.json" : "deno.jsonc";
-    return { ...container, stack: "deno", setupCmd, testCmd: "deno test", buildCmd: "deno task build", triggerFile };
+    let buildCmd = "";
+    try {
+      const denoConfig = JSON.parse(readFileSync(join(projectRoot, triggerFile), "utf-8"));
+      if (denoConfig && typeof denoConfig === "object" && denoConfig.tasks && denoConfig.tasks.build) {
+        buildCmd = "deno task build";
+      }
+    } catch (_) {}
+    return { ...container, stack: "deno", setupCmd, testCmd: "deno test", buildCmd, triggerFile };
   }
   if (existsSync(join(projectRoot, "package.json"))) {
     const hasPnpm = existsSync(join(projectRoot, "pnpm-lock.yaml"));