jules-orchestrator-kit 0.72.2 → 0.73.0

package/bin/init.js

@@ -260,9 +260,12 @@ const setupMdContent = `# Google Jules Encoded Workspace Manifest
 > **Generated**: ${agentState.generatedAt}
 > **Workspace Manifest Code**: \`${payloadToken}\`
 
-## 🔗 Official Setup & Documentation
-1. Documentation & Guide: https://jules.google
-2. Workspace Manifest Code:
+## Encoded workspace preset
+This kit-generated JULES1. token is an encoded workspace preset generated for the Jules web UI, not an official Google setup code or credential. It contains a SHA-256 digest and base64url-encoded Brotli-compressed JSON; encoding is not encryption. Review the decoded settings before use.
+
+Jules web UI: https://jules.google (the preset format is maintained by this kit).
+
+Workspace Manifest Code:
 \`\`\`
 ${payloadToken}
 \`\`\`

package/index.mjs

@@ -111,13 +111,16 @@ export { measureEventLoopDelay } from "./src/perf.mjs";
 export { DagExecutor, DagCycleError } from "./src/dag-engine.mjs";
 export { journalIntent, journalDone, reapOrphanedIntents, reapStaleMutexDirs } from "./src/journal.mjs";
 
-// Legacy SDK shims for backward compatibility
+// Command resolution entrypoint (package.json/CI required) and its boundary helpers.
 export { resolveProjectCommands, resolveWorkspaceExecutionBoundary } from "./scripts/command-resolver.mjs";
-export { runSelfAudit, runPreflightSandbox } from "./scripts/jules-self-audit.mjs";
-export { scanCodebaseForTodos, runScanner } from "./scripts/jules-scan-todos.mjs";
-export { getDynamicGuardrails, dispatchTask } from "./scripts/jules-dispatch.mjs";
-export { classifyQueueFailure } from "./scripts/jules-queue-runner.mjs";
-export { extractPrUrls, auditSessions, buildSyncManifest, pushReservationManifest } from "./scripts/utils.mjs";
+// Self-audit, TODO scanner, dispatch helpers, and swarm sync manifest:
+// implementation lives in src/ (P04 shim cleanup); the scripts/ files are
+// minimal CLI entrypoints that re-export the same surface for compatibility.
+export { runSelfAudit, runPreflightSandbox } from "./src/self-audit.mjs";
+export { scanCodebaseForTodos, runScanner } from "./src/todo-scanner.mjs";
+export { getDynamicGuardrails, dispatchTask } from "./src/dispatch.mjs";
+export { classifyQueueFailure } from "./src/engine.mjs";
+export { extractPrUrls, auditSessions, buildSyncManifest, pushReservationManifest } from "./src/swarm.mjs";
 
 // Native TUI Primitives
 export { isTTY, styleText, select, multiSelect, input, confirm, secretInput, spinner, ANSI } from "./src/tui.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.72.2",
+  "version": "0.73.0",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/scripts/asset-integrity-check.mjs

@@ -8,7 +8,7 @@ const root = process.cwd();
 const dirsToScan = ["public", "src/assets", "assets", "static"].map((d) => join(root, d)).filter(existsSync);
 
 if (dirsToScan.length === 0) {
-  console.log("[asset-integrity] No asset directories (public/, src/assets/) found. Passing.");
+  console.log("[asset-integrity] status: N/A — No asset directories (public/, src/assets/, assets/, static/) found. Nothing to check.");
   process.exit(0);
 }
 

package/scripts/doc-sync-check.mjs

@@ -20,6 +20,7 @@ import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { execSync } from "node:child_process";
 import { resolveRoot } from "../src/config.mjs";
+import { formatRegistryMarkdown } from "../src/ops/command-registry.mjs";
 
 /**
  * Runs the unit suite and extracts the authoritative counts.
@@ -317,6 +318,52 @@ export function checkDocSync(root = process.cwd(), opts = {}) {
     }
   }
 
+  // 6. SECURITY.md — supported version table must name the current version series.
+  const security = readIfExists(join(root, "SECURITY.md"));
+  if (security === null) {
+    add("SECURITY present", false, "SECURITY.md not found");
+  } else {
+    const sem = version.split(".");
+    const expectedSeries = `v${sem[0]}.${sem[1]}.x`;
+    const secMatch = security.match(/\|\s*`v(\d+\.\d+)\.x`\s*\(Latest\)\s*\|/);
+    add(
+      "SECURITY supported version",
+      secMatch ? `v${secMatch[1]}.x` === expectedSeries : false,
+      secMatch ? `found v${secMatch[1]}.x, expected ${expectedSeries}` : "no `vX.Y.x (Latest)` marker found"
+    );
+  }
+
+  // 7. docs/COMMAND_REFERENCE.md — regenerated from the command registry on
+  //    every run and diffed against the file on disk. The registry feeds
+  //    `agentctl --help` and `help <command>`, so a stale reference means the
+  //    docs disagree with the CLI itself. Regenerate with:
+  //      node scripts/generate-command-reference.mjs
+  const referencePath = join(root, "docs", "COMMAND_REFERENCE.md");
+  const referenceOnDisk = readIfExists(referencePath);
+  if (referenceOnDisk === null) {
+    add("COMMAND_REFERENCE present", false, "docs/COMMAND_REFERENCE.md not found");
+  } else {
+    let rendered = null;
+    try {
+      rendered = `${formatRegistryMarkdown()}`.replace(/\s+$/, "") + "\n";
+    } catch {
+      rendered = null;
+    }
+    if (rendered === null) {
+      add("COMMAND_REFERENCE in sync", false, "could not render registry (import failed)");
+    } else {
+      const diskNorm = referenceOnDisk.replace(/\r\n/g, "\n");
+      const renderedNorm = rendered.replace(/\r\n/g, "\n");
+      add(
+        "COMMAND_REFERENCE in sync",
+        diskNorm === renderedNorm,
+        diskNorm === renderedNorm
+          ? "matches src/ops/command-registry.mjs"
+          : "stale — run: node scripts/generate-command-reference.mjs"
+      );
+    }
+  }
+
   return { ok: checks.every((c) => c.ok), version, checks };
 }
 

package/scripts/generate-command-reference.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+
+/**
+ * Regenerate docs/COMMAND_REFERENCE.md from the command registry.
+ *
+ * The registry (src/ops/command-registry.mjs) is the single source of truth
+ * for command flags, usage and examples; this script renders it to Markdown
+ * so the checked-in reference cannot drift from `agentctl --help` output.
+ * The doc-sync gate (scripts/doc-sync-check.mjs) diffs the rendered output
+ * against the file on disk and fails on any difference.
+ *
+ * Usage:
+ *   node scripts/generate-command-reference.mjs          # write the file
+ *   node scripts/generate-command-reference.mjs --check  # exit 1 if stale
+ */
+
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { formatRegistryMarkdown } from "../src/ops/command-registry.mjs";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+const TARGET = join(ROOT, "docs", "COMMAND_REFERENCE.md");
+
+const rendered = formatRegistryMarkdown().replace(/\s+$/, "") + "\n";
+
+if (process.argv.includes("--check")) {
+  const onDisk = existsSync(TARGET) ? readFileSync(TARGET, "utf-8").replace(/\r\n/g, "\n") : null;
+  const expected = rendered.replace(/\r\n/g, "\n");
+  if (onDisk === expected) {
+    console.log("✅ docs/COMMAND_REFERENCE.md is in sync with the command registry.");
+    process.exit(0);
+  }
+  console.error("❌ docs/COMMAND_REFERENCE.md is stale — run: node scripts/generate-command-reference.mjs");
+  process.exit(1);
+}
+
+writeFileSync(TARGET, rendered);
+console.log(`✅ Wrote ${TARGET}`);

package/scripts/jules-dispatch.mjs

@@ -1,128 +1,27 @@
 #!/usr/bin/env node
 
 /**
- * Task dispatch entrypoint: delegates execution to engine dispatch pipeline.
+ * Task dispatch entrypoint: deprecated CLI shim that delegates to the
+ * dispatch pipeline. All logic (guardrails, attachments, argv parsing,
+ * dispatchTask) lives in src/dispatch.mjs (P04 shim cleanup).
+ *
+ * The re-export below preserves the historical
+ * `scripts/jules-dispatch.mjs` import surface for external consumers,
+ * and — deliberately — keeps argv parsing OUT of module scope: importing
+ * this file must never consume the importer's process.argv (D10).
  */
 
-import { dispatch } from "../src/engine.mjs";
-import { loadConfig } from "../src/config.mjs";
-import { existsSync, statSync } from "node:fs";
-import { join } from "node:path";
+export * from "../src/dispatch.mjs";
+
+import { dispatchTask, parseDispatchArgs } from "../src/dispatch.mjs";
 
 if (process.argv[1] && (process.argv[1].endsWith("jules-dispatch.mjs") || process.argv[1].endsWith("jules-dispatch"))) {
   process.emitWarning(
     "scripts/jules-dispatch.mjs is deprecated and will be removed in v1.0.0. Use 'agentctl dispatch' or the programmatic SDK.",
     "DeprecationWarning"
   );
-}
-
-const args = process.argv.slice(2);
-let title = "Task Dispatch";
-let prompt = "";
-let dryRun = process.env.JULES_DRY_RUN === "true" || process.env.JULES_DRY_RUN === "1" || args.includes("--dry-run");
-let repoless = args.includes("--repoless");
-
-for (let i = 0; i < args.length; i++) {
-  if (args[i] === "--title" && args[i + 1]) title = args[i + 1];
-  else if (args[i] === "--prompt" && args[i + 1]) prompt = args[i + 1];
-}
-
-if (!prompt && args[0] && !args[0].startsWith("-")) {
-  title = args[0];
-  prompt = args[1] || args[0];
-}
-
-if (!prompt) {
-  prompt = "Execute task";
-}
-
-export function getDynamicGuardrails(promptText = "") {
-  const p = (promptText || "").toLowerCase();
-  const rules = [];
-  if (p.includes("auth") || p.includes("sec") || p.includes("key") || p.includes("token")) {
-    rules.push("Sentinel: SECRET REDACTION GUARDRAILS");
-  }
-  if (p.includes("perf") || p.includes("optimiz") || p.includes("fast")) {
-    rules.push("Performance Guidance (Bolt)");
-  }
-  if (p.includes("clean") || p.includes("refactor") || p.includes("lint")) {
-    rules.push("Clean Code Guidance (Janitor)");
-  }
-  if (p.includes("db") || p.includes("sql") || p.includes("database") || p.includes("schema")) {
-    rules.push("Alchemist: DATABASE GUARDRAILS");
-  }
-  if (p.includes("css") || p.includes("tailwind") || p.includes("theme")) {
-    rules.push("CSS & DESIGN GUARDRAILS");
-  }
-  return rules.join("\n");
-}
-
-export function extractImageAttachments(promptText = "", projectRoot = process.cwd()) {
-  if (!promptText || typeof promptText !== "string") return [];
-  const regex = /!\[([^\]]*)\]\(([^)]+)\)/g;
-  const matches = [];
-  let match;
-  while ((match = regex.exec(promptText)) !== null) {
-    const relPath = match[2].trim();
-    if (relPath.includes("..")) continue;
-    const absPath = join(projectRoot, relPath);
-    if (existsSync(absPath)) {
-      let mime = "image/png";
-      if (relPath.endsWith(".jpg") || relPath.endsWith(".jpeg")) mime = "image/jpeg";
-      if (relPath.endsWith(".gif")) mime = "image/gif";
-      if (relPath.endsWith(".webp")) mime = "image/webp";
-      const size = statSync(absPath).size;
-      matches.push({ relPath, absPath, mime, size });
-    }
-  }
-  return matches;
-}
-
-export function getMultimodalAttachmentDirective(attachments = []) {
-  if (!attachments || attachments.length === 0) return "";
-  return `### Multimodal Task Attachments (${attachments.length})\n` + attachments.map((a) => `- ${a.relPath}`).join("\n");
-}
-
-export function runPreflightStaticCheck(_projectRoot = process.cwd()) {
-  return "PASSED";
-}
-
-export function getAlphaRange(slotIndex = 0, totalSlots = 1) {
-  const total = Number(totalSlots);
-  const idx = Number(slotIndex);
-  if (total <= 1) return "A-Z";
-  if (total === 2) {
-    return idx === 0 ? "A-M" : "N-Z";
-  }
-  return `Slot ${idx + 1}`;
-}
-
-export function getSlotPartitionDirective(slotIndex = 0, totalSlots = 1) {
-  const total = Number(totalSlots);
-  const idx = Number(slotIndex);
-  if (total <= 1) return "";
-  return `[PARALLEL SWARM SLOT ${idx} of ${total}] Range: ${getAlphaRange(idx, total)} (Partition Focus)`;
-}
-
-export async function dispatchTask(opts = {}) {
-  const root = process.env.JULES_PROJECT_ROOT || process.cwd();
-  const config = loadConfig(root);
-  const isDry = opts.dryRun || dryRun;
-  const taskTitle = opts.title || title;
-  const taskPrompt = opts.prompt || prompt;
-
-  if (isDry) {
-    console.log(`[DRY RUN] Dispatching task: ${taskTitle}`);
-    console.log(`[DRY RUN] Dispatch payload prepared successfully`);
-    if (repoless || opts.repoless) {
-      console.log(`[DRY RUN] Target: (repoless / serverless)`);
-    }
-  }
-  return dispatch({ title: taskTitle, prompt: taskPrompt }, { config, dryRun: isDry });
-}
 
-if (process.argv[1] && process.argv[1].endsWith("jules-dispatch.mjs")) {
-  dispatchTask()
+  dispatchTask(parseDispatchArgs(process.argv.slice(2)))
     .then((session) => {
       console.log(`[Shim] Task dispatched session: ${session.id}`);
       process.exit(0);

package/scripts/jules-merge-swarm.mjs

@@ -1,204 +1,17 @@
 #!/usr/bin/env node
 
 /**
- * Swarm branch merger with 3-way structural JSON/object merge, git merge-file execution
- * isolated in os.tmpdir(), and safety gate checking.
+ * Swarm merge CLI entrypoint.
+ *
+ * The merge engine (3-way structural merge, git merge-file isolation,
+ * safety gate) lives in src/merge-swarm.mjs (P04 shim cleanup). The
+ * re-export below preserves the historical `scripts/jules-merge-swarm.mjs`
+ * import surface for external consumers.
  */
 
-import { writeFileSync, readFileSync, existsSync, readdirSync, rmSync, mkdtempSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { spawnSync } from "node:child_process";
-import { classifyRiskTier, RISK_TIERS } from "../src/risk.mjs";
-import { git, resolveBase } from "../src/git.mjs";
-import { normalizePath, loadConfig } from "../src/config.mjs";
+export * from "../src/merge-swarm.mjs";
 
-export const EXIT = Object.freeze({
-  SUCCESS: 0,
-  R3_RESTRICTED: 3,
-  MERGE_CONFLICT: 4,
-});
-
-const BLOCKED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
-
-function isPlainObject(v) {
-  return (
-    v !== null &&
-    typeof v === "object" &&
-    !Array.isArray(v) &&
-    (Object.getPrototypeOf(v) === null || Object.getPrototypeOf(v) === Object.prototype)
-  );
-}
-
-function deepClone(v) {
-  if (v === undefined) return undefined;
-  return JSON.parse(JSON.stringify(v));
-}
-
-function stableStringify(v) {
-  if (v === null || typeof v !== "object") return JSON.stringify(v);
-  if (Array.isArray(v)) return `[${v.map(stableStringify).join(",")}]`;
-  const keys = Object.keys(v).filter((k) => !BLOCKED_KEYS.has(k)).sort();
-  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(v[k])}`).join(",")}}`;
-}
-
-function deepEqual(a, b) {
-  return stableStringify(a) === stableStringify(b);
-}
-
-/**
- * Recursive 3-way structural object & array merge.
- */
-export function deepMerge3Way(base, ours, theirs, path = "$") {
-  const conflicts = [];
-  if (deepEqual(ours, theirs)) return { merged: deepClone(ours), conflicts };
-  if (deepEqual(ours, base)) return { merged: deepClone(theirs), conflicts };
-  if (deepEqual(theirs, base)) return { merged: deepClone(ours), conflicts };
-
-  if (isPlainObject(base) && isPlainObject(ours) && isPlainObject(theirs)) {
-    const merged = {};
-    const safeBase = base || {};
-    const safeOurs = ours || {};
-    const safeTheirs = theirs || {};
-    const keys = new Set([
-      ...Object.keys(safeBase),
-      ...Object.keys(safeOurs),
-      ...Object.keys(safeTheirs),
-    ]);
-    for (const k of keys) {
-      if (BLOCKED_KEYS.has(k)) continue;
-      const childPath = `${path}.${k}`;
-      const b = safeBase[k], o = safeOurs[k], t = safeTheirs[k];
-      if (o === undefined && t === undefined) continue;
-      if (o === undefined) { merged[k] = deepClone(t); continue; }
-      if (t === undefined) { merged[k] = deepClone(o); continue; }
-      const sub = deepMerge3Way(b, o, t, childPath);
-      merged[k] = sub.merged;
-      conflicts.push(...sub.conflicts);
-    }
-    return { merged, conflicts };
-  }
-
-  if (Array.isArray(ours) && Array.isArray(theirs)) {
-    const baseArr = Array.isArray(base) ? base : [];
-    const minLen = Math.min(ours.length, theirs.length);
-    const merged = [];
-    for (let i = 0; i < minLen; i++) {
-      const sub = deepMerge3Way(baseArr[i], ours[i], theirs[i], `${path}[${i}]`);
-      merged.push(sub.merged);
-      conflicts.push(...sub.conflicts);
-    }
-    if (ours.length > minLen && theirs.length <= minLen) {
-      merged.push(...ours.slice(minLen).map(deepClone));
-    } else if (theirs.length > minLen && ours.length <= minLen) {
-      merged.push(...theirs.slice(minLen).map(deepClone));
-    } else if (ours.length > minLen && theirs.length > minLen) {
-      conflicts.push({
-        path: `${path}[tail]`,
-        base: baseArr.slice(minLen),
-        ours: ours.slice(minLen),
-        theirs: theirs.slice(minLen),
-      });
-      merged.push(...ours.slice(minLen).map(deepClone));
-    }
-    return { merged, conflicts };
-  }
-
-  conflicts.push({ path, base: deepClone(base), ours: deepClone(ours), theirs: deepClone(theirs) });
-  return { merged: deepClone(ours), conflicts };
-}
-
-/**
- * Executes a function inside a temporary directory in os.tmpdir() with guaranteed cleanup.
- */
-export function withTempDir(prefix, fn) {
-  const dir = mkdtempSync(join(tmpdir(), prefix || "jules-merge-"));
-  try {
-    return fn(dir);
-  } finally {
-    try {
-      rmSync(dir, { recursive: true, force: true });
-    } catch (_) {}
-  }
-}
-
-/**
- * Attempts a 3-way text file merge using git merge-file inside os.tmpdir().
- */
-export function attemptCodeMergeFile(repoRoot, relPath, oursContent, baseContent, theirsContent) {
-  return withTempDir("jules-merge-", (tmp) => {
-    const baseFile = join(tmp, "base");
-    const oursFile = join(tmp, "ours");
-    const theirsFile = join(tmp, "theirs");
-    writeFileSync(baseFile, baseContent ?? "", "utf-8");
-    writeFileSync(oursFile, oursContent ?? "", "utf-8");
-    writeFileSync(theirsFile, theirsContent ?? "", "utf-8");
-
-    const res = spawnSync("git", ["merge-file", "-p", "--diff3", oursFile, baseFile, theirsFile], {
-      encoding: "utf-8",
-      maxBuffer: 64 * 1024 * 1024,
-    });
-
-    if (res.error) {
-      return { ok: false, conflicts: 0, error: res.error.message };
-    }
-    const conflictCount = res.status && res.status > 0 ? res.status : 0;
-    const merged = res.stdout ?? "";
-    return {
-      ok: conflictCount === 0,
-      merged,
-      conflicts: conflictCount,
-    };
-  });
-}
-
-/**
- * Checks safety gate against active worker locks and risk tiers.
- */
-export function checkSafetyGate(branchName = "", projectRoot = process.cwd(), opts = {}) {
-  const locksDir = join(projectRoot, ".agent/state/locks");
-  if (existsSync(locksDir)) {
-    try {
-      const files = readdirSync(locksDir);
-      for (const f of files) {
-        if (!f.endsWith(".json")) continue;
-        const content = readFileSync(join(locksDir, f), "utf-8");
-        const parsed = JSON.parse(content);
-        if (parsed.branch === branchName) {
-          return { safe: false, reason: `Active lock held by worker ${parsed.agent || "unknown"}` };
-        }
-      }
-    } catch (_) {}
-  }
-
-  // Check R3 risk tier if files modified on target branch
-  if (branchName) {
-    try {
-      const baseBranch = process.env.BASE_BRANCH || "main";
-      const resolvedBase = resolveBase(projectRoot, baseBranch);
-      const raw = git(["-c", "core.quotePath=false", "diff", "-z", "--name-only", `${resolvedBase}...${branchName}`], { cwd: projectRoot, raw: true, ignoreError: true }) || "";
-      const files = raw.split("\0").map(normalizePath).filter(Boolean);
-      if (files.length > 0) {
-        // The repository's own risk paths must apply here too, or the gate and
-        // the harvester classify the same branch differently.
-        let config = opts.config;
-        if (!config) {
-          try {
-            config = loadConfig(projectRoot);
-          } catch (_) {
-            config = {};
-          }
-        }
-        const tier = classifyRiskTier(files, { config });
-        if (tier.tier === RISK_TIERS.R3) {
-          return { safe: false, reason: `R3 Restricted Path violation: ${tier.reason}` };
-        }
-      }
-    } catch (_) {}
-  }
-
-  return { safe: true };
-}
+import { EXIT, checkSafetyGate } from "../src/merge-swarm.mjs";
 
 if (process.argv[1] && process.argv[1].endsWith("jules-merge-swarm.mjs")) {
   const branchName = process.argv[2] || "";
@@ -211,4 +24,3 @@ if (process.argv[1] && process.argv[1].endsWith("jules-merge-swarm.mjs")) {
   console.log("No open Jules PRs found.");
   process.exit(EXIT.SUCCESS);
 }
-

package/scripts/jules-patch.mjs

@@ -1,17 +1,16 @@
 #!/usr/bin/env node
 
 /**
- * Session patch fetching utility.
+ * Session patch fetching CLI entrypoint.
+ *
+ * fetchSessionPatch (argument validation around src/session-ops.mjs's
+ * extractSessionPatch) moved to session-ops itself (P04 shim cleanup); it is
+ * re-exported here for historical importers.
  */
 
-import { extractSessionPatch } from "../src/session-ops.mjs";
+export { fetchSessionPatch } from "../src/session-ops.mjs";
 
-export async function fetchSessionPatch(sessionId, options = {}) {
-  if (!sessionId || typeof sessionId !== "string") {
-    throw new Error("Session ID is required.");
-  }
-  return await extractSessionPatch(sessionId, options);
-}
+import { fetchSessionPatch } from "../src/session-ops.mjs";
 
 if (process.argv[1] && process.argv[1].endsWith("jules-patch.mjs")) {
   const sessionId = process.argv[2];

package/scripts/jules-queue-runner.mjs

@@ -2,17 +2,15 @@
 
 /**
  * Queue processing runner: processes envelopes in .agent/jules-queue/.
+ *
+ * Spawned by the webhook receiver as `node scripts/jules-queue-runner.mjs`.
+ * Failure classification lives in src/engine.mjs (P04 shim cleanup); the
+ * re-export keeps the historical import surface for external consumers.
  */
 
-import { run } from "../src/engine.mjs";
+export { classifyQueueFailure } from "../src/engine.mjs";
 
-export function classifyQueueFailure(err) {
-  const msg = String(err?.message || err || "");
-  if (msg.includes("FAILED_PRECONDITION") || msg.includes("Active Session Limit") || msg.includes("concurrency")) {
-    return "concurrency_limit";
-  }
-  return "retriable";
-}
+import { run } from "../src/engine.mjs";
 
 if (process.argv[1] && process.argv[1].endsWith("jules-queue-runner.mjs")) {
   const root = process.env.JULES_PROJECT_ROOT || process.cwd();

package/scripts/jules-scan-todos.mjs

@@ -1,48 +1,20 @@
 #!/usr/bin/env node
 
 /**
- * Codebase scanner for TODO and FIXME comments.
+ * TODO/FIXME scanner CLI entrypoint.
+ *
+ * The scanner itself (extension allowlist, size/binary limits, .gitignore
+ * awareness) lives in src/todo-scanner.mjs (P04 shim cleanup). The re-export
+ * below preserves the historical `scripts/jules-scan-todos.mjs` import
+ * surface for external consumers.
  */
 
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
+export * from "../src/todo-scanner.mjs";
 
-export function scanCodebaseForTodos(dir = process.cwd()) {
-  const todos = [];
-  function walk(current) {
-    let entries = [];
-    try { entries = readdirSync(current); } catch (_) { return; }
-    for (const entry of entries) {
-      if (entry === "node_modules" || entry === ".git") continue;
-      const full = join(current, entry);
-      try {
-        const stat = statSync(full);
-        if (stat.isDirectory()) {
-          walk(full);
-        } else if (stat.isFile()) {
-          const content = readFileSync(full, "utf-8");
-          const lines = content.split("\n");
-          lines.forEach((line, idx) => {
-            if (line.includes("TODO:")) {
-              todos.push({ file: full, line: idx + 1, text: line.trim(), tag: "TODO", type: "TODO", priority: "MEDIUM" });
-            } else if (line.includes("FIXME:")) {
-              todos.push({ file: full, line: idx + 1, text: line.trim(), tag: "FIXME", type: "FIXME", priority: "HIGH" });
-            }
-          });
-        }
-      } catch (_) {}
-    }
-  }
-  walk(dir);
-  return todos;
-}
-
-export function runScanner(dir = process.cwd()) {
-  const todos = scanCodebaseForTodos(dir);
-  return { todos, count: todos.length };
-}
+import { runScanner } from "../src/todo-scanner.mjs";
 
 if (process.argv[1] && process.argv[1].endsWith("jules-scan-todos.mjs")) {
-  console.log("[Shim] TODO Scanner complete.");
+  const { count } = runScanner(process.env.JULES_PROJECT_ROOT || process.cwd());
+  console.log(`[Shim] TODO Scanner complete. Found ${count} annotation(s).`);
   process.exit(0);
 }