jules-orchestrator-kit 0.74.0 → 0.75.1

package/CHANGELOG.md

@@ -7,13 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.75.1] - 2026-10-09
+
+### Added
+- **Auto-Merge CI Workflow Template (`src/ci-templates.mjs`, `bin/agentctl.mjs`)**: Added `buildAutoMergeWorkflow` and `--with-automerge` flag to `agentctl ci init`. Generates `.github/workflows/agent-automerge.yml` operating on `workflow_run` strictly from `ref: main`, enforcing secure bot actor validation (`google-labs-jules[bot]`, `github-actions[bot]`), untrusted commit data fetching, and base-branch gate verification before automated squash-merging.
+- **Quiet-Run Invariant (`AGENTS.md`, `JULES_RULES_TEMPLATE.md`)**: Enforced explicit invariant prohibiting cosmetic refactors and fabricated changes when scheduled or automated runs discover all constraints already satisfied.
+- **Automated SYNC-CORE Byte Parity Test (`test/cli-surface.test.mjs`)**: Added test verifying byte-level identity between `AGENTS.md` and `JULES_RULES_TEMPLATE.md` core rule blocks.
+
+### Security
+- **Symlink & Mode Inspection Hardening (`scripts/ci-scope-guard.mjs`)**: Replaced `--name-only` diff inspection with null-delimited raw diff parsing (`git diff --raw -z --no-renames`). Inspects blob modes, rejects symlinks (`mode 120000`) resolving to protected paths or escaping repository root via `git cat-file blob <dstSha>` without local checkout, rejects git submodules (`mode 160000`), and fails closed on unreadable symlink targets.
+
+## [0.75.0] - 2026-09-28
+
+### Added
+- **Interactive Terminal Navigation Hub (`src/ops/tui-menu.mjs`)**: Added zero-external-dependency terminal UI hub accessible via `agentctl menu`, `tui`, `ui`, or `-i`, using Node.js ESM built-ins (`readline`, ANSI cursor escape sequences). Supports arrow-key navigation, hotkey selection, command preview, contextual execution, and direct handoff to interactive wizards.
+- **Fuzzy Typo Correction & Suggestions (`bin/agentctl.mjs`)**: Implemented Levenshtein-distance suggestion engine for unrecognized CLI commands, surfacing closest matches (e.g. `agentctl dsipatch` suggests `dispatch`).
+- **Actionable Scope Diagnostics & Protected Scope Flag (`src/wizard-task.mjs`)**: Added `--allow-protected` flag to `agentctl task create` alongside detailed diagnostic breakdowns of which paths are protected (e.g. `package.json`, `.agent/protected-paths.json`) when task objectives touch sensitive repository infrastructure.
+- **Task Payload Preview on Dry-Run (`bin/agentctl.mjs`, `src/engine.mjs`)**: `agentctl dispatch --dry-run` now prints formatted task payloads, verification commands, and risk tier assignments before execution.
+- **Maintainer Approval Path for Test Changes (`.github/workflows/agent-scope-guard.yml`, `scripts/ci-scope-guard.mjs`)**: Established narrow maintainer approval protocol (`allow-p:<HEAD_SHA>`, `allow-e:<HEAD_SHA>`) allowing verified modifications to test expectations or protected paths under explicit commit-bound review.
+
+### Fixed
+- **Goal Evidence Enforcement (`src/engine.mjs`)**: Disallowed silent early termination on goal tasks lacking explicit verification evidence.
+- **Test Environment Variable Bleed (`src/engine.mjs`)**: Sanitized test execution environment to prevent PR label bypass tokens from leaking into child test runs during gate evaluation.
+
+### Changed
+- **Stack-Neutral Invariants & Isolation Cleanup (`src/wizard-task.mjs`, `docs/`)**: Removed hardcoded vendor framework assumptions from task authoring in favor of project configuration and options; purged Swedish phrasing from internal test suites and scripts.
+
 ## [0.74.0] - 2026-09-19
 
 ### Added
 - **Native `agentctl.task/v1` Frontmatter Specification & Zero-Dependency Parser (`src/envelope.mjs`, `scripts/validate-envelope.mjs`)**: Added canonical YAML frontmatter envelope support for task files (`.md`) without third-party dependencies. Reconciles `scope.allow`, `scope.deny`, `verification.commands`, `invariants`, `mcp_directives`, and `flags` with 100% backward compatibility for legacy HTML comments (`<!-- JULES_TASK_ENVELOPE: ... -->`).
 - **Taxonomy Delegation Lanes (Green / Amber / Orange / Red) (`src/envelope.mjs`, `src/wizard-task.mjs`)**: Formulated formal risk lane delegation. Red tasks are rejected at validation; Orange tasks warn for external execution only; Amber tasks allow protected path changes (e.g. dependency upgrades in `package.json`, migrations, auth) under explicit plan approval (`requirePlanApproval: true`). Green tasks prevent unapproved protected scope mutations.
 - **Circuit Breaker & Verification Contract in Envelope (`src/envelope.mjs`)**: Added frontmatter declarations for `circuitBreaker` (`max_attempts`, `max_diff_lines`, `stop_if_same_failure_repeats`) and `verification` metadata (`require_nonzero_test_count`, `trusted_base`), alongside `constraints` alias support.
-- **Stack Invariant & MCP Directive Ingestion (`src/wizard-task.mjs`)**: Automatically infers runtime constraints (Zero-JS for Astro, workerd edge runtime constraints for Cloudflare Wrangler) and injects mandatory pre-execution documentation lookup directives into task instructions.
+- **Custom Invariant & MCP Directive Ingestion (`src/wizard-task.mjs`)**: Ingests project invariants and MCP directives from configuration and options, attaching pre-execution documentation lookup directives into task instructions.
 - **Dependency Upgrade Scope Harmonization (`src/wizard-task.mjs`)**: Updated `buildGuardrailFooter` to exclude explicitly authorized paths (`opts.allowedPaths`) from forbidden path warnings, eliminating conflicting instructions for dependency upgrade workloads.
 - **Diff Payload Governor Branch Base Comparison (`src/wizard-task.mjs`)**: Calculated diff payload sizes against `git diff origin/${baseBranch}...HEAD | wc -c` instead of local uncommitted diffs.
 

package/JULES_RULES_TEMPLATE.md

@@ -31,6 +31,9 @@ below and keep existing project instructions when adopting this template.
   affected checks if the base changes.
 - Report what changed, commands run, results and remaining limitations. Do not
   claim a check passed if it was skipped or could not run.
+- Do not invent changes or perform cosmetic refactors when no substantive work
+  is needed. If the assigned task or verification demonstrates that state is already
+  correct, report the finding and leave files unmodified.
 
 <!-- SYNC-CORE:END -->
 

package/README.md

@@ -17,7 +17,7 @@ You can also run local checks without connecting an agent provider.
 `agentctl repair` explicitly for repair workflows. Provider output and passing
 checks still need review before merging.
 
-The current release is **v0.74.0**, a pre-1.0 release. A long-term stability policy is a
+The current release is **v0.75.1**, a pre-1.0 release. A long-term stability policy is a
 [v1.0 goal](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/ROADMAP_V1.md).
 
 ## Quickstart
@@ -111,6 +111,7 @@ For direct `agentctl` commands, install globally with
 
 | Goal | Command |
 | --- | --- |
+| Interactive terminal navigation | `agentctl menu` (or `agentctl -i`) |
 | Inspect provider setup | `agentctl providers` |
 | Create a scoped task | `agentctl task create` |
 | Preview queued work | `agentctl queue --dry-run` |
@@ -153,6 +154,7 @@ and [SDK/MCP integration](https://github.com/FullThrottle83/jules-orchestrator-k
 
 | Command | Description |
 | --- | --- |
+| `menu` | Interactive terminal navigation hub; browse commands and launch workflows without typing arguments. |
 | `dashboard` | Local telemetry viewer; default port 4100. Set another port with `--port <n>`. |
 
 
@@ -174,7 +176,7 @@ npm run package-integrity
 npm run guard-reach
 ```
 
-The recorded baseline is **1553 unit tests across 204 suites**. Doc-sync compares
+The recorded baseline is **1667 unit tests across 210 suites**. Doc-sync compares
 that count with an actual run. Counts do not establish correctness for every
 provider or project. See
 [contributing](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/CONTRIBUTING.md)