jules-orchestrator-kit 0.75.0 → 0.75.1

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.75.1] - 2026-10-09
+
+### Added
+- **Auto-Merge CI Workflow Template (`src/ci-templates.mjs`, `bin/agentctl.mjs`)**: Added `buildAutoMergeWorkflow` and `--with-automerge` flag to `agentctl ci init`. Generates `.github/workflows/agent-automerge.yml` operating on `workflow_run` strictly from `ref: main`, enforcing secure bot actor validation (`google-labs-jules[bot]`, `github-actions[bot]`), untrusted commit data fetching, and base-branch gate verification before automated squash-merging.
+- **Quiet-Run Invariant (`AGENTS.md`, `JULES_RULES_TEMPLATE.md`)**: Enforced explicit invariant prohibiting cosmetic refactors and fabricated changes when scheduled or automated runs discover all constraints already satisfied.
+- **Automated SYNC-CORE Byte Parity Test (`test/cli-surface.test.mjs`)**: Added test verifying byte-level identity between `AGENTS.md` and `JULES_RULES_TEMPLATE.md` core rule blocks.
+
+### Security
+- **Symlink & Mode Inspection Hardening (`scripts/ci-scope-guard.mjs`)**: Replaced `--name-only` diff inspection with null-delimited raw diff parsing (`git diff --raw -z --no-renames`). Inspects blob modes, rejects symlinks (`mode 120000`) resolving to protected paths or escaping repository root via `git cat-file blob <dstSha>` without local checkout, rejects git submodules (`mode 160000`), and fails closed on unreadable symlink targets.
+
 ## [0.75.0] - 2026-09-28
 
 ### Added
@@ -20,13 +30,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Goal Evidence Enforcement (`src/engine.mjs`)**: Disallowed silent early termination on goal tasks lacking explicit verification evidence.
 - **Test Environment Variable Bleed (`src/engine.mjs`)**: Sanitized test execution environment to prevent PR label bypass tokens from leaking into child test runs during gate evaluation.
 
+### Changed
+- **Stack-Neutral Invariants & Isolation Cleanup (`src/wizard-task.mjs`, `docs/`)**: Removed hardcoded vendor framework assumptions from task authoring in favor of project configuration and options; purged Swedish phrasing from internal test suites and scripts.
+
 ## [0.74.0] - 2026-09-19
 
 ### Added
 - **Native `agentctl.task/v1` Frontmatter Specification & Zero-Dependency Parser (`src/envelope.mjs`, `scripts/validate-envelope.mjs`)**: Added canonical YAML frontmatter envelope support for task files (`.md`) without third-party dependencies. Reconciles `scope.allow`, `scope.deny`, `verification.commands`, `invariants`, `mcp_directives`, and `flags` with 100% backward compatibility for legacy HTML comments (`<!-- JULES_TASK_ENVELOPE: ... -->`).
 - **Taxonomy Delegation Lanes (Green / Amber / Orange / Red) (`src/envelope.mjs`, `src/wizard-task.mjs`)**: Formulated formal risk lane delegation. Red tasks are rejected at validation; Orange tasks warn for external execution only; Amber tasks allow protected path changes (e.g. dependency upgrades in `package.json`, migrations, auth) under explicit plan approval (`requirePlanApproval: true`). Green tasks prevent unapproved protected scope mutations.
 - **Circuit Breaker & Verification Contract in Envelope (`src/envelope.mjs`)**: Added frontmatter declarations for `circuitBreaker` (`max_attempts`, `max_diff_lines`, `stop_if_same_failure_repeats`) and `verification` metadata (`require_nonzero_test_count`, `trusted_base`), alongside `constraints` alias support.
-- **Stack Invariant & MCP Directive Ingestion (`src/wizard-task.mjs`)**: Automatically infers runtime constraints (Zero-JS for Astro, workerd edge runtime constraints for Cloudflare Wrangler) and injects mandatory pre-execution documentation lookup directives into task instructions.
+- **Custom Invariant & MCP Directive Ingestion (`src/wizard-task.mjs`)**: Ingests project invariants and MCP directives from configuration and options, attaching pre-execution documentation lookup directives into task instructions.
 - **Dependency Upgrade Scope Harmonization (`src/wizard-task.mjs`)**: Updated `buildGuardrailFooter` to exclude explicitly authorized paths (`opts.allowedPaths`) from forbidden path warnings, eliminating conflicting instructions for dependency upgrade workloads.
 - **Diff Payload Governor Branch Base Comparison (`src/wizard-task.mjs`)**: Calculated diff payload sizes against `git diff origin/${baseBranch}...HEAD | wc -c` instead of local uncommitted diffs.
 

package/JULES_RULES_TEMPLATE.md

@@ -31,6 +31,9 @@ below and keep existing project instructions when adopting this template.
   affected checks if the base changes.
 - Report what changed, commands run, results and remaining limitations. Do not
   claim a check passed if it was skipped or could not run.
+- Do not invent changes or perform cosmetic refactors when no substantive work
+  is needed. If the assigned task or verification demonstrates that state is already
+  correct, report the finding and leave files unmodified.
 
 <!-- SYNC-CORE:END -->
 

package/README.md

@@ -17,7 +17,7 @@ You can also run local checks without connecting an agent provider.
 `agentctl repair` explicitly for repair workflows. Provider output and passing
 checks still need review before merging.
 
-The current release is **v0.75.0**, a pre-1.0 release. A long-term stability policy is a
+The current release is **v0.75.1**, a pre-1.0 release. A long-term stability policy is a
 [v1.0 goal](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/ROADMAP_V1.md).
 
 ## Quickstart
@@ -111,6 +111,7 @@ For direct `agentctl` commands, install globally with
 
 | Goal | Command |
 | --- | --- |
+| Interactive terminal navigation | `agentctl menu` (or `agentctl -i`) |
 | Inspect provider setup | `agentctl providers` |
 | Create a scoped task | `agentctl task create` |
 | Preview queued work | `agentctl queue --dry-run` |
@@ -153,6 +154,7 @@ and [SDK/MCP integration](https://github.com/FullThrottle83/jules-orchestrator-k
 
 | Command | Description |
 | --- | --- |
+| `menu` | Interactive terminal navigation hub; browse commands and launch workflows without typing arguments. |
 | `dashboard` | Local telemetry viewer; default port 4100. Set another port with `--port <n>`. |
 
 
@@ -174,7 +176,7 @@ npm run package-integrity
 npm run guard-reach
 ```
 
-The recorded baseline is **1650 unit tests across 210 suites**. Doc-sync compares
+The recorded baseline is **1667 unit tests across 210 suites**. Doc-sync compares
 that count with an actual run. Counts do not establish correctness for every
 provider or project. See
 [contributing](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/CONTRIBUTING.md)

package/bin/agentctl.mjs

@@ -343,6 +343,7 @@ async function main() {
           "require-plan-approval": { type: "boolean" },
           "auto-approve-plans": { type: "boolean" },
           "auto-approve": { type: "boolean" },
+          "auto-reply": { type: "boolean" },
           "check-premise": { type: "boolean" },
           "goal-check": { type: "string" },
           idempotent: { type: "boolean" },
@@ -396,6 +397,7 @@ async function main() {
       }
 
       const autoApprove = Boolean(values["auto-approve-plans"] || values["auto-approve"]);
+      const autoReply = Boolean(values["auto-reply"] || values.autoReply);
       const task = {
         title: values.title || "CLI Dispatch Task",
         prompt: promptContent,
@@ -406,6 +408,8 @@ async function main() {
         repoless: values.repoless,
         autoPr: values["auto-pr"],
         requirePlanApproval: autoApprove ? false : values["require-plan-approval"],
+        autoApprovePlan: autoApprove,
+        autoReply,
         checkPremise: values["check-premise"] || values.idempotent,
         goalCheck: values["goal-check"],
         author: values.author,
@@ -421,6 +425,8 @@ async function main() {
           source: values.source,
           branch: values.branch,
           checkPremise: values["check-premise"] || values.idempotent,
+          autoApprovePlan: autoApprove,
+          autoReply,
         });
         if (values.json) {
           console.log(JSON.stringify({ ok: true, session }, null, 2));
@@ -1018,6 +1024,8 @@ async function main() {
           cmd: { type: "string", short: "c" },
           task: { type: "boolean", short: "t" },
           author: { type: "string" },
+          "auto-approve": { type: "boolean" },
+          "auto-reply": { type: "boolean" },
           json: { type: "boolean", short: "j" },
           "dry-run": { type: "boolean" },
         },
@@ -1069,7 +1077,13 @@ async function main() {
         }
         const repairRes = await repair(
           { stderr: cleanTrace, command: values.cmd || "verify" },
-          { root, dryRun: values["dry-run"], author: values.author }
+          {
+            root,
+            dryRun: values["dry-run"],
+            author: values.author,
+            autoApprove: values["auto-approve"],
+            autoReply: values["auto-reply"],
+          }
         );
 
         if (values.json) {
@@ -1881,7 +1895,7 @@ async function main() {
     case "ci": {
       const sub = args[1];
       if (sub !== "init") {
-        console.error(`❌ Unknown 'ci' action '${sub || ""}'. Usage: agentctl ci init [--target github|gitlab] [--force]`);
+        console.error(`❌ Unknown 'ci' action '${sub || ""}'. Usage: agentctl ci init [--target github|gitlab] [--force] [--with-automerge]`);
         process.exit(2);
       }
       const { values } = parseArgs({
@@ -1891,6 +1905,7 @@ async function main() {
           force: { type: "boolean", short: "f" },
           "dry-run": { type: "boolean", short: "d" },
           json: { type: "boolean", short: "j" },
+          "with-automerge": { type: "boolean" },
         },
         allowPositionals: true,
       });
@@ -1902,6 +1917,7 @@ async function main() {
         config,
         version: VERSION,
         stack: detectStack(root),
+        withAutomerge: values["with-automerge"],
       });
 
       if (values.json) {
@@ -1912,9 +1928,13 @@ async function main() {
         console.error(`❌ ${res.error}`);
         process.exit(1);
       }
-      console.log(`✅ ${res.written ? "Wrote" : "Would write"} ${res.file}`);
+      const filesDesc = Array.isArray(res.files) ? res.files.join(", ") : res.file;
+      console.log(`✅ ${res.written ? "Wrote" : "Would write"} ${filesDesc}`);
       console.log(`   Stack: ${res.stack} · runtime setup: ${res.setupSummary}`);
       console.log(`   The workflow runs: agentctl check --mode committed`);
+      if (values["with-automerge"]) {
+        console.log(`   Auto-merge: enabled for authorized agent pull requests via workflow_run`);
+      }
       if (!res.written && !values["dry-run"]) {
         console.log(`   (unchanged — pass --force to overwrite)`);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.75.0",
+  "version": "0.75.1",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents \u2014 Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/scripts/ci-scope-guard.mjs

@@ -16,7 +16,7 @@
  */
 import { execFileSync } from "node:child_process";
 import { checkScope } from "../src/security.mjs";
-import { normalizePath } from "../src/config.mjs";
+import { normalizePath, canonicalizePath } from "../src/config.mjs";
 
 /** Exit code 3 in the kit's registry: scope violation. */
 const EXIT_SCOPE_VIOLATION = 3;
@@ -74,36 +74,132 @@ export function loadProtectedPatterns(opts = {}) {
   );
 }
 
+/** Where a symlink at `link` pointing at `target` lands, as a repo-relative or absolute path. */
+export function resolveLinkTarget(link, target) {
+  const normLink = normalizePath(link);
+  const normTarget = normalizePath(target);
+  if (normTarget.startsWith("/") || /^[a-zA-Z]:[/\\]/.test(target)) {
+    return normTarget;
+  }
+  const linkDir = normLink.split("/").slice(0, -1).join("/");
+  return canonicalizePath(linkDir ? `${linkDir}/${normTarget}` : normTarget);
+}
+
+/**
+ * Parses `git diff --raw -z` output into structured file change entries.
+ *
+ * Each record emitted by `--raw -z` is:
+ *   ":<srcmode> <dstmode> <srcsha> <dstsha> <status>\0<path>\0"
+ * (or two paths if renames were enabled). With `--no-renames`, it is always 1 path.
+ *
+ * For symlinks (mode 120000), retrieves the link target blob via `git cat-file blob <dstSha>`
+ * without checking out the branch to disk.
+ *
+ * @param {string} raw - raw stdout from git diff --raw -z
+ * @param {string} [root] - repo root cwd
+ * @returns {Array<{ file: string, srcMode: string, dstMode: string, srcSha: string, dstSha: string, status: string, symlinkTarget?: string, symlinkUnreadable?: boolean }>}
+ */
+export function parseRawDiffEntries(raw, root = process.cwd()) {
+  if (!raw || typeof raw !== "string") return [];
+  const fields = raw.split("\0").filter((f) => f !== "");
+  const entries = [];
+
+  for (let i = 0; i < fields.length; i++) {
+    const meta = fields[i];
+    if (!meta.startsWith(":")) continue;
+    const parts = meta.slice(1).split(/\s+/);
+    const file = fields[i + 1];
+    i += 1;
+    if (!file) continue;
+
+    const srcMode = parts[0] || "";
+    const dstMode = parts[1] || "";
+    const srcSha = parts[2] || "";
+    const dstSha = parts[3] || "";
+    const status = (parts[4] || "").charAt(0);
+
+    let symlinkTarget = null;
+    let symlinkUnreadable = false;
+
+    if (dstMode === "120000") {
+      if (dstSha && !/^0+$/.test(dstSha)) {
+        try {
+          const rawTarget = execFileSync("git", ["cat-file", "blob", dstSha], {
+            cwd: root,
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "pipe"],
+          }).trim();
+          if (rawTarget) {
+            symlinkTarget = resolveLinkTarget(file, rawTarget);
+          } else {
+            symlinkUnreadable = true;
+          }
+        } catch (_) {
+          symlinkUnreadable = true;
+        }
+      } else {
+        symlinkUnreadable = true;
+      }
+    }
+
+    entries.push({
+      file: normalizePath(file),
+      srcMode,
+      dstMode,
+      srcSha,
+      dstSha,
+      status,
+      symlinkTarget,
+      symlinkUnreadable,
+    });
+  }
+
+  return entries;
+}
+
 /**
  * Lists the paths a pull request changes.
  *
- * `-z` and `core.quotePath=false` matter here: without them git splits on
- * whitespace and octal-escapes non-ASCII names, so `docs/min plan.md` and
- * `säkerhet/nyckel.pem` arrive as tokens that match no pattern — a protected
- * file walking past the guard because of how it is spelled.
+ * Inspects `git diff --raw -z --no-renames` to capture all paths while
+ * preserving spaces and non-ASCII characters without quoting corruption.
  *
  * @param {{ baseSha: string, headSha: string, root?: string }} opts
  * @returns {string[]}
  */
 export function listChangedFiles(opts = {}) {
+  return listChangedEntries(opts).map((e) => e.file);
+}
+
+/**
+ * Returns raw diff entries including blob mode and symlink resolution.
+ *
+ * @param {{ baseSha: string, headSha: string, root?: string }} opts
+ * @returns {Array<{ file: string, srcMode: string, dstMode: string, srcSha: string, dstSha: string, status: string, symlinkTarget?: string, symlinkUnreadable?: boolean }>}
+ */
+export function listChangedEntries(opts = {}) {
   const root = opts.root || process.cwd();
   const raw = execFileSync(
     "git",
-    ["-c", "core.quotePath=false", "diff", "-z", "--name-only", opts.baseSha, opts.headSha],
+    ["-c", "core.quotePath=false", "diff", "-z", "--raw", "--no-renames", opts.baseSha, opts.headSha],
     { cwd: root, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 10 * 1024 * 1024 }
   );
-  return raw.split("\0").map(normalizePath).filter(Boolean);
+  return parseRawDiffEntries(raw, root);
 }
 
 /**
  * Pure evaluation core, so the decision is testable without a git repository.
  *
- * @param {string[]} files
+ * Evaluates changed files and entries against protected patterns:
+ * - Rejects Git submodules (mode 160000)
+ * - Evaluates symlinks (mode 120000): rejects traversal / root escape, fails closed on unreadable targets,
+ *   and fails if the resolved symlink target points to a protected file.
+ *
+ * @param {Array<string|object>} filesOrEntries
  * @param {string[]} patterns
- * @param {{ labels?: string[] }} [opts]
+ * @param {{ labels?: string[], headSha?: string, symlinks?: Array<{ link: string, target: string }> }} [opts]
  * @returns {{ ok: boolean, bypassed: boolean, violations: Array<object> }}
  */
-export function evaluateScopeGuard(files = [], patterns = [], opts = {}) {
+export function evaluateScopeGuard(filesOrEntries = [], patterns = [], opts = {}) {
   const labels = (opts.labels || []).map((l) => String(l).toLowerCase().trim());
   const headSha = String(opts.headSha || "").trim().toLowerCase();
 
@@ -118,12 +214,88 @@ export function evaluateScopeGuard(files = [], patterns = [], opts = {}) {
     bypassed = labels.includes(BYPASS_LABEL) || labels.includes(LEGACY_BYPASS_LABEL);
   }
 
+  const normalizedEntries = [];
+  for (const item of filesOrEntries) {
+    if (typeof item === "string") {
+      normalizedEntries.push({ file: item });
+    } else if (item && typeof item === "object") {
+      normalizedEntries.push(item);
+    }
+  }
+
+  if (Array.isArray(opts.symlinks)) {
+    for (const s of opts.symlinks) {
+      if (s && s.link) {
+        normalizedEntries.push({
+          file: s.link,
+          dstMode: "120000",
+          symlinkTarget: s.target || null,
+        });
+      }
+    }
+  }
+
+  const explicitViolations = [];
+  const scopeCandidates = [];
+  const symlinkTargetOf = new Map();
+
+  for (const entry of normalizedEntries) {
+    const file = entry.file || "";
+    if (file) {
+      scopeCandidates.push(file);
+    }
+
+    // 1. Refuse Git submodules (mode 160000)
+    if (entry.dstMode === "160000") {
+      explicitViolations.push({
+        file,
+        reason: "Git submodule (mode 160000) is forbidden in agent pull requests",
+        rule: "deny",
+        pattern: "<submodule>",
+      });
+      continue;
+    }
+
+    // 2. Inspect Symlinks (mode 120000)
+    if (entry.dstMode === "120000") {
+      if (entry.symlinkUnreadable || !entry.symlinkTarget) {
+        explicitViolations.push({
+          file,
+          reason: "Unreadable or empty symlink target cannot be verified",
+          rule: "deny",
+          pattern: "<unreadable-symlink>",
+        });
+        continue;
+      }
+
+      const target = entry.symlinkTarget;
+      scopeCandidates.push(target);
+      symlinkTargetOf.set(target, file);
+    }
+  }
+
   // Matching always runs at full strength; the label only decides whether a
   // match blocks. Passing `allowProtected` into checkScope instead would make
   // a bypassed run report zero violations, and the job log is the record of
   // what a human waved through.
-  const res = checkScope(files, { protect: patterns }, { allowProtected: false });
-  return { ok: bypassed || res.ok, bypassed, violations: res.violations };
+  const res = checkScope(scopeCandidates, { protect: patterns }, { allowProtected: false });
+
+  const mappedScopeViolations = (res.violations || []).map((v) => {
+    const link = symlinkTargetOf.get(v.file);
+    if (link) {
+      return {
+        ...v,
+        link,
+        file: link,
+        target: v.file,
+        reason: `Symlink "${link}" -> "${v.file}": ${v.reason}`,
+      };
+    }
+    return v;
+  });
+
+  const allViolations = [...explicitViolations, ...mappedScopeViolations];
+  return { ok: bypassed || allViolations.length === 0, bypassed, violations: allViolations };
 }
 
 /**
@@ -157,21 +329,29 @@ function main() {
   }
 
   let patterns;
-  let files;
+  let entries = [];
   try {
     patterns = loadProtectedPatterns({ baseSha, baseRef, root });
-    files = listChangedFiles({ baseSha, headSha, root });
+    entries = listChangedEntries({ baseSha, headSha, root });
   } catch (err) {
     console.error(`::error::Agent Scope Guard could not evaluate this pull request: ${err.message}`);
     process.exit(EXIT_ERROR);
   }
 
   const labels = parseLabels(process.env.PR_LABELS);
-  const result = evaluateScopeGuard(files, patterns, { labels, headSha });
+  const result = evaluateScopeGuard(entries, patterns, { labels, headSha });
 
   console.log(`Protected patterns (${patterns.length}): ${patterns.join(", ")}`);
-  console.log(`Changed files (${files.length}):`);
-  for (const f of files) console.log(`  ${f}`);
+  console.log(`Changed files (${entries.length}):`);
+  for (const e of entries) {
+    if (e.dstMode === "120000") {
+      console.log(`  ${e.file} -> ${e.symlinkTarget || "(unresolved)"} [symlink]`);
+    } else if (e.dstMode === "160000") {
+      console.log(`  ${e.file} [submodule]`);
+    } else {
+      console.log(`  ${e.file}`);
+    }
+  }
 
   const labelName = headSha ? `${BYPASS_LABEL}:${headSha}` : BYPASS_LABEL;
   const legacyLabelName = headSha ? `${LEGACY_BYPASS_LABEL}:${headSha}` : LEGACY_BYPASS_LABEL;

package/scripts/run-tests.mjs

@@ -101,18 +101,22 @@ function reap(signal = "SIGKILL") {
 
 // Ctrl-C, a CI cancellation and a harness teardown all arrive as signals; each
 // must take the tree with it rather than detaching it from its parent.
+let shuttingDown = false;
 for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
   process.on(sig, () => {
+    if (shuttingDown) return;
+    shuttingDown = true;
     reap("SIGTERM");
     // Give the group a moment to unwind, then make sure.
     setTimeout(() => {
       reap("SIGKILL");
-      process.exit(130);
+      process.exit(sig === "SIGINT" ? 130 : 143);
     }, 2000).unref();
   });
 }
 
 child.on("exit", (code, signal) => {
+  if (shuttingDown) return;
   // Stragglers outlive a clean exit too: a test that spawned a server and
   // failed before its teardown leaves it running.
   reap("SIGKILL");

package/src/ci-templates.mjs

@@ -149,51 +149,214 @@ ${extraSteps ? extraSteps + "\n" : ""}
 }
 
 /**
- * Write the generated workflow, refusing to clobber an existing file unless
+ * Generate a workflow_run auto-merge workflow for GitHub Actions that safely
+ * merges qualifying green PRs opened by authorized automation bots.
+ *
+ * Implements a strict trust boundary:
+ * - Executes exclusively on the base branch (default `main`)
+ * - Evaluates PR commits strictly as unexecuted data (fetch + git diff)
+ * - Verifies the bot actor against authorized identities (default `google-labs-jules[bot]`)
+ * - Merges cleanly via `gh pr merge --squash --delete-branch`
+ *
+ * @param {object} opts
+ * @param {object} [opts.config]
+ * @param {string} [opts.version]
+ * @param {string[]} [opts.allowedActors]
+ * @returns {{ file: string, content: string }}
+ */
+export function buildAutoMergeWorkflow(opts = {}) {
+  const base = opts.config?.baseBranch || opts.baseBranch || "main";
+  const version = opts.version || "0";
+  const defaultActors = ["google-labs-jules[bot]", "github-actions[bot]"];
+  const allowedActors = opts.allowedActors || defaultActors;
+  const actorCases = allowedActors.map((a) => `"${a}"`).join("|");
+
+  const content = `# Generated by jules-orchestrator-kit v${version}.
+#
+# Auto-merge verified pull requests opened by authorized automation bots.
+#
+# TRUST BOUNDARY ARCHITECTURE:
+#   For pull requests from repository branches, GitHub Actions runs
+#   'on: pull_request' workflows from the PR branch head. A pull request can
+#   therefore supply its own modified workflow code.
+#
+#   This workflow runs on 'workflow_run' after 'Agent Safety Gate' completes.
+#   It executes STRICTLY from the default branch (${base}), ensuring that:
+#   1. It only runs code, scripts, and policies committed to ${base}.
+#   2. The pull request commits are fetched strictly as unexecuted data.
+#   3. Privileged write tokens are never exposed to the untrusted PR branch.
+#
+# Regenerate with: agentctl ci init --with-automerge --force
+
+name: Agent Auto-Merge
+
+on:
+  workflow_run:
+    workflows: ["Agent Safety Gate"]
+    types: [completed]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agent-automerge-\${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: false
+
+jobs:
+  automerge:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.head_repository.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+      REPO: \${{ github.repository }}
+      HEAD_SHA: \${{ github.event.workflow_run.head_sha }}
+      ACTOR: \${{ github.event.workflow_run.actor.login }}
+    steps:
+      - name: Checkout base revision (${base})
+        uses: actions/checkout@v4
+        with:
+          ref: ${base}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Verify authorized automation actor
+        run: |
+          set -euo pipefail
+          case "$ACTOR" in
+            ${actorCases})
+              echo "Authorized automation actor: $ACTOR"
+              ;;
+            *)
+              echo "Actor '$ACTOR' is not an authorized automation bot; leaving PR for human review."
+              exit 0
+              ;;
+          esac
+
+      - id: pr
+        name: Resolve Pull Request
+        run: |
+          set -euo pipefail
+          num=$(gh pr list --repo "$REPO" --state open --base "${base}" \\
+                  --json number,headRefOid \\
+                  --jq "[.[] | select(.headRefOid == \\"$HEAD_SHA\\")] | .[0].number // empty")
+          if [ -z "$num" ]; then
+            echo "No open PR found for head SHA $HEAD_SHA; nothing to merge."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "Resolved PR #$num for $HEAD_SHA"
+          echo "number=$num" >> "$GITHUB_OUTPUT"
+          echo "found=true" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch PR commits as untrusted data
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin "+$HEAD_SHA:refs/pr-head"
+
+      - name: Set up Node.js
+        if: steps.pr.outputs.found == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Verify safety gate from base
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          npx --yes jules-orchestrator-kit check --mode committed --base "${base}"
+
+      - name: Squash and merge pull request
+        if: steps.pr.outputs.found == 'true'
+        run: |
+          gh pr merge --squash --delete-branch "\${{ steps.pr.outputs.number }}" --repo "$REPO"
+`;
+
+  return { file: ".github/workflows/agent-automerge.yml", content };
+}
+
+/**
+ * Write the generated workflow(s), refusing to clobber existing files unless
  * asked.
  *
  * @param {string} root
- * @param {object} [opts] - see {@link buildCiWorkflow}, plus `force` and `dryRun`
- * @returns {{ ok: boolean, file?: string, written?: boolean, stack?: string, setupSummary?: string, content?: string, error?: string }}
+ * @param {object} [opts] - see {@link buildCiWorkflow}, plus `force`, `dryRun`, and `withAutomerge`
+ * @returns {{ ok: boolean, file?: string, files?: string[], written?: boolean, stack?: string, setupSummary?: string, content?: string, error?: string }}
  */
 export function writeCiWorkflow(root, opts = {}) {
+  const target = CI_TARGETS.includes(opts.target) ? opts.target : (opts.target ? opts.target : "github");
   if (opts.target && !CI_TARGETS.includes(opts.target)) {
     return { ok: false, error: `Unknown CI target '${opts.target}'. Choose one of: ${CI_TARGETS.join(", ")}` };
   }
 
+  const withAutomerge = Boolean(opts.withAutomerge || opts["with-automerge"]);
+  if (withAutomerge && target !== "github") {
+    return { ok: false, error: "Auto-merge workflow is currently only supported for GitHub Actions." };
+  }
+
   const built = buildCiWorkflow(opts);
   const stackId = opts.stack?.stack || "unknown";
-  const abs = join(root, built.file);
+  const itemsToWrite = [built];
 
-  if (opts.dryRun) {
-    return { ok: true, file: built.file, written: false, stack: stackId, setupSummary: built.setupSummary, content: built.content };
+  if (withAutomerge) {
+    itemsToWrite.push(buildAutoMergeWorkflow(opts));
   }
 
-  if (existsSync(abs) && !opts.force) {
-    let identical = false;
-    try {
-      identical = readFileSync(abs, "utf-8") === built.content;
-    } catch (_) {
-      // Unreadable target: treat as different so the caller is told to --force
-      // rather than being told nothing changed.
-    }
+  const files = itemsToWrite.map((item) => item.file);
+
+  if (opts.dryRun) {
     return {
       ok: true,
       file: built.file,
+      files,
       written: false,
-      identical,
       stack: stackId,
       setupSummary: built.setupSummary,
       content: built.content,
+      workflows: itemsToWrite,
     };
   }
 
-  try {
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, built.content, "utf-8");
-  } catch (err) {
-    return { ok: false, error: `Could not write ${built.file}: ${err.message}` };
+  let allWritten = true;
+  let allIdentical = true;
+  for (const item of itemsToWrite) {
+    const abs = join(root, item.file);
+    if (existsSync(abs) && !opts.force) {
+      let identical = false;
+      try {
+        identical = readFileSync(abs, "utf-8") === item.content;
+      } catch (_) {
+        // Unreadable target: treat as different so the caller is told to --force
+        // rather than being told nothing changed.
+      }
+      if (!identical) {
+        allIdentical = false;
+      }
+      allWritten = false;
+      continue;
+    }
+
+    try {
+      mkdirSync(dirname(abs), { recursive: true });
+      writeFileSync(abs, item.content, "utf-8");
+    } catch (err) {
+      return { ok: false, error: `Could not write ${item.file}: ${err.message}` };
+    }
   }
 
-  return { ok: true, file: built.file, written: true, stack: stackId, setupSummary: built.setupSummary, content: built.content };
+  return {
+    ok: true,
+    file: built.file,
+    files,
+    written: allWritten,
+    identical: allWritten ? false : allIdentical,
+    stack: stackId,
+    setupSummary: built.setupSummary,
+    content: built.content,
+  };
 }

package/src/engine.mjs

@@ -947,6 +947,11 @@ export async function repair(failure, opts = {}) {
         dryRun: opts.dryRun,
         pollIntervalMs: opts.pollIntervalMs,
         maxPollAttempts: opts.maxPollAttempts,
+        autoApprovePlan: opts.autoApprovePlan || opts.autoApprove,
+        autoReply: opts.autoReply,
+        maxAutoReplies: opts.maxAutoReplies,
+        autoReplyFn: opts.autoReplyFn,
+        task: opts.task || { id: `repair-${n}`, title: `OODA Auto-Repair Attempt ${n}`, prompt: repairPrompt },
       });
 
       // The gate below is the authority on whether the change works, so it runs
@@ -1139,6 +1144,54 @@ export const TERMINAL_SESSION_STATES = new Set(["COMPLETED", "FAILED"]);
  */
 export const BLOCKING_SESSION_STATES = new Set(["AWAITING_PLAN_APPROVAL", "AWAITING_USER_FEEDBACK", "PAUSED"]);
 
+/**
+ * Synthesizes an autonomous, envelope-grounded reply directive when Jules halts
+ * in AWAITING_USER_FEEDBACK during unattended execution.
+ *
+ * @param {object|null} task - Task envelope or task definition object.
+ * @param {string} [question] - Extracted question text from the agent.
+ * @returns {string} Deterministic directive for the agent to continue.
+ */
+export function buildAutoReplyPrompt(task = null, question = "") {
+  const parts = [];
+  parts.push("Autonomous execution directive:");
+
+  if (task && typeof task === "object") {
+    const scope = task.scope?.allow || task.allowedFiles || task.targetFiles;
+    if (Array.isArray(scope) && scope.length > 0) {
+      parts.push(`- Scope constraint: modify only files matching ${scope.join(", ")}.`);
+    }
+
+    const invariants = Array.isArray(task.invariants) ? task.invariants : [];
+    if (invariants.length > 0) {
+      parts.push(`- Invariants: ${invariants.slice(0, 5).join("; ")}.`);
+    }
+
+    if (task.title || task.objective) {
+      parts.push(`- Objective: ${task.title || task.objective}.`);
+    }
+
+    if (task.clarifications && typeof task.clarifications === "object") {
+      const entries = Object.entries(task.clarifications);
+      if (entries.length > 0) {
+        const qLower = String(question || "").toLowerCase();
+        for (const [k, v] of entries) {
+          if (qLower.includes(k.toLowerCase())) {
+            parts.push(`- Pre-approved clarification (${k}): ${v}`);
+          }
+        }
+      }
+    }
+  }
+
+  parts.push(
+    "- Decision rule: Make reasonable engineering assumptions that satisfy tests and maintain existing API contracts.",
+    "- Do not pause for human confirmation or additional feedback. Proceed with implementation, verification, and completion."
+  );
+
+  return parts.join("\n");
+}
+
 /**
  * Polls the provider until the session reaches a terminal state, blocks on an
  * actor, or the poll budget runs out.
@@ -1180,6 +1233,8 @@ export async function pollSessionState(provider, session, opts = {}) {
   const startTime = Date.now();
   let lastStatus = "";
   let polls = 0;
+  const repliedActivityIds = new Set();
+  let autoRepliesCount = 0;
 
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
     if (Date.now() - startTime > timeoutMs) break;
@@ -1235,6 +1290,102 @@ export async function pollSessionState(provider, session, opts = {}) {
         }
       }
 
+      // Autonomously answer clarifying questions if requested
+      const isUserFeedback = status === "AWAITING_USER_FEEDBACK";
+      const wantsAutoReply = Boolean(opts.autoReply || session.autoReply);
+      const canSend = provider && (typeof provider.sendMessage === "function" || typeof provider.resume === "function");
+      if (isUserFeedback && wantsAutoReply && canSend) {
+        const maxAutoReplies = Number(opts.maxAutoReplies ?? session.maxAutoReplies ?? 3);
+        if (autoRepliesCount >= maxAutoReplies) {
+          return {
+            ...currentSession,
+            status,
+            terminal: false,
+            blockedOn: status,
+            autoReplyLimitExceeded: true,
+            autoReplies: autoRepliesCount,
+            polls,
+          };
+        }
+
+        let question = "";
+        let activityId = null;
+        if (typeof provider.listActivities === "function") {
+          try {
+            const actRes = await provider.listActivities(session.id, opts);
+            const activities = Array.isArray(actRes?.activities) ? actRes.activities : [];
+            for (let i = activities.length - 1; i >= 0; i--) {
+              const act = activities[i];
+              const msg = act.agentMessaged?.agentMessage || act.message;
+              if (msg) {
+                question = String(msg).trim();
+                activityId = act.name || act.id || null;
+                break;
+              }
+            }
+          } catch (_) {}
+        }
+
+        // Idempotency: If this activity was already answered, wait for the agent to advance rather than duplicate
+        if (activityId && repliedActivityIds.has(activityId)) {
+          await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+          continue;
+        }
+
+        let reply = "";
+        const taskContext = opts.task || session.task || null;
+        if (typeof opts.autoReplyFn === "function") {
+          try {
+            reply = await opts.autoReplyFn({ session: currentSession, question, activityId, task: taskContext });
+          } catch (err) {
+            return {
+              ...currentSession,
+              status,
+              terminal: false,
+              blockedOn: status,
+              autoReplyError: `autoReplyFn failed: ${err.message}`,
+              autoReplies: autoRepliesCount,
+              polls,
+            };
+          }
+        } else {
+          reply = buildAutoReplyPrompt(taskContext, question);
+        }
+
+        if (activityId) {
+          repliedActivityIds.add(activityId);
+        }
+
+        try {
+          const sendFn = typeof provider.sendMessage === "function"
+            ? provider.sendMessage.bind(provider)
+            : provider.resume.bind(provider);
+          await sendFn(session.id, reply, opts);
+          autoRepliesCount += 1;
+          if (opts.root) {
+            appendTelemetry(opts.root, "session_auto_reply", {
+              sessionId: session.id,
+              question: question ? question.slice(0, 300) : null,
+              reply: reply ? reply.slice(0, 300) : null,
+              replyCount: autoRepliesCount,
+              activityId,
+            });
+          }
+          await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+          continue;
+        } catch (err) {
+          return {
+            ...currentSession,
+            status,
+            terminal: false,
+            blockedOn: status,
+            autoReplyError: err && err.message ? err.message : String(err),
+            autoReplies: autoRepliesCount,
+            polls,
+          };
+        }
+      }
+
       return { ...currentSession, status, terminal: false, blockedOn: status, polls };
     }
 
@@ -1745,7 +1896,13 @@ export async function probeDevServer(serverConfig = {}, root = process.cwd()) {
         if (isWin) {
           spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore" });
         } else {
-          process.kill(-child.pid, "SIGTERM");
+          const pgid = -child.pid;
+          process.kill(pgid, "SIGTERM");
+          setTimeout(() => {
+            try {
+              process.kill(pgid, "SIGKILL");
+            } catch (_) {}
+          }, 2000).unref();
         }
       } catch (_) {}
     }

package/src/evidence.mjs

@@ -135,14 +135,21 @@ export function computeDirectoryHash(root, options = {}) {
     // The named directories stay as a fast path; when they yield nothing, walk
     // the repository and let the shared predicate decide. The walk already
     // skips node_modules, vendor, target and the build caches.
-    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "specs", "src"];
+    const targetDirs = options.directories || ["test", "tests", "__tests__", "spec", "specs", "src", "scripts", "bin"];
     for (const dirName of targetDirs) {
       const dirPath = join(root, dirName);
       if (existsSync(dirPath)) {
-        const found = findFilesRecursively(dirPath, root);
-        fileList.push(...found);
+        if (statSync(dirPath).isFile()) {
+          fileList.push(normalizePath(dirName));
+        } else {
+          const found = findFilesRecursively(dirPath, root);
+          fileList.push(...found);
+        }
       }
     }
+    if (existsSync(join(root, "package.json"))) {
+      fileList.push("package.json");
+    }
     if (options.testOnly && !fileList.some((f) => isTestPath(f))) {
       for (const f of findFilesRecursively(root, root)) {
         if (isTestPath(f)) fileList.push(f);
@@ -191,7 +198,8 @@ export function computeDirectoryHash(root, options = {}) {
     }
   }
 
-  const treeHash = "sha256:" + sha256(hashLines.join("\n"));
+  // Join with null byte to prevent path delimiter injection (F-03)
+  const treeHash = "sha256:" + sha256(hashLines.join("\0"));
   return {
     treeHash,
     fileCount: hashLines.length,
@@ -511,9 +519,18 @@ export function verifyEvidenceManifest(root = process.cwd(), manifestOrPath = "m
     return { ok: false, reason: "Evidence manifest hash signature mismatch (tampered file)" };
   }
 
+  // 1.5 Verify recorded execution outcome (F-08)
+  if (manifest.status && !["passed", "success", "ok"].includes(manifest.status)) {
+    return { ok: false, reason: `Evidence manifest records failed execution outcome: ${manifest.status}` };
+  }
+
   // 2. Verify test integrity / No test weakening
   const currentTestState = computeDirectoryHash(root, { testOnly: true });
-  if (manifest.testIntegrity?.tamperDetected) {
+  if (!manifest.testIntegrity?.postTestHash) {
+    return { ok: false, reason: "Evidence manifest is missing test integrity baseline (empty shell)" };
+  }
+
+  if (manifest.testIntegrity.tamperDetected) {
     return {
       ok: false,
       reason: "Test suite tampering detected in evidence manifest",

package/src/ops/command-registry.mjs

@@ -1210,6 +1210,7 @@ export const COMMAND_REGISTRY = [
     shortcuts: ["ci-init"],
     examples: [
       "agentctl ci init",
+      "agentctl ci init --with-automerge",
       "agentctl ci init --target gitlab --force",
       "agentctl ci init --dry-run --json",
     ],
@@ -1218,6 +1219,7 @@ export const COMMAND_REGISTRY = [
       { name: "force", type: "boolean", description: "Overwrite existing workflow file (-f)" },
       { name: "dry-run", type: "boolean", description: "Report what would be written (-d)" },
       { name: "json", type: "boolean", description: "Output structured JSON result (-j)" },
+      { name: "with-automerge", type: "boolean", description: "Also generate a workflow_run auto-merge workflow" },
     ],
   },
   {

package/src/prompt-guard.mjs

@@ -5,6 +5,10 @@
  * Strips zero-width unicode, bidi control characters, and ANSI escape sequences, normalizes UTF-8,
  * neutralizes LLM control role markers and prompt injection patterns, and wraps inputs in strict tags.
  */
+import { BIDI_CONTROL_REGEX, INVISIBLE_OBFUSCATION_REGEX } from "./bidi-guard.mjs";
+import { CONFUSABLE_TO_ASCII } from "./secret-scanner.mjs";
+
+const CONFUSABLE_REGEX = new RegExp([...CONFUSABLE_TO_ASCII.keys()].join("|"), "g");
 
 const ZERO_WIDTH_AND_BIDI_REGEX = /[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF]|[\u{E0000}-\u{E007F}]/gu;
 const ANSI_ESCAPE_REGEX = /\u001B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g;
@@ -100,8 +104,13 @@ export function sanitizeUntrustedData(input, sourceName = "untrusted") {
   // 1. Normalize UTF-8 string (NFKC)
   let text = input.normalize("NFKC");
 
+  // 1.5 Convert confusables to ASCII (transliterate Cyrillic/Greek lookalikes)
+  text = text.replace(CONFUSABLE_REGEX, (m) => CONFUSABLE_TO_ASCII.get(m));
+
   // 2. Strip zero-width Unicode and bidi control characters
   text = text.replace(ZERO_WIDTH_AND_BIDI_REGEX, "");
+  text = text.replace(BIDI_CONTROL_REGEX, "");
+  text = text.replace(INVISIBLE_OBFUSCATION_REGEX, "");
 
   // 3. Strip ANSI terminal control sequences
   text = text.replace(ANSI_ESCAPE_REGEX, "");

package/src/provider.mjs

@@ -716,6 +716,10 @@ export function createProvider(spec = "jules", config = {}) {
       throw new Error(`Unsupported provider type: ${providerSpec.type}`);
     },
 
+    async sendMessage(sessionId, prompt = "", ctx = {}, task = null) {
+      return this.resume(sessionId, prompt, ctx, task);
+    },
+
     async getSession(sessionId, ctx = {}) {
       if (!ctx || typeof ctx !== "object") ctx = {};
       // `listSources()` reuses this method purely as an authenticated GET, and
@@ -1126,6 +1130,10 @@ export function createFailoverProvider(providers = ["jules"], config = {}) {
       }
     },
 
+    async sendMessage(sessionId, prompt, ctx = {}, task = null) {
+      return this.resume(sessionId, prompt, ctx, task);
+    },
+
     async getSession(sessionId, ctx = {}) {
       const errors = [];
       for (let i = 0; i < providerList.length; i++) {
@@ -1263,6 +1271,12 @@ export function createSyntaxVerifiedProvider(fastProvider, complexProvider, conf
       return fastProvider.resume(...args);
     },
 
+    sendMessage(...args) {
+      return typeof fastProvider.sendMessage === "function"
+        ? fastProvider.sendMessage(...args)
+        : fastProvider.resume(...args);
+    },
+
     getSession(...args) {
       return fastProvider.getSession(...args);
     },

package/src/secret-scanner.mjs

@@ -254,6 +254,11 @@ export function secretScanVariants(addedLines) {
   // Collapse method concatenations like .concat("...") or .join("")
   dejoined = dejoined.replace(/\.concat\(\s*["'`]/g, "").replace(/\.join\(\s*["'`]{2}\s*\)/g, "");
 
+  // Collapse array elements like ["A", "B"]
+  dejoined = dejoined.replace(/["'`]\s*,\s*["'`]/g, "");
+  // Collapse split variables across newlines (e.g. const a = "AKIA"; const b = "...")
+  dejoined = dejoined.replace(/["'`]\s*[,;+]*\s*[\r\n]+\s*(?:(?:export\s+)?(?:const|let|var)\s+[A-Za-z0-9_]+\s*=\s*)?["'`]/g, "");
+
   // Collapse whitespace/newlines between adjacent base64 characters (including line-wrapped PEM/base64, template literals, and quoted string chunks)
   const base64Dejoined = stripped
     .replace(/([A-Za-z0-9+/=_-])\s*[\r\n]+\s*(?=[A-Za-z0-9+/=_-])/g, "$1")
@@ -266,9 +271,16 @@ export function secretScanVariants(addedLines) {
   // source-level join AND spelled with homoglyphs still surfaces.
   const confusable = normalizeSecretText(stripped);
   const confusableDejoined = normalizeSecretText(dejoined);
+  const uniDecoded = dejoined
+    .replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+    .replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+
+  const stringLiteralsCollapsed = (stripped.match(/(["'`])(?:(?!\1)[^\n])*\1/g) || [])
+    .map(s => s.slice(1, -1))
+    .join('');
 
   return {
-    all: [...new Set([addedLines, stripped, dejoined, base64Dejoined, hexDecoded, pctDecoded, confusable, confusableDejoined])],
+    all: [...new Set([addedLines, stripped, dejoined, base64Dejoined, hexDecoded, pctDecoded, confusable, confusableDejoined, uniDecoded, stringLiteralsCollapsed])],
     normalized: dejoined,
     base64Normalized: base64Dejoined,
   };

package/src/security.mjs

@@ -167,6 +167,10 @@ function splitDiffByFile(diffText) {
       current.lines.push({ text: line.slice(1), no: lineNo });
       if (lineNo !== null) lineNo++;
     } else if (lineNo !== null && !line.startsWith("-") && !line.startsWith("\\")) {
+      if (line.startsWith(" ")) {
+        if (!current) select(null);
+        current.lines.push({ text: line.slice(1), no: lineNo });
+      }
       lineNo++; // A context line advances the post-image just as an added one does.
     }
   }

package/src/state.mjs

@@ -233,24 +233,36 @@ export function withVfsMutex(mutexDir, fn, opts = {}) {
   const maxRetries = opts.maxRetries || 200;
   const retryDelayMs = opts.retryDelayMs || 10;
 
+  const staleMs = opts.staleMs || 2000;
+
   for (let i = 0; i < maxRetries; i++) {
+    let acquired = false;
     try {
       mkdirSync(mutexDir);
-      try {
-        return fn();
-      } finally {
-        try {
-          rmdirSync(mutexDir);
-        } catch (_) {}
-      }
+      acquired = true;
     } catch (err) {
       if (err.code === "EEXIST") {
+        try {
+          if (Date.now() - statSync(mutexDir).mtimeMs > staleMs) {
+            rmdirSync(mutexDir);
+          }
+        } catch (_) {}
         const deadline = Date.now() + retryDelayMs;
         while (Date.now() < deadline) {}
         continue;
       }
       throw err;
     }
+    
+    if (acquired) {
+      try {
+        return fn();
+      } finally {
+        try {
+          rmdirSync(mutexDir);
+        } catch (_) {}
+      }
+    }
   }
   throw new MutexTimeoutError(`Failed to acquire VFS mutex lock at ${mutexDir} after ${maxRetries} retries`);
 }
@@ -634,9 +646,10 @@ export function acquireLock(agentName, taskId, files = [], rootOrOpts = resolveR
   const root = typeof rootOrOpts === "string" ? rootOrOpts : (rootOrOpts?.root || resolveRoot());
   const branch = (typeof rootOrOpts === "object" && rootOrOpts?.branch) || opts?.branch || process.env.JULES_BRANCH || process.env.BRANCH_NAME || "";
   const lockDir = getLockDir(root);
-  const lockFile = join(lockDir, `${taskId}.json`);
+  return withVfsMutex(join(lockDir, ".acquire.mutex"), () => {
+    const lockFile = join(lockDir, `${taskId}.json`);
 
-  if (existsSync(lockFile)) {
+    if (existsSync(lockFile)) {
     try {
       const existing = JSON.parse(readFileSync(lockFile, "utf-8"));
       if (isLockLive(existing)) {
@@ -740,6 +753,7 @@ export function acquireLock(agentName, taskId, files = [], rootOrOpts = resolveR
       try { closeSync(fd); } catch (_) {}
     }
   }
+  });
 }
 
 export function releaseLock(taskId, rootOrOpts = resolveRoot()) {

package/src/wizard-task.mjs

@@ -1,5 +1,5 @@
 import { writeFileSync, mkdirSync, existsSync } from "node:fs";
-import { resolve, join } from "node:path";
+import { resolve } from "node:path";
 import { untrackedOnboardingArtifacts } from "./git.mjs";
 import { loadConfig } from "./config.mjs";
 import { gate } from "./engine.mjs";
@@ -220,33 +220,22 @@ export function planTaskCreate(root = process.cwd(), inputObj = {}) {
   const rawId = inputObj.id || `TASK-${Date.now().toString(36).toUpperCase()}`;
   const taskId = String(rawId).replace(/[^a-zA-Z0-9_-]/g, "_");
 
-  const hasAstro = existsSync(join(root, "astro.config.mjs")) || existsSync(join(root, "astro.config.ts"));
-  const hasWrangler =
-    existsSync(join(root, "wrangler.jsonc")) ||
-    existsSync(join(root, "wrangler.json")) ||
-    existsSync(join(root, "wrangler.toml"));
-
+  const configInvariants = Array.isArray(config.invariants) ? config.invariants : [];
   const autoInvariants = [
     "Preserve existing signatures, surrounding logic, and coding style.",
     "Do not modify files outside scope.allow.",
+    ...configInvariants,
   ];
-  if (hasAstro) {
-    autoInvariants.push("Zero-JS runtime-princip: skicka noll onödig klient-JS i src/ och använd plana <img> framför Astro <Image>.");
-  }
-  if (hasWrangler) {
-    autoInvariants.push("Edge runtime constraints: inga otillåtna Node-imports (t.ex. node:fs, node:path, sharp) i workerd runtime-kod.");
-  }
   const invariants = Array.isArray(inputObj.invariants) && inputObj.invariants.length > 0
     ? inputObj.invariants
     : autoInvariants;
 
-  const autoMcpDirectives = [];
-  if (hasAstro) autoMcpDirectives.push("astro-docs");
-  if (hasWrangler) autoMcpDirectives.push("cloudflare-docs");
-  if (existsSync(join(root, "emdash.config.ts"))) autoMcpDirectives.push("emdash-docs");
-  if (autoMcpDirectives.length > 0) autoMcpDirectives.push("context7");
-
-  const mcpDirectives = inputObj.mcpDirectives || inputObj.mcp_directives || (autoMcpDirectives.length > 0 ? autoMcpDirectives : undefined);
+  const configDirectives = Array.isArray(config.mcp_directives)
+    ? config.mcp_directives
+    : Array.isArray(config.mcpDirectives)
+      ? config.mcpDirectives
+      : [];
+  const mcpDirectives = inputObj.mcpDirectives || inputObj.mcp_directives || (configDirectives.length > 0 ? configDirectives : undefined);
   const mcpDirectiveLine = mcpDirectives && mcpDirectives.length > 0
     ? `MCP DIRECTIVE: Mandating pre-execution documentation lookup via [${mcpDirectives.join(" | ")}] before modifying code.\n\n`
     : "";