jules-orchestrator-kit 0.75.1 → 0.75.2

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.75.2] - 2026-10-09
+
+### Fixed
+- **Committed Mode Snapshot Target (`src/engine.mjs`)**: Pointed `materializeSnapshot` to target commit `opts.head` (defaults to `HEAD`) instead of base commit when evaluating in committed mode.
+- **Auto-Merge CI PR Head Checkout (`src/ci-templates.mjs`)**: Detached checkout to fetched PR head (`git checkout --detach refs/pr-head`) before gate evaluation so PR verification tests candidate changes rather than base.
+- **TUI Interactive Fallback on Headless CI (`src/ops/tui-menu.mjs`)**: Allowed interactive terminal UI menu execution when custom mock streams are explicitly provided even if `process.env.CI` is defined.
+- **Pure JSON Output in Task Queue (`bin/agentctl.mjs`)**: Suppressed decorative informational messages during `agentctl queue --json` execution for uncorrupted machine consumption.
+
+### Added
+- **CLI Navigation Aliases & Gate Flags (`bin/agentctl.mjs`, `src/ops/command-registry.mjs`)**: Added `hub` alias for `menu`, `task new` alias for `task create`, and forwarded `--head` to `agentctl check` and verification gate.
+
+### Security
+- **Task Envelope & Pre-Dispatch Secret Prevention (`src/envelope.mjs`, `src/engine.mjs`)**: Rejected prompts and task intents containing unredacted high-confidence credentials before queuing or agent dispatch.
+
 ## [0.75.1] - 2026-10-09
 
 ### Added

package/README.md

@@ -17,7 +17,7 @@ You can also run local checks without connecting an agent provider.
 `agentctl repair` explicitly for repair workflows. Provider output and passing
 checks still need review before merging.
 
-The current release is **v0.75.1**, a pre-1.0 release. A long-term stability policy is a
+The current release is **v0.75.2**, a pre-1.0 release. A long-term stability policy is a
 [v1.0 goal](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/ROADMAP_V1.md).
 
 ## Quickstart
@@ -176,7 +176,7 @@ npm run package-integrity
 npm run guard-reach
 ```
 
-The recorded baseline is **1667 unit tests across 210 suites**. Doc-sync compares
+The recorded baseline is **1670 unit tests across 210 suites**. Doc-sync compares
 that count with an actual run. Counts do not establish correctness for every
 provider or project. See
 [contributing](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/CONTRIBUTING.md)

package/bin/agentctl.mjs

@@ -272,8 +272,8 @@ async function main() {
   if (!command) {
     if (args.includes("-i") || args.includes("--interactive")) {
       const { runTuiMenu } = await import("../src/ops/tui-menu.mjs");
-      await runTuiMenu(resolveRoot());
-      process.exit(0);
+      const res = await runTuiMenu(resolveRoot());
+      process.exit(res?.code || (res?.headless ? 1 : 0));
     }
     const { resolveNextStep, renderNextStep } = await import("../src/ops/next-step.mjs");
     const cwd = process.cwd();
@@ -497,6 +497,7 @@ async function main() {
         args: args.slice(1),
         options: {
           base: { type: "string", short: "b" },
+          head: { type: "string" },
           mode: { type: "string", short: "m", default: "working-tree" },
           "working-tree": { type: "boolean" },
           staged: { type: "boolean" },
@@ -532,6 +533,7 @@ async function main() {
         root,
         config,
         base: values.base,
+        head: values.head,
         mode: selectedMode,
         fix: values.fix,
         allowProtected: values["allow-protected"],
@@ -1402,24 +1404,29 @@ async function main() {
       } else {
         files = queueEntries.filter((f) => isTaskFile(f, queueDir));
       }
-      console.log(`Found ${files.length} queued task(s) in .agent/jules-queue/`);
-      if (files.length > 0) {
-        const concurrency = values.concurrency ? Number(values.concurrency) : undefined;
-        const results = await run(null, {
-          root,
-          config,
-          dag: values.dag,
-          concurrency,
-          dryRun: values["dry-run"],
-        });
+      if (!values.json) {
+        console.log(`Found ${files.length} queued task(s) in .agent/jules-queue/`);
+      }
+      if (files.length === 0) {
         if (values.json) {
-          console.log(JSON.stringify(results, null, 2));
-          const anyFailed = (results.results || []).some((r) => r && r.ok === false);
-          process.exit(anyFailed ? 1 : 0);
+          console.log(JSON.stringify({ ok: true, processed: 0, results: [], dryRun: Boolean(values["dry-run"]) }, null, 2));
         }
-        process.exit(reportRunOutcome(results));
+        process.exit(0);
       }
-      process.exit(0);
+      const concurrency = values.concurrency ? Number(values.concurrency) : undefined;
+      const results = await run(null, {
+        root,
+        config,
+        dag: values.dag,
+        concurrency,
+        dryRun: values["dry-run"],
+      });
+      if (values.json) {
+        console.log(JSON.stringify(results, null, 2));
+        const anyFailed = (results.results || []).some((r) => r && r.ok === false);
+        process.exit(anyFailed ? 1 : 0);
+      }
+      process.exit(reportRunOutcome(results));
       break;
     }
 
@@ -2031,12 +2038,13 @@ async function main() {
       break;
     }
 
+    case "hub":
     case "menu":
     case "tui":
     case "ui": {
       const { runTuiMenu } = await import("../src/ops/tui-menu.mjs");
-      await runTuiMenu(root);
-      process.exit(0);
+      const res = await runTuiMenu(root);
+      process.exit(res?.code || (res?.headless ? 1 : 0));
       break;
     }
 
@@ -2195,7 +2203,7 @@ async function main() {
 
     case "task": {
       const subCommand = args[1] || "create";
-      if (subCommand === "create") {
+      if (subCommand === "create" || subCommand === "new") {
         const { values, positionals } = parseArgs({
           args: args.slice(2),
           options: {
@@ -2456,7 +2464,7 @@ async function main() {
 
         process.exit(result.ok ? 0 : 1);
       } else {
-        console.error(`Unknown task subcommand '${subCommand}'. Supported: agentctl task create, agentctl task optimize, agentctl task template, agentctl task validate`);
+        console.error(`Unknown task subcommand '${subCommand}'. Supported: agentctl task create (or task new), agentctl task optimize, agentctl task template, agentctl task validate`);
         process.exit(1);
       }
       break;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.75.1",
-  "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents \u2014 Google Jules, Claude Code, Codex and Gemini CLI.",
+  "version": "0.75.2",
+  "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/FullThrottle83/jules-orchestrator-kit.git"

package/src/ci-templates.mjs

@@ -259,6 +259,7 @@ jobs:
         run: |
           set -euo pipefail
           git fetch --no-tags origin "+$HEAD_SHA:refs/pr-head"
+          git checkout --detach refs/pr-head
 
       - name: Set up Node.js
         if: steps.pr.outputs.found == 'true'

package/src/engine.mjs

@@ -2,7 +2,7 @@ import { loadConfig, resolveTrustedPolicy, normalizePath } from "./config.mjs";
 import { isTestPath } from "./test-paths.mjs";
 import { isPlaceholderTestScript, isSrcLayout } from "./stack-detector.mjs";
 import { checkCollectionFloor } from "./ops/test-collection.mjs";
-import { checkScope, scanDiff, scanBinaryPayloads, redactSecrets } from "./security.mjs";
+import { checkScope, scanDiff, scanBinaryPayloads, redactSecrets, hasHighConfidenceSecret } from "./security.mjs";
 import { changedFiles, diffBytes, diffText, binaryDiffEntries, symlinkChanges, showFromOrigin, runCmd, materializeSnapshot } from "./git.mjs";
 import { createProvider, ProviderRateLimitError, ProviderUnavailableError } from "./provider.mjs";
 import { resolveRoutedProvider } from "./router.mjs";
@@ -306,7 +306,7 @@ export async function gate(opts = {}) {
   let snapshot = { cwd: root, cleanup: () => {}, mode };
   try {
     if (mode === "staged" || mode === "committed") {
-      snapshot = materializeSnapshot(root, mode, base);
+      snapshot = materializeSnapshot(root, mode, opts.head || "HEAD");
     }
   } catch (snapErr) {
     phases.push({ phase: "verify", ok: false, error: snapErr.message });
@@ -1482,8 +1482,14 @@ export async function dispatch(task = {}, opts = {}) {
     };
   }
 
+  // Pre-dispatch secret leak prevention (unless explicitly allowed)
+  const rawPrompt = task.prompt || "";
+  if (!opts.allowSecrets && hasHighConfidenceSecret(rawPrompt)) {
+    throw new Error("Pre-Dispatch Secret Leak Blocked: Task prompt contains unredacted high-confidence credentials.");
+  }
+
   // Redact secrets in prompt before dispatching
-  let cleanPrompt = redactSecrets(task.prompt || "");
+  let cleanPrompt = redactSecrets(rawPrompt);
 
   // Specialist Role resolution (if role is set and not already present in prompt)
   if (task.role) {

package/src/envelope.mjs

@@ -1,5 +1,5 @@
 import { git, runCmd, resolveBase } from "./git.mjs";
-import { checkScope } from "./security.mjs";
+import { checkScope, scanDiff } from "./security.mjs";
 import { normalizeScope } from "./config.mjs";
 import { existsSync } from "node:fs";
 import { resolve, relative, isAbsolute } from "node:path";
@@ -185,6 +185,22 @@ export function validateEnvelope(envelope = {}, opts = {}) {
     }
   }
 
+  // 11. Secret Leak Scrubbing Preflight
+  const textToScan = [
+    typeof envelope.prompt === "string" ? envelope.prompt : "",
+    typeof envelope.intent === "string" ? envelope.intent : (envelope.intent?.outcome || ""),
+    typeof envelope.instructions === "string" ? envelope.instructions : "",
+  ].filter(Boolean).join("\n");
+
+  if (textToScan && !opts.allowSecrets) {
+    const multilineDiff = textToScan.split("\n").map((line) => `+${line}`).join("\n");
+    const secretScan = scanDiff(multilineDiff);
+    if (!secretScan.ok && secretScan.findings.length > 0) {
+      const types = secretScan.findings.map((f) => f.type || "SECRET_DETECTED").join(", ");
+      errors.push(`Secret leak detected in envelope prompt/intent (${types}). Scrub credentials before validation.`);
+    }
+  }
+
   return {
     ok: errors.length === 0,
     code: errors.length === 0 ? 0 : 1,

package/src/ops/command-registry.mjs

@@ -373,9 +373,10 @@ export const COMMAND_REGISTRY = [
     risk: "low",
     interactive: "always",
     requiresRepository: true,
-    shortcuts: ["tui", "ui"],
+    shortcuts: ["hub", "tui", "ui"],
     examples: [
       "agentctl menu",
+      "agentctl hub",
       "agentctl tui",
     ],
     flags: [],

package/src/ops/tui-menu.mjs

@@ -27,9 +27,11 @@ export async function runTuiMenu(root = process.cwd(), options = {}) {
   const stdin = options.stdin || process.stdin;
   const stdout = options.stdout || process.stdout;
 
-  if (!isTTY(stdin) && !options.allowHeadless) {
+  const hasCustomStreams = Boolean(options.stdin || options.stdout);
+  const isInteractive = isTTY(stdin) && isTTY(stdout) && (!process.env.CI || hasCustomStreams || options.allowInteractive);
+  if (!isInteractive && !options.allowHeadless) {
     stdout.write("Interactive terminal menu requires a TTY terminal. Use 'agentctl --help' for CLI commands.\n");
-    return { ok: true, headless: true };
+    return { ok: true, headless: true, code: 1 };
   }
 
   while (true) {