jules-orchestrator-kit 0.75.1 → 0.75.3

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.75.3] - 2026-10-09
+
+### Added
+- **`--oracle` Verification Alias (`bin/agentctl.mjs`, `src/ops/command-registry.mjs`)**: Added `--oracle` alias for `--verify` / `--verify-cmd` across `agentctl task create`, `task new`, `task template`, and `dispatch`, aligning CLI flags with prompt template terminology.
+- **Explicit Lane Flag on Task Creation (`bin/agentctl.mjs`, `src/ops/command-registry.mjs`)**: Added `--lane` and `--risk-lane` flags to `agentctl task create` and `task new` to specify risk level directly (`green|amber|orange|red`) without manual frontmatter edits.
+
+### Fixed
+- **Queue Fallback Isolation (`bin/agentctl.mjs`)**: Prevented automatic pending queue file selection during `task create` / `task new`, ensuring queue auto-selection is restricted to `dispatch` and `run`.
+- **Envelope Comment Stripping in Entropy Scanner (`src/wizard-task.mjs`, `src/secret-scanner.mjs`)**: Stripped `<!-- JULES_TASK_ENVELOPE: ... -->` comments and YAML frontmatter prior to Shannon entropy calculation to prevent false-positive secret leak blocks on tasks carrying envelope metadata.
+- **Word Boundaries on Credential Keywords (`src/secret-scanner.mjs`)**: Added word boundary assertions around credential keywords in `LOW_CONFIDENCE_PATTERNS` so identifiers like `hasHighEntropyToken` are not flagged as secret leaks.
+
+## [0.75.2] - 2026-10-09
+
+### Fixed
+- **Committed Mode Snapshot Target (`src/engine.mjs`)**: Pointed `materializeSnapshot` to target commit `opts.head` (defaults to `HEAD`) instead of base commit when evaluating in committed mode.
+- **Auto-Merge CI PR Head Checkout (`src/ci-templates.mjs`)**: Detached checkout to fetched PR head (`git checkout --detach refs/pr-head`) before gate evaluation so PR verification tests candidate changes rather than base.
+- **TUI Interactive Fallback on Headless CI (`src/ops/tui-menu.mjs`)**: Allowed interactive terminal UI menu execution when custom mock streams are explicitly provided even if `process.env.CI` is defined.
+- **Pure JSON Output in Task Queue (`bin/agentctl.mjs`)**: Suppressed decorative informational messages during `agentctl queue --json` execution for uncorrupted machine consumption.
+
+### Added
+- **CLI Navigation Aliases & Gate Flags (`bin/agentctl.mjs`, `src/ops/command-registry.mjs`)**: Added `hub` alias for `menu`, `task new` alias for `task create`, and forwarded `--head` to `agentctl check` and verification gate.
+
+### Security
+- **Task Envelope & Pre-Dispatch Secret Prevention (`src/envelope.mjs`, `src/engine.mjs`)**: Rejected prompts and task intents containing unredacted high-confidence credentials before queuing or agent dispatch.
+
 ## [0.75.1] - 2026-10-09
 
 ### Added

package/README.md

@@ -17,7 +17,7 @@ You can also run local checks without connecting an agent provider.
 `agentctl repair` explicitly for repair workflows. Provider output and passing
 checks still need review before merging.
 
-The current release is **v0.75.1**, a pre-1.0 release. A long-term stability policy is a
+The current release is **v0.75.3**, a pre-1.0 release. A long-term stability policy is a
 [v1.0 goal](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/ROADMAP_V1.md).
 
 ## Quickstart
@@ -176,7 +176,7 @@ npm run package-integrity
 npm run guard-reach
 ```
 
-The recorded baseline is **1667 unit tests across 210 suites**. Doc-sync compares
+The recorded baseline is **1672 unit tests across 210 suites**. Doc-sync compares
 that count with an actual run. Counts do not establish correctness for every
 provider or project. See
 [contributing](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/CONTRIBUTING.md)

package/bin/agentctl.mjs

@@ -127,7 +127,7 @@ export function printHelp() {
  * @param {string} [root] Repository root.
  * @returns {{ content: string, sourceFile: string | null }}
  */
-function resolvePromptDetails(values, positionals = [], root = process.cwd()) {
+function resolvePromptDetails(values, positionals = [], root = process.cwd(), { allowQueueFallback = true } = {}) {
   const file = values["prompt-file"] || values.file;
   if (file) {
     if (!existsSync(file)) {
@@ -157,7 +157,7 @@ function resolvePromptDetails(values, positionals = [], root = process.cwd()) {
     }
   }
 
-  if (positionals.length === 0) {
+  if (allowQueueFallback && positionals.length === 0) {
     const queueDir = getQueueDir(root);
     if (existsSync(queueDir)) {
       const candidates = readdirSync(queueDir)
@@ -176,8 +176,8 @@ function resolvePromptDetails(values, positionals = [], root = process.cwd()) {
   return { content: positionals.join(" ").trim(), sourceFile: null };
 }
 
-function resolvePromptInput(values, positionals = [], root = process.cwd()) {
-  return resolvePromptDetails(values, positionals, root).content;
+function resolvePromptInput(values, positionals = [], root = process.cwd(), options = {}) {
+  return resolvePromptDetails(values, positionals, root, options).content;
 }
 
 /**
@@ -272,8 +272,8 @@ async function main() {
   if (!command) {
     if (args.includes("-i") || args.includes("--interactive")) {
       const { runTuiMenu } = await import("../src/ops/tui-menu.mjs");
-      await runTuiMenu(resolveRoot());
-      process.exit(0);
+      const res = await runTuiMenu(resolveRoot());
+      process.exit(res?.code || (res?.headless ? 1 : 0));
     }
     const { resolveNextStep, renderNextStep } = await import("../src/ops/next-step.mjs");
     const cwd = process.cwd();
@@ -350,6 +350,7 @@ async function main() {
           author: { type: "string" },
           "verify-cmd": { type: "string", short: "v" },
           verify: { type: "string" },
+          oracle: { type: "string" },
           "dry-run": { type: "boolean", short: "d" },
           json: { type: "boolean", short: "j" },
         },
@@ -368,7 +369,7 @@ async function main() {
         values.title = values.title || envelopeMeta.title;
         values.role = values.role || envelopeMeta.role;
         values.tier = values.tier || envelopeMeta.tier;
-        values["verify-cmd"] = values["verify-cmd"] || values.verify || envelopeMeta.verifyCmd;
+        values["verify-cmd"] = values.oracle || values["verify-cmd"] || values.verify || envelopeMeta.verifyCmd;
         if (values["auto-pr"] === undefined && envelopeMeta.flags?.autoPr !== undefined) {
           values["auto-pr"] = envelopeMeta.flags.autoPr;
         }
@@ -413,7 +414,7 @@ async function main() {
         checkPremise: values["check-premise"] || values.idempotent,
         goalCheck: values["goal-check"],
         author: values.author,
-        verifyCmd: values["verify-cmd"] || values.verify,
+        verifyCmd: values.oracle || values["verify-cmd"] || values.verify,
       };
 
       try {
@@ -497,6 +498,7 @@ async function main() {
         args: args.slice(1),
         options: {
           base: { type: "string", short: "b" },
+          head: { type: "string" },
           mode: { type: "string", short: "m", default: "working-tree" },
           "working-tree": { type: "boolean" },
           staged: { type: "boolean" },
@@ -532,6 +534,7 @@ async function main() {
         root,
         config,
         base: values.base,
+        head: values.head,
         mode: selectedMode,
         fix: values.fix,
         allowProtected: values["allow-protected"],
@@ -1402,24 +1405,29 @@ async function main() {
       } else {
         files = queueEntries.filter((f) => isTaskFile(f, queueDir));
       }
-      console.log(`Found ${files.length} queued task(s) in .agent/jules-queue/`);
-      if (files.length > 0) {
-        const concurrency = values.concurrency ? Number(values.concurrency) : undefined;
-        const results = await run(null, {
-          root,
-          config,
-          dag: values.dag,
-          concurrency,
-          dryRun: values["dry-run"],
-        });
+      if (!values.json) {
+        console.log(`Found ${files.length} queued task(s) in .agent/jules-queue/`);
+      }
+      if (files.length === 0) {
         if (values.json) {
-          console.log(JSON.stringify(results, null, 2));
-          const anyFailed = (results.results || []).some((r) => r && r.ok === false);
-          process.exit(anyFailed ? 1 : 0);
+          console.log(JSON.stringify({ ok: true, processed: 0, results: [], dryRun: Boolean(values["dry-run"]) }, null, 2));
         }
-        process.exit(reportRunOutcome(results));
+        process.exit(0);
       }
-      process.exit(0);
+      const concurrency = values.concurrency ? Number(values.concurrency) : undefined;
+      const results = await run(null, {
+        root,
+        config,
+        dag: values.dag,
+        concurrency,
+        dryRun: values["dry-run"],
+      });
+      if (values.json) {
+        console.log(JSON.stringify(results, null, 2));
+        const anyFailed = (results.results || []).some((r) => r && r.ok === false);
+        process.exit(anyFailed ? 1 : 0);
+      }
+      process.exit(reportRunOutcome(results));
       break;
     }
 
@@ -2031,12 +2039,13 @@ async function main() {
       break;
     }
 
+    case "hub":
     case "menu":
     case "tui":
     case "ui": {
       const { runTuiMenu } = await import("../src/ops/tui-menu.mjs");
-      await runTuiMenu(root);
-      process.exit(0);
+      const res = await runTuiMenu(root);
+      process.exit(res?.code || (res?.headless ? 1 : 0));
       break;
     }
 
@@ -2195,7 +2204,7 @@ async function main() {
 
     case "task": {
       const subCommand = args[1] || "create";
-      if (subCommand === "create") {
+      if (subCommand === "create" || subCommand === "new") {
         const { values, positionals } = parseArgs({
           args: args.slice(2),
           options: {
@@ -2209,6 +2218,9 @@ async function main() {
             "depends-on": { type: "string" },
             verify: { type: "string" },
             "verify-cmd": { type: "string", short: "v" },
+            oracle: { type: "string" },
+            lane: { type: "string" },
+            "risk-lane": { type: "string" },
             "auto-pr": { type: "boolean" },
             "require-plan-approval": { type: "boolean" },
             repoless: { type: "boolean" },
@@ -2232,18 +2244,19 @@ async function main() {
           isTTY: Boolean(process.stdin.isTTY),
           // A title and a prompt together state the whole task; there is
           // nothing left for the wizard to ask.
-          fullySpecified: Boolean(values.title && resolvePromptInput(values, positionals)),
+          fullySpecified: Boolean(values.title && resolvePromptInput(values, positionals, root, { allowQueueFallback: false })),
         });
 
         const { runTaskCreateWizard } = await import("../src/wizard-task.mjs");
         const res = await runTaskCreateWizard(root, {
           title: values.title,
-          prompt: resolvePromptInput(values, positionals),
+          prompt: resolvePromptInput(values, positionals, root, { allowQueueFallback: false }),
           role: values.role,
           tier: values.tier,
           template: values.template,
+          lane: values.lane || values["risk-lane"],
           dependsOn: values["depends-on"] || values.depends,
-          verifyCmd: values["verify-cmd"] || values.verify,
+          verifyCmd: values.oracle || values["verify-cmd"] || values.verify,
           autoPr: values["auto-pr"],
           requirePlanApproval: values["require-plan-approval"],
           repoless: values.repoless,
@@ -2276,6 +2289,7 @@ async function main() {
             json: { type: "boolean", short: "j" },
             verify: { type: "string" },
             "verify-cmd": { type: "string", short: "v" },
+            oracle: { type: "string" },
             "dry-run": { type: "boolean", short: "d" },
           },
           allowPositionals: true,
@@ -2308,7 +2322,7 @@ async function main() {
           process.exit(1);
         }
 
-        const envelope = synthesizeWebEnvelope(templateName, {}, { verifyCmd: values["verify-cmd"] || values.verify });
+        const envelope = synthesizeWebEnvelope(templateName, {}, { verifyCmd: values.oracle || values["verify-cmd"] || values.verify });
         if (values.json) {
           console.log(JSON.stringify({ ok: true, ...envelope }, null, 2));
         } else {
@@ -2456,7 +2470,7 @@ async function main() {
 
         process.exit(result.ok ? 0 : 1);
       } else {
-        console.error(`Unknown task subcommand '${subCommand}'. Supported: agentctl task create, agentctl task optimize, agentctl task template, agentctl task validate`);
+        console.error(`Unknown task subcommand '${subCommand}'. Supported: agentctl task create (or task new), agentctl task optimize, agentctl task template, agentctl task validate`);
         process.exit(1);
       }
       break;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.75.1",
-  "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents \u2014 Google Jules, Claude Code, Codex and Gemini CLI.",
+  "version": "0.75.3",
+  "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/FullThrottle83/jules-orchestrator-kit.git"

package/src/ci-templates.mjs

@@ -259,6 +259,7 @@ jobs:
         run: |
           set -euo pipefail
           git fetch --no-tags origin "+$HEAD_SHA:refs/pr-head"
+          git checkout --detach refs/pr-head
 
       - name: Set up Node.js
         if: steps.pr.outputs.found == 'true'

package/src/engine.mjs

@@ -2,7 +2,7 @@ import { loadConfig, resolveTrustedPolicy, normalizePath } from "./config.mjs";
 import { isTestPath } from "./test-paths.mjs";
 import { isPlaceholderTestScript, isSrcLayout } from "./stack-detector.mjs";
 import { checkCollectionFloor } from "./ops/test-collection.mjs";
-import { checkScope, scanDiff, scanBinaryPayloads, redactSecrets } from "./security.mjs";
+import { checkScope, scanDiff, scanBinaryPayloads, redactSecrets, hasHighConfidenceSecret } from "./security.mjs";
 import { changedFiles, diffBytes, diffText, binaryDiffEntries, symlinkChanges, showFromOrigin, runCmd, materializeSnapshot } from "./git.mjs";
 import { createProvider, ProviderRateLimitError, ProviderUnavailableError } from "./provider.mjs";
 import { resolveRoutedProvider } from "./router.mjs";
@@ -306,7 +306,7 @@ export async function gate(opts = {}) {
   let snapshot = { cwd: root, cleanup: () => {}, mode };
   try {
     if (mode === "staged" || mode === "committed") {
-      snapshot = materializeSnapshot(root, mode, base);
+      snapshot = materializeSnapshot(root, mode, opts.head || "HEAD");
     }
   } catch (snapErr) {
     phases.push({ phase: "verify", ok: false, error: snapErr.message });
@@ -1482,8 +1482,14 @@ export async function dispatch(task = {}, opts = {}) {
     };
   }
 
+  // Pre-dispatch secret leak prevention (unless explicitly allowed)
+  const rawPrompt = task.prompt || "";
+  if (!opts.allowSecrets && hasHighConfidenceSecret(rawPrompt)) {
+    throw new Error("Pre-Dispatch Secret Leak Blocked: Task prompt contains unredacted high-confidence credentials.");
+  }
+
   // Redact secrets in prompt before dispatching
-  let cleanPrompt = redactSecrets(task.prompt || "");
+  let cleanPrompt = redactSecrets(rawPrompt);
 
   // Specialist Role resolution (if role is set and not already present in prompt)
   if (task.role) {

package/src/envelope.mjs

@@ -1,5 +1,5 @@
 import { git, runCmd, resolveBase } from "./git.mjs";
-import { checkScope } from "./security.mjs";
+import { checkScope, scanDiff } from "./security.mjs";
 import { normalizeScope } from "./config.mjs";
 import { existsSync } from "node:fs";
 import { resolve, relative, isAbsolute } from "node:path";
@@ -185,6 +185,22 @@ export function validateEnvelope(envelope = {}, opts = {}) {
     }
   }
 
+  // 11. Secret Leak Scrubbing Preflight
+  const textToScan = [
+    typeof envelope.prompt === "string" ? envelope.prompt : "",
+    typeof envelope.intent === "string" ? envelope.intent : (envelope.intent?.outcome || ""),
+    typeof envelope.instructions === "string" ? envelope.instructions : "",
+  ].filter(Boolean).join("\n");
+
+  if (textToScan && !opts.allowSecrets) {
+    const multilineDiff = textToScan.split("\n").map((line) => `+${line}`).join("\n");
+    const secretScan = scanDiff(multilineDiff);
+    if (!secretScan.ok && secretScan.findings.length > 0) {
+      const types = secretScan.findings.map((f) => f.type || "SECRET_DETECTED").join(", ");
+      errors.push(`Secret leak detected in envelope prompt/intent (${types}). Scrub credentials before validation.`);
+    }
+  }
+
   return {
     ok: errors.length === 0,
     code: errors.length === 0 ? 0 : 1,

package/src/ops/command-registry.mjs

@@ -185,6 +185,9 @@ export const COMMAND_REGISTRY = [
       { name: "depends", type: "string", description: "Alias for --depends-on" },
       { name: "verify-cmd", type: "string", description: "Verification command override (-v)" },
       { name: "verify", type: "string", description: "Alias for --verify-cmd" },
+      { name: "oracle", type: "string", description: "Alias for --verify-cmd" },
+      { name: "lane", type: "string", description: "Risk lane assignment (green | amber | orange | red)" },
+      { name: "risk-lane", type: "string", description: "Alias for --lane" },
       { name: "auto-pr", type: "boolean", description: "Automatically create GitHub PR upon completion" },
       { name: "require-plan-approval", type: "boolean", description: "Require approval of agent plan before execution" },
       { name: "repoless", type: "boolean", description: "Execute in repoless sandbox mode" },
@@ -216,6 +219,7 @@ export const COMMAND_REGISTRY = [
       { name: "list", type: "boolean", description: "List available task templates (-l)" },
       { name: "verify-cmd", type: "string", description: "Verification command override (-v)" },
       { name: "verify", type: "string", description: "Alias for --verify-cmd" },
+      { name: "oracle", type: "string", description: "Alias for --verify-cmd" },
       { name: "dry-run", type: "boolean", description: "Simulate envelope synthesis (-d)" },
       { name: "json", type: "boolean", description: "Output structured JSON envelope (-j)" },
     ],
@@ -373,9 +377,10 @@ export const COMMAND_REGISTRY = [
     risk: "low",
     interactive: "always",
     requiresRepository: true,
-    shortcuts: ["tui", "ui"],
+    shortcuts: ["hub", "tui", "ui"],
     examples: [
       "agentctl menu",
+      "agentctl hub",
       "agentctl tui",
     ],
     flags: [],
@@ -820,6 +825,7 @@ export const COMMAND_REGISTRY = [
       { name: "author", type: "string", description: "Attribution author for the dispatch" },
       { name: "verify-cmd", type: "string", description: "Verification command override (-v)" },
       { name: "verify", type: "string", description: "Alias for --verify-cmd" },
+      { name: "oracle", type: "string", description: "Alias for --verify-cmd" },
       { name: "source", type: "string", description: "Jules repository source identifier (-s)" },
       { name: "branch", type: "string", description: "Starting branch for task execution (-b)" },
       { name: "repoless", type: "boolean", description: "Dispatch task in repoless execution mode" },

package/src/ops/tui-menu.mjs

@@ -27,9 +27,11 @@ export async function runTuiMenu(root = process.cwd(), options = {}) {
   const stdin = options.stdin || process.stdin;
   const stdout = options.stdout || process.stdout;
 
-  if (!isTTY(stdin) && !options.allowHeadless) {
+  const hasCustomStreams = Boolean(options.stdin || options.stdout);
+  const isInteractive = isTTY(stdin) && isTTY(stdout) && (!process.env.CI || hasCustomStreams || options.allowInteractive);
+  if (!isInteractive && !options.allowHeadless) {
     stdout.write("Interactive terminal menu requires a TTY terminal. Use 'agentctl --help' for CLI commands.\n");
-    return { ok: true, headless: true };
+    return { ok: true, headless: true, code: 1 };
   }
 
   while (true) {

package/src/secret-scanner.mjs

@@ -49,7 +49,7 @@ export const LOW_CONFIDENCE_PATTERNS = [
   /Bearer\s+[A-Za-z0-9._~+/-]{10,255}/gi,
   /Authorization:\s*Bearer\s+[A-Za-z0-9._~+/-]{10,255}/gi,
   /\bsk_test_[0-9a-zA-Z]{24,99}\b/g,
-  /(?:api[_-]?key|secret|password|passwd|token|auth[_-]?token)\s*[:=]\s*(?:['"`]([^'"`\n]{8,128})['"`]|([A-Za-z0-9._~+/-]{16,128}))/gi,
+  /(?:["'`]|\b)(?:api[_-]?key|secret|password|passwd|token|auth[_-]?token)(?:["'`]|\b)\s*[:=]\s*(?:['"`]([^'"`\n]{8,128})['"`]|([A-Za-z0-9._~+/-]{16,128}))/gi,
 ];
 
 export function shannonEntropy(str) {
@@ -499,7 +499,10 @@ export function hasHighEntropyToken(text = "", file = null) {
     return false;
   }
 
-  const lines = text.split("\n");
+  const sanitizedText = text
+    .replace(/<!--\s*JULES_TASK_ENVELOPE:[\s\S]*?-->/gi, " ")
+    .replace(/^---\s*[\s\S]*?---\s*/m, " ");
+  const lines = sanitizedText.split("\n");
   for (const rawLine of lines) {
     const line = stripEntropyNoise(rawLine);
 

package/src/wizard-task.mjs

@@ -186,11 +186,14 @@ export function planTaskCreate(root = process.cwd(), inputObj = {}) {
     if (/[/\\][a-zA-Z0-9_.-]+\.[a-zA-Z0-9]+(:\d+(:\d+)?)?$/.test(clean)) return true;
     return false;
   };
-  const hasHighEntropyToken = rawPrompt
+  const promptForEntropy = rawPrompt
+    .replace(/<!--\s*JULES_TASK_ENVELOPE:[\s\S]*?-->/gi, " ")
+    .replace(/^---\s*[\s\S]*?---\s*/m, " ");
+  const hasHighEntropyToken = promptForEntropy
     .split(/\s+/)
     .some((token) => !isPathOrUrlToken(token) && token.length >= 20 && shannonEntropy(token) > 4.3);
   const isShortHighEntropy =
-    rawPrompt.length <= 120 && !isPathOrUrlToken(rawPrompt.trim()) && shannonEntropy(rawPrompt) > 4.5;
+    promptForEntropy.length <= 120 && !isPathOrUrlToken(promptForEntropy.trim()) && shannonEntropy(promptForEntropy) > 4.5;
   if ((hasHighEntropyToken || isShortHighEntropy) && !inputObj.allowHighEntropy) {
     secretFindings.push({ id: "HIGH_ENTROPY_PROMPT", line: 1 });
   }