jules-orchestrator-kit 0.75.2 → 0.75.3

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.75.3] - 2026-10-09
+
+### Added
+- **`--oracle` Verification Alias (`bin/agentctl.mjs`, `src/ops/command-registry.mjs`)**: Added `--oracle` alias for `--verify` / `--verify-cmd` across `agentctl task create`, `task new`, `task template`, and `dispatch`, aligning CLI flags with prompt template terminology.
+- **Explicit Lane Flag on Task Creation (`bin/agentctl.mjs`, `src/ops/command-registry.mjs`)**: Added `--lane` and `--risk-lane` flags to `agentctl task create` and `task new` to specify risk level directly (`green|amber|orange|red`) without manual frontmatter edits.
+
+### Fixed
+- **Queue Fallback Isolation (`bin/agentctl.mjs`)**: Prevented automatic pending queue file selection during `task create` / `task new`, ensuring queue auto-selection is restricted to `dispatch` and `run`.
+- **Envelope Comment Stripping in Entropy Scanner (`src/wizard-task.mjs`, `src/secret-scanner.mjs`)**: Stripped `<!-- JULES_TASK_ENVELOPE: ... -->` comments and YAML frontmatter prior to Shannon entropy calculation to prevent false-positive secret leak blocks on tasks carrying envelope metadata.
+- **Word Boundaries on Credential Keywords (`src/secret-scanner.mjs`)**: Added word boundary assertions around credential keywords in `LOW_CONFIDENCE_PATTERNS` so identifiers like `hasHighEntropyToken` are not flagged as secret leaks.
+
 ## [0.75.2] - 2026-10-09
 
 ### Fixed

package/README.md

@@ -17,7 +17,7 @@ You can also run local checks without connecting an agent provider.
 `agentctl repair` explicitly for repair workflows. Provider output and passing
 checks still need review before merging.
 
-The current release is **v0.75.2**, a pre-1.0 release. A long-term stability policy is a
+The current release is **v0.75.3**, a pre-1.0 release. A long-term stability policy is a
 [v1.0 goal](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/ROADMAP_V1.md).
 
 ## Quickstart
@@ -176,7 +176,7 @@ npm run package-integrity
 npm run guard-reach
 ```
 
-The recorded baseline is **1670 unit tests across 210 suites**. Doc-sync compares
+The recorded baseline is **1672 unit tests across 210 suites**. Doc-sync compares
 that count with an actual run. Counts do not establish correctness for every
 provider or project. See
 [contributing](https://github.com/FullThrottle83/jules-orchestrator-kit/blob/main/CONTRIBUTING.md)

package/bin/agentctl.mjs

@@ -127,7 +127,7 @@ export function printHelp() {
  * @param {string} [root] Repository root.
  * @returns {{ content: string, sourceFile: string | null }}
  */
-function resolvePromptDetails(values, positionals = [], root = process.cwd()) {
+function resolvePromptDetails(values, positionals = [], root = process.cwd(), { allowQueueFallback = true } = {}) {
   const file = values["prompt-file"] || values.file;
   if (file) {
     if (!existsSync(file)) {
@@ -157,7 +157,7 @@ function resolvePromptDetails(values, positionals = [], root = process.cwd()) {
     }
   }
 
-  if (positionals.length === 0) {
+  if (allowQueueFallback && positionals.length === 0) {
     const queueDir = getQueueDir(root);
     if (existsSync(queueDir)) {
       const candidates = readdirSync(queueDir)
@@ -176,8 +176,8 @@ function resolvePromptDetails(values, positionals = [], root = process.cwd()) {
   return { content: positionals.join(" ").trim(), sourceFile: null };
 }
 
-function resolvePromptInput(values, positionals = [], root = process.cwd()) {
-  return resolvePromptDetails(values, positionals, root).content;
+function resolvePromptInput(values, positionals = [], root = process.cwd(), options = {}) {
+  return resolvePromptDetails(values, positionals, root, options).content;
 }
 
 /**
@@ -350,6 +350,7 @@ async function main() {
           author: { type: "string" },
           "verify-cmd": { type: "string", short: "v" },
           verify: { type: "string" },
+          oracle: { type: "string" },
           "dry-run": { type: "boolean", short: "d" },
           json: { type: "boolean", short: "j" },
         },
@@ -368,7 +369,7 @@ async function main() {
         values.title = values.title || envelopeMeta.title;
         values.role = values.role || envelopeMeta.role;
         values.tier = values.tier || envelopeMeta.tier;
-        values["verify-cmd"] = values["verify-cmd"] || values.verify || envelopeMeta.verifyCmd;
+        values["verify-cmd"] = values.oracle || values["verify-cmd"] || values.verify || envelopeMeta.verifyCmd;
         if (values["auto-pr"] === undefined && envelopeMeta.flags?.autoPr !== undefined) {
           values["auto-pr"] = envelopeMeta.flags.autoPr;
         }
@@ -413,7 +414,7 @@ async function main() {
         checkPremise: values["check-premise"] || values.idempotent,
         goalCheck: values["goal-check"],
         author: values.author,
-        verifyCmd: values["verify-cmd"] || values.verify,
+        verifyCmd: values.oracle || values["verify-cmd"] || values.verify,
       };
 
       try {
@@ -2217,6 +2218,9 @@ async function main() {
             "depends-on": { type: "string" },
             verify: { type: "string" },
             "verify-cmd": { type: "string", short: "v" },
+            oracle: { type: "string" },
+            lane: { type: "string" },
+            "risk-lane": { type: "string" },
             "auto-pr": { type: "boolean" },
             "require-plan-approval": { type: "boolean" },
             repoless: { type: "boolean" },
@@ -2240,18 +2244,19 @@ async function main() {
           isTTY: Boolean(process.stdin.isTTY),
           // A title and a prompt together state the whole task; there is
           // nothing left for the wizard to ask.
-          fullySpecified: Boolean(values.title && resolvePromptInput(values, positionals)),
+          fullySpecified: Boolean(values.title && resolvePromptInput(values, positionals, root, { allowQueueFallback: false })),
         });
 
         const { runTaskCreateWizard } = await import("../src/wizard-task.mjs");
         const res = await runTaskCreateWizard(root, {
           title: values.title,
-          prompt: resolvePromptInput(values, positionals),
+          prompt: resolvePromptInput(values, positionals, root, { allowQueueFallback: false }),
           role: values.role,
           tier: values.tier,
           template: values.template,
+          lane: values.lane || values["risk-lane"],
           dependsOn: values["depends-on"] || values.depends,
-          verifyCmd: values["verify-cmd"] || values.verify,
+          verifyCmd: values.oracle || values["verify-cmd"] || values.verify,
           autoPr: values["auto-pr"],
           requirePlanApproval: values["require-plan-approval"],
           repoless: values.repoless,
@@ -2284,6 +2289,7 @@ async function main() {
             json: { type: "boolean", short: "j" },
             verify: { type: "string" },
             "verify-cmd": { type: "string", short: "v" },
+            oracle: { type: "string" },
             "dry-run": { type: "boolean", short: "d" },
           },
           allowPositionals: true,
@@ -2316,7 +2322,7 @@ async function main() {
           process.exit(1);
         }
 
-        const envelope = synthesizeWebEnvelope(templateName, {}, { verifyCmd: values["verify-cmd"] || values.verify });
+        const envelope = synthesizeWebEnvelope(templateName, {}, { verifyCmd: values.oracle || values["verify-cmd"] || values.verify });
         if (values.json) {
           console.log(JSON.stringify({ ok: true, ...envelope }, null, 2));
         } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.75.2",
+  "version": "0.75.3",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for autonomous coding agents — Google Jules, Claude Code, Codex and Gemini CLI.",
   "repository": {
     "type": "git",

package/src/ops/command-registry.mjs

@@ -185,6 +185,9 @@ export const COMMAND_REGISTRY = [
       { name: "depends", type: "string", description: "Alias for --depends-on" },
       { name: "verify-cmd", type: "string", description: "Verification command override (-v)" },
       { name: "verify", type: "string", description: "Alias for --verify-cmd" },
+      { name: "oracle", type: "string", description: "Alias for --verify-cmd" },
+      { name: "lane", type: "string", description: "Risk lane assignment (green | amber | orange | red)" },
+      { name: "risk-lane", type: "string", description: "Alias for --lane" },
       { name: "auto-pr", type: "boolean", description: "Automatically create GitHub PR upon completion" },
       { name: "require-plan-approval", type: "boolean", description: "Require approval of agent plan before execution" },
       { name: "repoless", type: "boolean", description: "Execute in repoless sandbox mode" },
@@ -216,6 +219,7 @@ export const COMMAND_REGISTRY = [
       { name: "list", type: "boolean", description: "List available task templates (-l)" },
       { name: "verify-cmd", type: "string", description: "Verification command override (-v)" },
       { name: "verify", type: "string", description: "Alias for --verify-cmd" },
+      { name: "oracle", type: "string", description: "Alias for --verify-cmd" },
       { name: "dry-run", type: "boolean", description: "Simulate envelope synthesis (-d)" },
       { name: "json", type: "boolean", description: "Output structured JSON envelope (-j)" },
     ],
@@ -821,6 +825,7 @@ export const COMMAND_REGISTRY = [
       { name: "author", type: "string", description: "Attribution author for the dispatch" },
       { name: "verify-cmd", type: "string", description: "Verification command override (-v)" },
       { name: "verify", type: "string", description: "Alias for --verify-cmd" },
+      { name: "oracle", type: "string", description: "Alias for --verify-cmd" },
       { name: "source", type: "string", description: "Jules repository source identifier (-s)" },
       { name: "branch", type: "string", description: "Starting branch for task execution (-b)" },
       { name: "repoless", type: "boolean", description: "Dispatch task in repoless execution mode" },

package/src/secret-scanner.mjs

@@ -49,7 +49,7 @@ export const LOW_CONFIDENCE_PATTERNS = [
   /Bearer\s+[A-Za-z0-9._~+/-]{10,255}/gi,
   /Authorization:\s*Bearer\s+[A-Za-z0-9._~+/-]{10,255}/gi,
   /\bsk_test_[0-9a-zA-Z]{24,99}\b/g,
-  /(?:api[_-]?key|secret|password|passwd|token|auth[_-]?token)\s*[:=]\s*(?:['"`]([^'"`\n]{8,128})['"`]|([A-Za-z0-9._~+/-]{16,128}))/gi,
+  /(?:["'`]|\b)(?:api[_-]?key|secret|password|passwd|token|auth[_-]?token)(?:["'`]|\b)\s*[:=]\s*(?:['"`]([^'"`\n]{8,128})['"`]|([A-Za-z0-9._~+/-]{16,128}))/gi,
 ];
 
 export function shannonEntropy(str) {
@@ -499,7 +499,10 @@ export function hasHighEntropyToken(text = "", file = null) {
     return false;
   }
 
-  const lines = text.split("\n");
+  const sanitizedText = text
+    .replace(/<!--\s*JULES_TASK_ENVELOPE:[\s\S]*?-->/gi, " ")
+    .replace(/^---\s*[\s\S]*?---\s*/m, " ");
+  const lines = sanitizedText.split("\n");
   for (const rawLine of lines) {
     const line = stripEntropyNoise(rawLine);
 

package/src/wizard-task.mjs

@@ -186,11 +186,14 @@ export function planTaskCreate(root = process.cwd(), inputObj = {}) {
     if (/[/\\][a-zA-Z0-9_.-]+\.[a-zA-Z0-9]+(:\d+(:\d+)?)?$/.test(clean)) return true;
     return false;
   };
-  const hasHighEntropyToken = rawPrompt
+  const promptForEntropy = rawPrompt
+    .replace(/<!--\s*JULES_TASK_ENVELOPE:[\s\S]*?-->/gi, " ")
+    .replace(/^---\s*[\s\S]*?---\s*/m, " ");
+  const hasHighEntropyToken = promptForEntropy
     .split(/\s+/)
     .some((token) => !isPathOrUrlToken(token) && token.length >= 20 && shannonEntropy(token) > 4.3);
   const isShortHighEntropy =
-    rawPrompt.length <= 120 && !isPathOrUrlToken(rawPrompt.trim()) && shannonEntropy(rawPrompt) > 4.5;
+    promptForEntropy.length <= 120 && !isPathOrUrlToken(promptForEntropy.trim()) && shannonEntropy(promptForEntropy) > 4.5;
   if ((hasHighEntropyToken || isShortHighEntropy) && !inputObj.allowHighEntropy) {
     secretFindings.push({ id: "HIGH_ENTROPY_PROMPT", line: 1 });
   }