jules-orchestrator-kit 0.8.0 → 0.8.5

package/scripts/jules-patch.mjs

@@ -0,0 +1,111 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadEnv, ensureSdkCacheIsolation, log } from "./utils.mjs";
+
+const isMainModule = process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url));
+
+export async function fetchSessionPatch(sessionId, options = {}) {
+  if (!sessionId || typeof sessionId !== "string") {
+    throw new Error("Session ID is required.");
+  }
+
+  const apiKey = options.apiKey || process.env.JULES_API_KEY || process.env.GEMINI_API_KEY || "";
+  const apiUrlBase = options.apiUrl || process.env.JULES_API_URL || "https://jules.googleapis.com/v1alpha/sessions";
+
+  // Normalize session ID (handles full resource name "sessions/123" or short ID "123")
+  const sessionPath = sessionId.startsWith("sessions/") ? sessionId : `sessions/${sessionId}`;
+
+  if (apiKey) {
+    const targetUrl = apiUrlBase.endsWith(`/${sessionPath}`)
+      ? apiUrlBase
+      : `${apiUrlBase.replace(/\/sessions\/?$/, "")}/${sessionPath}`;
+
+    try {
+      const res = await fetch(targetUrl, {
+        method: "GET",
+        headers: {
+          "X-Goog-Api-Key": apiKey,
+          "Content-Type": "application/json"
+        },
+        signal: AbortSignal.timeout(15000)
+      });
+
+      if (res.ok) {
+        const data = await res.json();
+        const outputs = data.outputs || [];
+        const changeSetOutput = outputs.find((o) => o.type === "changeSet" || o.changeSet);
+        const changeSet = changeSetOutput?.changeSet;
+        const diff = changeSet?.gitPatch?.unidiffPatch || "";
+
+        return {
+          sessionId: data.sessionId || sessionId,
+          state: data.state || "UNKNOWN",
+          title: data.title || "",
+          hasPatch: !!diff,
+          diff
+        };
+      }
+    } catch (err) {
+      log.warn(`⚠️ REST API fetch failed (${err.message}), attempting SDK fallback...`);
+    }
+  }
+
+  // Fallback to @google/jules-sdk if available
+  try {
+    const { jules } = await import("@google/jules-sdk");
+    const rawId = sessionId.replace(/^sessions\//, "");
+    const info = await jules.session(rawId).info();
+    const outputs = info.outputs || [];
+    const changeSet = outputs.find((o) => o.type === "changeSet" || o.changeSet)?.changeSet;
+    const diff = changeSet?.gitPatch?.unidiffPatch || "";
+
+    return {
+      sessionId: info.id || rawId,
+      state: info.state || "UNKNOWN",
+      title: info.title || "",
+      hasPatch: !!diff,
+      diff
+    };
+  } catch (sdkErr) {
+    if (sdkErr.code === "ERR_MODULE_NOT_FOUND" || sdkErr.message?.includes("Cannot find package")) {
+      throw new Error("No API key configured and @google/jules-sdk is not installed. Set JULES_API_KEY or install @google/jules-sdk.");
+    }
+    throw new Error(`Failed to retrieve session patch: ${sdkErr.message}`);
+  }
+}
+
+if (isMainModule) {
+  loadEnv();
+  ensureSdkCacheIsolation();
+
+  const args = process.argv.slice(2);
+  const isJson = args.includes("--json");
+  const filteredArgs = args.filter((arg) => !arg.startsWith("--"));
+  const sessionId = filteredArgs[0];
+
+  if (!sessionId || args.includes("--help") || args.includes("-h")) {
+    console.error("Usage: node scripts/jules-patch.mjs <session_id> [--json]");
+    console.error("Extracts raw git unidiff patch from a Jules session for headless CI (git apply).");
+    process.exit(args.includes("--help") || args.includes("-h") ? 0 : 1);
+  }
+
+  fetchSessionPatch(sessionId)
+    .then((result) => {
+      if (isJson) {
+        console.log(JSON.stringify(result, null, 2));
+        process.exit(0);
+      }
+
+      if (!result.hasPatch || !result.diff) {
+        console.error(`::warning::No git patch found in session outputs for session: ${sessionId}`);
+        process.exit(2);
+      }
+
+      process.stdout.write(result.diff);
+      process.exit(0);
+    })
+    .catch((err) => {
+      console.error(`::error::Failed to extract patch for session ${sessionId}: ${err.message}`);
+      process.exit(1);
+    });
+}

package/scripts/jules-queue-runner.mjs

@@ -97,14 +97,17 @@ async function safeMoveAsync(src, dest) {
   }
 }
 
-function classifyQueueFailure(error) {
+export function classifyQueueFailure(error) {
   const message = String(error?.stderr || error?.stdout || error?.message || "");
+  const code = error?.code;
 
-  if (/RESTRICTED FILE VIOLATION|COMMAND FILE CHANGE DETECTED|SECRET LEAK PREVENTED|AGENT RULE FILE CHANGE DETECTED/i.test(message)) return "security_violation";
-  if (/DIFF PAYLOAD TOO LARGE/i.test(message)) return "diff_too_large";
-  if (/Daily budget exhausted/i.test(message)) return "budget_exhausted";
-  if (/HTTP 429|Rate Limit Exceeded/i.test(message)) return "rate_limited";
+  if (code === 6 || /RESTRICTED FILE VIOLATION|COMMAND FILE CHANGE DETECTED|SECRET LEAK PREVENTED|AGENT RULE FILE CHANGE DETECTED|Security violation/i.test(message)) return "security_violation";
+  if (code === 5 || /DIFF PAYLOAD TOO LARGE|DIFF TOO LARGE/i.test(message)) return "diff_too_large";
+  if (code === 8 || /lock contention|lock busy/i.test(message)) return "budget_locked";
+  if (code === 7 || /Daily budget exhausted|budget exhausted/i.test(message)) return "budget_exhausted";
+  if (/HTTP 429|Rate Limit Exceeded|FAILED_PRECONDITION|Active Session Limit/i.test(message)) return "concurrency_limit";
   if (/HTTP 5\d\d/i.test(message)) return "api_error";
+  if (/command not found|ENOENT|CLI|execFile|spawn|exit code/i.test(message)) return "cli_error";
   return "unknown";
 }
 
@@ -131,6 +134,7 @@ function setTaskState(filename, stateObj) {
 }
 
 async function runQueue() {
+  let permanentFailuresCount = 0;
   for (let i = 0; i < files.length; i += MAX_CONCURRENT) {
     const batch = files.slice(i, i + MAX_CONCURRENT);
     await Promise.allSettled(
@@ -183,25 +187,45 @@ async function runQueue() {
           logQueueState(file, "FAILED", error);
 
           const failureClass = classifyQueueFailure(error);
-          const NON_RETRYABLE = new Set(["security_violation", "diff_too_large", "budget_exhausted"]);
+          const NON_RETRYABLE = new Set(["security_violation", "diff_too_large"]);
 
           const taskState = getTaskState(file);
-          const attempts = (taskState.attempts || 0) + 1;
 
-          if (NON_RETRYABLE.has(failureClass) || attempts >= 3) {
-            const destPath = path.join(failedDir, file);
-            setTaskState(file, { attempts, status: "FAILED_PERMANENT", failure_class: failureClass, last_error: error.message, updated_at: new Date().toISOString() });
-            try { await safeMoveAsync(processingPath, destPath); } catch (_) {}
-            log.error(`Task [${title}] failed (${failureClass}). Moved to failed/. Error: ${error.message}`);
-          } else {
-            setTaskState(file, { attempts, status: "REQUEUED", failure_class: failureClass, last_error: error.message, updated_at: new Date().toISOString() });
+          if (failureClass === "budget_exhausted") {
+            setTaskState(file, { attempts: taskState.attempts || 0, status: "DEFERRED_BUDGET", failure_class: failureClass, last_error: error.message, updated_at: new Date().toISOString() });
+            try { await safeMoveAsync(processingPath, filePath); } catch (_) {}
+            log.warn(`Task [${title}] deferred due to daily budget limit. Left in queue for next budget reset.`);
+          } else if (failureClass === "budget_locked") {
+            setTaskState(file, { attempts: taskState.attempts || 0, status: "REQUEUED_LOCK_BUSY", failure_class: failureClass, last_error: error.message, updated_at: new Date().toISOString() });
+            try { await safeMoveAsync(processingPath, filePath); } catch (_) {}
+            log.warn(`Task [${title}] lock contention (busy). Re-queued for retry.`);
+          } else if (failureClass === "concurrency_limit") {
+            setTaskState(file, { attempts: taskState.attempts || 0, status: "REQUEUED_CONCURRENCY", failure_class: failureClass, last_error: error.message, updated_at: new Date().toISOString() });
             try { await safeMoveAsync(processingPath, filePath); } catch (_) {}
-            log.warn(`Task [${title}] failed (${failureClass}). Re-queued (Attempt ${attempts}/3). Error: ${error.message}`);
+            log.warn(`Task [${title}] active session quota (~30) reached. Pausing 15s before re-queuing.`);
+            await sleep(15000);
+          } else {
+            const attempts = (taskState.attempts || 0) + 1;
+            if (NON_RETRYABLE.has(failureClass) || attempts >= 3) {
+              permanentFailuresCount++;
+              const destPath = path.join(failedDir, file);
+              setTaskState(file, { attempts, status: "FAILED_PERMANENT", failure_class: failureClass, last_error: error.message, updated_at: new Date().toISOString() });
+              try { await safeMoveAsync(processingPath, destPath); } catch (_) {}
+              log.error(`Task [${title}] failed (${failureClass}). Moved to failed/. Error: ${error.message}`);
+            } else {
+              setTaskState(file, { attempts, status: "REQUEUED", failure_class: failureClass, last_error: error.message, updated_at: new Date().toISOString() });
+              try { await safeMoveAsync(processingPath, filePath); } catch (_) {}
+              log.warn(`Task [${title}] failed (${failureClass}). Re-queued (Attempt ${attempts}/3). Error: ${error.message}`);
+            }
           }
         }
       })
     );
   }
+  if (permanentFailuresCount > 0) {
+    log.error(`Queue processing complete with ${permanentFailuresCount} failed task(s).`);
+    process.exit(1);
+  }
   log.header("Queue processing complete!");
 }
 

package/scripts/jules-scan-todos.mjs

@@ -3,7 +3,7 @@
  * Suggested Tasks Scanner for Google Jules
  * Scans codebase for TODO, FIXME, HACK, and OPTIMIZE comments, ranks them by priority,
  * and generates a tasks JSON file formatted for jules-swarm or jules-dispatch.
- * Zero external dependencies.
+ * Zero runtime dependencies.
  */
 
 import fs from "node:fs";

package/scripts/jules-self-audit.mjs

@@ -5,11 +5,15 @@ import crypto from "node:crypto";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
 import { resolveWorkspaceExecutionBoundary } from "./command-resolver.mjs";
-import { log, logToHistory, redactSecrets, hasHighConfidenceSecret, hasLowConfidenceSecret } from "./utils.mjs";
+import { log, hasHighConfidenceSecret, hasLowConfidenceSecret, redactSecrets, anonymizePii } from "./utils.mjs";
 
 function runGitCommand(args, ignoreError = false) {
   try {
-    return execFileSync("git", args, { encoding: "utf-8" }).trim();
+    return execFileSync("git", args, {
+      encoding: "utf-8",
+      maxBuffer: 25 * 1024 * 1024,
+      stdio: ["pipe", "pipe", ignoreError ? "ignore" : "pipe"],
+    }).trim();
   } catch (error) {
     if (ignoreError) return "";
     const err = new Error(`Git command failed: git ${args.join(" ")}\n${error.message}`);
@@ -137,7 +141,8 @@ export function loadForbiddenPatterns(configContent = "") {
     ".github/**",
     "**/secrets/**",
     "**/*.pem",
-    "**/lock-manager/**",
+    "**/.env*",
+    "**/lock-manager*",
     "scripts/jules-*",
     ".agent/jules.yml"
   ];
@@ -160,10 +165,12 @@ export function loadForbiddenPatterns(configContent = "") {
       continue;
     }
     if (inForbidden) {
-      const trimmed = line.trim();
+      const lineWithoutComment = line.split("#")[0];
+      const trimmed = lineWithoutComment.trim();
       if (trimmed.startsWith("-")) {
-        blockParsed.push(trimmed.slice(1).trim().replace(/^["']|["']$/g, ""));
-      } else if (trimmed && !trimmed.startsWith("#")) {
+        const val = trimmed.slice(1).trim().replace(/^["']|["']$/g, "");
+        if (val) blockParsed.push(val);
+      } else if (trimmed) {
         break;
       }
     }
@@ -201,6 +208,50 @@ export function loadAllowedPatterns(configContent = "") {
   return blockParsed;
 }
 
+export function validateJulesConfig(configContent = "", jsonGuardrailsContent = "") {
+  const errors = [];
+
+  if (configContent) {
+    const forbidden = loadForbiddenPatterns(configContent);
+    const allowed = loadAllowedPatterns(configContent);
+    const allPatterns = [...forbidden, ...allowed];
+
+    for (const pat of allPatterns) {
+      if (typeof pat !== "string" || !pat.trim()) {
+        errors.push("Empty or non-string glob pattern found in configuration.");
+      }
+    }
+  }
+
+  if (jsonGuardrailsContent) {
+    try {
+      const data = JSON.parse(jsonGuardrailsContent);
+      if (Array.isArray(data.rules)) {
+        for (let i = 0; i < data.rules.length; i++) {
+          const rule = data.rules[i];
+          if (rule.trigger) {
+            try {
+              new RegExp(rule.trigger, "i");
+            } catch (reErr) {
+              errors.push(`Invalid RegExp trigger at rule index ${i} ('${rule.trigger}'): ${reErr.message}`);
+            }
+          }
+        }
+      }
+    } catch (jsonErr) {
+      errors.push(`Invalid JSON syntax in dynamic-guardrails.json: ${jsonErr.message}`);
+    }
+  }
+
+  if (errors.length > 0) {
+    const err = new Error(`CONFIG VALIDATION ERROR:\n` + errors.map((e) => `  - ${e}`).join("\n"));
+    err.code = 3;
+    return { ok: false, errors, err };
+  }
+
+  return { ok: true, errors: [] };
+}
+
 export function parseAndCleanStderr(stderrStr) {
   if (!stderrStr) return "";
   const clean = stderrStr.replace(/\x1B\[[0-9;]*[a-zA-Z]/g, "");
@@ -208,6 +259,22 @@ export function parseAndCleanStderr(stderrStr) {
   return lines.slice(-100).join("\n");
 }
 
+export function getOodaStateFile(mergeBase = "main") {
+  const oodaDir = path.resolve(process.cwd(), ".agent/state/ooda");
+  if (!fs.existsSync(oodaDir)) fs.mkdirSync(oodaDir, { recursive: true });
+
+  const keyInput = [
+    process.env.GITHUB_REPOSITORY || "",
+    process.env.GITHUB_REF || "",
+    process.env.GITHUB_HEAD_REF || "",
+    mergeBase,
+    process.cwd()
+  ].join("\u0000");
+
+  const key = crypto.createHash("sha256").update(keyInput).digest("hex").slice(0, 16);
+  return path.join(oodaDir, `${key}.json`);
+}
+
 export function logAuditMetrics(metrics) {
   const historyDir = path.resolve(process.cwd(), ".agent/history");
   if (!fs.existsSync(historyDir)) {
@@ -275,7 +342,9 @@ export function runSelfAudit() {
 
   if (commandFileChanges.length > 0 && process.env.JULES_ALLOW_COMMAND_FILE_CHANGES !== "true" && process.env.JULES_ALLOW_COMMAND_FILE_CHANGES !== "1") {
     const err = new Error(
-      "COMMAND FILE CHANGE DETECTED: " + commandFileChanges.join(", ") + ". Refusing to execute verification scripts from untrusted branch."
+      "COMMAND / BUILD CONFIG FILE CHANGE DETECTED: [" + commandFileChanges.join(", ") + "]. " +
+      "Refusing to execute verification scripts from untrusted branch. " +
+      "To override for legitimate dependency updates, set JULES_ALLOW_COMMAND_FILE_CHANGES=true."
     );
     err.code = 3;
     throw err;
@@ -287,7 +356,9 @@ export function runSelfAudit() {
 
   if (agentRuleChanges.length > 0 && process.env.JULES_ALLOW_AGENT_RULE_CHANGES !== "true" && process.env.JULES_ALLOW_AGENT_RULE_CHANGES !== "1") {
     const err = new Error(
-      "AGENT RULE FILE CHANGE DETECTED: " + agentRuleChanges.join(", ") + ". Refusing to load agent rules from untrusted branch."
+      "AGENT RULE FILE CHANGE DETECTED: [" + agentRuleChanges.join(", ") + "]. " +
+      "Refusing to load agent rules from untrusted branch. " +
+      "To override for legitimate rule updates, set JULES_ALLOW_AGENT_RULE_CHANGES=true."
     );
     err.code = 3;
     throw err;
@@ -302,23 +373,44 @@ export function runSelfAudit() {
   // Fail closed: Load security config exclusively from base branch (mainRef).
   // Never fall back to working-tree config which an untrusted PR could craft.
   const trustedConfig = runGitCommand(["show", `${mainRef}:.agent/jules.yml`], true);
+  const trustedJson = runGitCommand(["show", `${mainRef}:.agent/rules/dynamic-guardrails.json`], true);
+  
+  const validationRes = validateJulesConfig(trustedConfig, trustedJson);
+  if (!validationRes.ok) {
+    log.error(`Config validation failed: ${validationRes.err.message}`);
+    throw validationRes.err;
+  }
+
   const forbiddenPatterns = loadForbiddenPatterns(trustedConfig);
   const allowedPatterns = loadAllowedPatterns(trustedConfig);
 
-  const violations = rawDiffFiles.filter((file) => {
-    const isForbidden = forbiddenPatterns.some((pattern) => matchGlob(file, pattern));
-    if (isForbidden) return true; // Immutable forbidden path — CANNOT be overridden by allow_paths
+  const violationsWithDetails = [];
+  rawDiffFiles.forEach((file) => {
+    const matchedForbidden = forbiddenPatterns.find((pattern) => matchGlob(file, pattern));
+    if (matchedForbidden) {
+      violationsWithDetails.push(`${file} (matched forbidden pattern '${matchedForbidden}')`);
+      return;
+    }
     if (allowedPatterns.length > 0) {
       const isAllowed = allowedPatterns.some((pattern) => matchGlob(file, pattern));
-      return !isAllowed;
+      if (!isAllowed) {
+        violationsWithDetails.push(`${file} (not permitted in allow_paths [${allowedPatterns.join(", ")}])`);
+      }
     }
-    return false;
   });
 
-  if (violations.length > 0) {
-    const err = new Error("RESTRICTED FILE VIOLATION DETECTED: " + violations.join(", "));
-    err.code = 3;
-    throw err;
+  if (violationsWithDetails.length > 0) {
+    if (process.env.JULES_ALLOW_RESTRICTED_FILES === "true") {
+      log.warn("JULES_ALLOW_RESTRICTED_FILES=true is set. Bypassing restricted file boundary check.");
+    } else {
+      const err = new Error(
+        `RESTRICTED FILE VIOLATION DETECTED (config read from ${mainRef}:.agent/jules.yml):\n` +
+        violationsWithDetails.map((v) => `  - ${v}`).join("\n") +
+        "\nTo override restricted file checks, set JULES_ALLOW_RESTRICTED_FILES=true."
+      );
+      err.code = 3;
+      throw err;
+    }
   }
   log.success("Restricted File Boundary Check: PASSED");
 
@@ -328,15 +420,23 @@ export function runSelfAudit() {
     : "";
 
   const diffBytes = Buffer.byteLength(codeDiffPayload, "utf8");
-  const maxDiffBytes = 75 * 1024; // 75 KB
+  const maxDiffKb = parseInt(process.env.JULES_MAX_DIFF_KB || "50", 10);
+  const maxDiffBytes = maxDiffKb * 1024;
 
   if (diffBytes > maxDiffBytes) {
-    const err = new Error(`DIFF PAYLOAD TOO LARGE: ${diffBytes} bytes exceeds ${maxDiffBytes} bytes limit for code files. Split the task.`);
+    const err = new Error(`DIFF PAYLOAD TOO LARGE: ${diffBytes} bytes exceeds ${maxDiffKb} KB limit for code files. Split the task.`);
     err.code = 5;
     throw err;
   }
   
-  const fullDiffPayload = runGitCommand(["diff", `${mergeBase}...HEAD`], true);
+  let fullDiffPayload = "";
+  try {
+    fullDiffPayload = runGitCommand(["diff", `${mergeBase}...HEAD`], false);
+  } catch (err) {
+    const error = new Error("DIFF PAYLOAD TOO LARGE: The PR diff exceeds the maximum buffer size (25MB) and cannot be safely scanned for secrets. Please split the task into smaller PRs.");
+    error.code = 5;
+    throw error;
+  }
   const addedLines = fullDiffPayload
     .split("\n")
     .filter((line) => line.startsWith("+") && !line.startsWith("+++"))
@@ -393,8 +493,17 @@ export function runSelfAudit() {
   let failureLog = "";
 
   const runVerification = (cmd) => {
+    if (typeof cmd !== "string" || !cmd.trim()) {
+      return false;
+    }
+    if (/[\r\n\0]/.test(cmd)) {
+      log.error(`Security violation: Invalid control characters in command: ${cmd}`);
+      failureLog = `Security violation: Invalid control characters in verification command`;
+      return false;
+    }
     try {
-      execSync(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
+      const timeoutMs = parseInt(process.env.JULES_VERIFY_TIMEOUT_MS || "600000", 10);
+      execSync(cmd, { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: timeoutMs });
       return true;
     } catch (err) {
       failureLog = parseAndCleanStderr((err.stderr || "") + "\n" + (err.stdout || "") + "\n" + (err.message || ""));
@@ -442,37 +551,15 @@ export function runSelfAudit() {
       throw err;
     }
 
-function getOodaStateFile(mergeBase = "main") {
-  const oodaDir = path.resolve(process.cwd(), ".agent/state/ooda");
-  if (!fs.existsSync(oodaDir)) fs.mkdirSync(oodaDir, { recursive: true });
-
-  const keyInput = [
-    process.env.GITHUB_REPOSITORY || "",
-    process.env.GITHUB_REF || "",
-    process.env.GITHUB_HEAD_REF || "",
-    mergeBase,
-    process.cwd()
-  ].join("\u0000");
-
-  const key = crypto.createHash("sha256").update(keyInput).digest("hex").slice(0, 16);
-  return path.join(oodaDir, `${key}.json`);
-}
-
     let oodaRetries = 0;
     const oodaStateFile = getOodaStateFile(mergeBase);
     try {
       if (fs.existsSync(oodaStateFile)) {
         const oodaData = JSON.parse(fs.readFileSync(oodaStateFile, "utf-8"));
         oodaRetries = oodaData.attempts || 0;
-      } else {
-        const history = execSync("git log -n 5 --format=%B", { encoding: "utf-8" });
-        const matches = history.match(/OODA Auto-Repair/gi);
-        if (matches) {
-          oodaRetries = matches.length;
-        }
       }
     } catch (e) {
-      // Ignore errors here
+      // Ignore reading errors
     }
 
     if (oodaRetries < 3) {
@@ -480,13 +567,15 @@ function getOodaStateFile(mergeBase = "main") {
       try {
         fs.writeFileSync(oodaStateFile, JSON.stringify({ attempts: oodaRetries + 1, lastAttempt: new Date().toISOString() }), "utf-8");
       } catch (e) {}
-      const prompt = `OODA Auto-Repair Attempt ${oodaRetries + 1}\n\nThe verification suite failed with the following errors after the previous patch:\n\n\`\`\`\n${failureLog.slice(-1500)}\n\`\`\`\n\nPlease fix the errors so the verification passes.`;
+      const sanitizedFailureLog = redactSecrets(anonymizePii(failureLog.slice(-1500)));
+      const prompt = `OODA Auto-Repair Attempt ${oodaRetries + 1}\n\nThe verification suite failed with the following errors after the previous patch:\n\n\`\`\`\n${sanitizedFailureLog}\n\`\`\`\n\nPlease fix the errors so the verification passes.`;
       
       const dispatchScript = path.resolve(process.cwd(), "scripts/jules-dispatch.mjs");
       try {
         const env = { 
           ...process.env, 
-          BASE_BRANCH: process.env.GITHUB_HEAD_REF || targetBranch 
+          START_BRANCH: process.env.GITHUB_HEAD_REF || targetBranch,
+          BASE_BRANCH: targetBranch
         };
         execFileSync("node", [dispatchScript, "OODA Auto-Repair", prompt], {
           stdio: "inherit",
@@ -524,8 +613,8 @@ export function runPreflightSandbox() {
     log.step("[1/5]", `Creating isolated environment in ${sandboxDir}...`);
     fs.mkdirSync(sandboxDir, { recursive: true });
     
-    execSync(`git archive HEAD -o "${tempArchive}"`);
-    execSync(`tar -xf "${tempArchive}" -C "${sandboxDir}"`);
+    execFileSync("git", ["archive", "HEAD", "-o", tempArchive]);
+    execFileSync("tar", ["-xf", tempArchive, "-C", sandboxDir]);
     
     log.step("[2/5]", "Sterilizing environment variables...");
     const sterileEnv = { ...process.env };

package/scripts/jules-status.mjs

@@ -1,11 +1,15 @@
 import fs from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { log, checkDailyBudget } from "./utils.mjs";
 
-const isJson = process.argv.includes("--json");
-const queueLogPath = path.resolve(process.cwd(), ".agent/jules-queue/queue.jsonl");
+const isMainModule = process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url));
 
-const budgetInfo = checkDailyBudget();
+if (isMainModule) {
+  const isJson = process.argv.includes("--json");
+  const queueLogPath = path.resolve(process.cwd(), ".agent/jules-queue/queue.jsonl");
+
+  const budgetInfo = checkDailyBudget();
 
 if (!fs.existsSync(queueLogPath)) {
   if (isJson) {
@@ -16,59 +20,60 @@ if (!fs.existsSync(queueLogPath)) {
   process.exit(0);
 }
 
-try {
-  const content = fs.readFileSync(queueLogPath, "utf-8");
-  const lines = content.split("\n").filter(Boolean);
-  
-  if (lines.length === 0) {
-    if (isJson) {
-      console.log(JSON.stringify({ queue: [], budget: budgetInfo }, null, 2));
-    } else {
-      log.info("Queue log is empty.");
+  try {
+    const content = fs.readFileSync(queueLogPath, "utf-8");
+    const lines = content.split("\n").filter(Boolean);
+    
+    if (lines.length === 0) {
+      if (isJson) {
+        console.log(JSON.stringify({ queue: [], budget: budgetInfo }, null, 2));
+      } else {
+        log.info("Queue log is empty.");
+      }
+      process.exit(0);
     }
-    process.exit(0);
-  }
 
-  // We only want the latest status for each task file
-  const statusMap = new Map();
+    // We only want the latest status for each task file
+    const statusMap = new Map();
 
-  for (const line of lines) {
-    try {
-      const entry = JSON.parse(line);
-      if (entry.file) {
-        statusMap.set(entry.file, {
-          file: entry.file,
-          Task: entry.file.replace(/^TASK-\d+-/, "").replace(/\.md$/, ""),
-          Status: entry.status,
-          Timestamp: entry.timestamp,
-          Error: entry.error || null
-        });
+    for (const line of lines) {
+      try {
+        const entry = JSON.parse(line);
+        if (entry.file) {
+          statusMap.set(entry.file, {
+            file: entry.file,
+            Task: entry.file.replace(/^TASK-\d+-/, "").replace(/\.md$/, ""),
+            Status: entry.status,
+            Timestamp: entry.timestamp,
+            Error: entry.error || null
+          });
+        }
+      } catch (e) {
+        // Ignore malformed lines
       }
-    } catch (e) {
-      // Ignore malformed lines
     }
-  }
 
-  const tasksList = Array.from(statusMap.values());
+    const tasksList = Array.from(statusMap.values());
 
-  if (isJson) {
-    console.log(JSON.stringify({ queue: tasksList, budget: budgetInfo }, null, 2));
-    process.exit(0);
-  }
+    if (isJson) {
+      console.log(JSON.stringify({ queue: tasksList, budget: budgetInfo }, null, 2));
+      process.exit(0);
+    }
 
-  if (tasksList.length === 0) {
-    log.info("No parseable task events found in queue.jsonl");
-    process.exit(0);
-  }
+    if (tasksList.length === 0) {
+      log.info("No parseable task events found in queue.jsonl");
+      process.exit(0);
+    }
 
-  log.header(`JULES QUEUE STATUS (Budget: ${budgetInfo.used}/${budgetInfo.budget} sessions used)`);
-  console.table(tasksList.map(t => ({ Task: t.Task, Status: t.Status, Timestamp: new Date(t.Timestamp).toLocaleString(), Error: t.Error || "-" })));
+    log.header(`JULES QUEUE STATUS (Budget: ${budgetInfo.used}/${budgetInfo.budget} sessions used)`);
+    console.table(tasksList.map(t => ({ Task: t.Task, Status: t.Status, Timestamp: new Date(t.Timestamp).toLocaleString(), Error: t.Error || "-" })));
 
-} catch (err) {
-  if (isJson) {
-    console.log(JSON.stringify({ error: err.message }, null, 2));
-  } else {
-    log.error(`Failed to read queue log: ${err.message}`);
+  } catch (err) {
+    if (isJson) {
+      console.log(JSON.stringify({ error: err.message }, null, 2));
+    } else {
+      log.error(`Failed to read queue log: ${err.message}`);
+    }
+    process.exit(1);
   }
-  process.exit(1);
 }