substrate-ai 0.20.135 → 0.20.136

package/dist/adapter-registry-JR4v2z6n.js

@@ -0,0 +1,4 @@
+import { AdapterRegistry } from "./dist-T6ZXe2Q2.js";
+import "./adapter-registry-DIcrxjH8.js";
+
+export { AdapterRegistry };

package/dist/cli/index.js

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
-import { FileKvStore, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, buildPipelineStatusOutput, createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion } from "../health-DiT_FlpE.js";
+import { FileKvStore, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, buildPipelineStatusOutput, createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion } from "../health-COhVUNXM.js";
 import { createLogger } from "../logger-KeHncl-f.js";
 import { createEventBus } from "../helpers-CElYrONe.js";
-import { AdapterRegistry, BudgetConfigSchema, CURRENT_CONFIG_FORMAT_VERSION, CURRENT_TASK_GRAPH_VERSION, ConfigError, CostTrackerConfigSchema, DEFAULT_CONFIG, DoltClient, DoltNotInstalled, GlobalSettingsSchema, InMemoryDatabaseAdapter, IngestionServer, MonitorDatabaseImpl, OPERATIONAL_FINDING, PartialGlobalSettingsSchema, PartialProviderConfigSchema, ProvidersSchema, RoutingRecommender, STORY_METRICS, TelemetryConfigSchema, addTokenUsage, aggregateTokenUsageForRun, checkDoltInstalled, compareRunMetrics, createAmendmentRun, createConfigSystem, createDecision, createPipelineRun, createStderrLogger, getActiveDecisions, getAllCostEntriesFiltered, getBaselineRunMetrics, getDecisionsByCategory, getDecisionsByPhaseForRun, getLatestCompletedRun, getLatestRun, getPipelineRunById, getPlanningCostTotal, getRetryableEscalations, getRunMetrics, getRunningPipelineRuns, getSessionCostSummary, getSessionCostSummaryFiltered, getStoryMetricsForRun, getTokenUsageSummary, incrementRunRestarts, initSchema, initWorkGraphSchema, initializeDolt, listRunMetrics, loadParentRunDecisions, supersedeDecision, swallowDebug, tagRunAsBaseline, updatePipelineRun } from "../dist-FYMixuGN.js";
-import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR, GitClient, GrammarLoader, Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runSolutioningPhase, unescape, validateStopAfterFromConflict } from "../run-DCcJjWhx.js";
+import { AdapterRegistry, BudgetConfigSchema, CURRENT_CONFIG_FORMAT_VERSION, CURRENT_TASK_GRAPH_VERSION, ConfigError, CostTrackerConfigSchema, DEFAULT_CONFIG, DoltClient, DoltNotInstalled, GlobalSettingsSchema, InMemoryDatabaseAdapter, IngestionServer, MonitorDatabaseImpl, OPERATIONAL_FINDING, PartialGlobalSettingsSchema, PartialProviderConfigSchema, ProvidersSchema, RoutingRecommender, STORY_METRICS, TelemetryConfigSchema, addTokenUsage, aggregateTokenUsageForRun, checkDoltInstalled, compareRunMetrics, createAmendmentRun, createConfigSystem, createDecision, createPipelineRun, createStderrLogger, getActiveDecisions, getAllCostEntriesFiltered, getBaselineRunMetrics, getDecisionsByCategory, getDecisionsByPhaseForRun, getLatestCompletedRun, getLatestRun, getPipelineRunById, getPlanningCostTotal, getRetryableEscalations, getRunMetrics, getRunningPipelineRuns, getSessionCostSummary, getSessionCostSummaryFiltered, getStoryMetricsForRun, getTokenUsageSummary, incrementRunRestarts, initSchema, initWorkGraphSchema, initializeDolt, listRunMetrics, loadParentRunDecisions, supersedeDecision, swallowDebug, tagRunAsBaseline, updatePipelineRun } from "../dist-T6ZXe2Q2.js";
+import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR, GitClient, GrammarLoader, Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runSolutioningPhase, unescape, validateStopAfterFromConflict } from "../run-lBgnO-3E.js";
 import "../adapter-registry-DIcrxjH8.js";
-import { RunManifest, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, parseRuntimeProbes, readCurrentRunId, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck } from "../manifest-read-BCnoRvTV.js";
-import "../errors-Qqm59kND.js";
+import { RunManifest, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, parseRuntimeProbes, readCurrentRunId, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck } from "../manifest-read-C84VX-CF.js";
+import "../errors-C-9u7gCX.js";
 import "../routing-DFxoKHDt.js";
 import { WorkGraphRepository } from "../work-graph-repository-DZyJv5pV.js";
 import "../decisions-CzSIEeGP.js";
 import "../decision-router-DblHY8se.js";
-import "../interactive-prompt-CHWGblJe.js";
+import "../interactive-prompt-wZnuOAri.js";
 import "../recovery-engine-BKGBeBnW.js";
 import "../version-manager-impl-qFBiO4Eh.js";
-import { registerUpgradeCommand } from "../upgrade-DWzAWGtt.js";
+import { registerUpgradeCommand } from "../upgrade-CZMWjtYN.js";
 import { Command } from "commander";
 import { fileURLToPath } from "url";
 import { dirname, join, resolve } from "path";
@@ -7023,7 +7023,7 @@ async function runStatusAction(options) {
 			logger$15.debug({ err }, "Work graph query failed, continuing without work graph data");
 		}
 		if (run === void 0) {
-			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-CmwLEwMG.js");
+			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-Dt1yKeE5.js");
 			const substrateDirPath = join(projectRoot, ".substrate");
 			const processInfo = inspectProcessTree$1({
 				projectRoot,
@@ -7971,7 +7971,7 @@ function defaultSupervisorDeps() {
 				if (cached === null) {
 					const { AdapterRegistry: AR } = await import(
 						/* @vite-ignore */
-						"../adapter-registry-61HN97Pb.js"
+						"../adapter-registry-JR4v2z6n.js"
 );
 					cached = new AR();
 					await cached.discoverAndRegister();
@@ -8538,11 +8538,11 @@ async function runSupervisorAction(options, deps = {}) {
 						try {
 							const { createExperimenter } = await import(
 								/* @vite-ignore */
-								"../experimenter-Dwti5ZXb.js"
+								"../experimenter-BZ1rtNzK.js"
 );
 							const { getLatestRun: getLatest } = await import(
 								/* @vite-ignore */
-								"../decisions-B2ColN4E.js"
+								"../decisions-D0MA8bRv.js"
 );
 							const expAdapter = createDatabaseAdapter({
 								backend: "auto",
@@ -8552,7 +8552,7 @@ async function runSupervisorAction(options, deps = {}) {
 								await initSchema(expAdapter);
 								const { runRunAction: runPipeline } = await import(
 									/* @vite-ignore */
-									"../run-DBu_DjmA.js"
+									"../run-rq4X93Bs.js"
 );
 								const runStoryFn = async (opts) => {
 									const exitCode = await runPipeline({
@@ -9077,7 +9077,7 @@ async function runMetricsAction(options) {
 			const routingConfigPath = join(dbDir, "routing.yml");
 			let routingConfig = null;
 			if (existsSync$1(routingConfigPath)) try {
-				const { loadModelRoutingConfig } = await import("../routing-Bl3LFjFs.js");
+				const { loadModelRoutingConfig } = await import("../routing-2kbRZmr7.js");
 				routingConfig = loadModelRoutingConfig(routingConfigPath);
 			} catch {}
 			if (routingConfig === null) routingConfig = {
@@ -13387,8 +13387,8 @@ async function createProgram() {
 /** Fire-and-forget startup version check (story 8.3, AC3/AC5) */
 function checkForUpdatesInBackground(currentVersion) {
 	if (process.env.SUBSTRATE_NO_UPDATE_CHECK === "1") return;
-	import("../upgrade-Bq4SRZgH.js").then(async () => {
-		const { createVersionManager } = await import("../version-manager-impl-CZKVyewX.js");
+	import("../upgrade-DjJ4uqLJ.js").then(async () => {
+		const { createVersionManager } = await import("../version-manager-impl-BLXt2ucf.js");
 		const vm = createVersionManager();
 		const result = await vm.checkForUpdates();
 		if (result.updateAvailable) {

package/dist/{decisions-B2ColN4E.js → decisions-D0MA8bRv.js}

@@ -1,4 +1,4 @@
-import { addTokenUsage, createDecision, createPipelineRun, createRequirement, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunningPipelineRuns, getTokenUsageSummary, listRequirements, registerArtifact, updateDecision, updatePipelineRun, updatePipelineRunConfig, upsertDecision } from "./dist-FYMixuGN.js";
+import { addTokenUsage, createDecision, createPipelineRun, createRequirement, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunningPipelineRuns, getTokenUsageSummary, listRequirements, registerArtifact, updateDecision, updatePipelineRun, updatePipelineRunConfig, upsertDecision } from "./dist-T6ZXe2Q2.js";
 import "./decisions-CzSIEeGP.js";
 
 export { getLatestRun };

package/dist/{dist-FYMixuGN.js → dist-T6ZXe2Q2.js}

@@ -9728,7 +9728,7 @@ const CODEX_SANDBOX_BLOCK_SIGNATURES = [
 	"disallowed by requirements"
 ];
 /** Human-readable explanation appended to escalations caused by a Codex write-block. */
-const CODEX_SANDBOX_BLOCK_HINT = "Likely cause: Codex could not write files. Substrate runs `codex exec --sandbox workspace-write --ask-for-approval never` (normal automation mode — not the org-blocked `--dangerously-bypass-approvals-and-sandbox`). If the run log shows \"disallowed by requirements\", your org policy forbids the `never` approval policy, so Codex cannot write non-interactively on this machine — an org constraint, not substrate. Workaround: dispatch with a provider that can write here (e.g. `--agent claude-code`), or have the Codex policy permit non-interactive workspace writes.";
+const CODEX_SANDBOX_BLOCK_HINT = "Likely cause: Codex could not write files. Substrate runs `codex exec --full-auto` (Codex's documented alias for `-a on-request --sandbox workspace-write` — the standard low-friction non-interactive automation mode, NOT the org-blocked `--dangerously-bypass-approvals-and-sandbox`). If the run log shows \"approval is not supported in exec mode\" or \"patch rejected by user\", the most likely cause is a known Codex defect: `UnlessTrusted` policy unconditionally asks for approval on `apply_patch` (see codex-rs/core/src/safety.rs TODO(ragona)), and `OnRequest` may also fail in environments where `get_platform_sandbox()` returns None (e.g. WSL — see Codex issue #18365). Workarounds: dispatch with a provider that can write here (e.g. `--agent claude-code`), or get the Codex CLI bug fixed upstream.";
 /**
 * Returns the Codex-write-block hint if `output` contains a sandbox/approval
 * block signature, else null. Pure + exported for diagnostics and testing.
@@ -9784,40 +9784,40 @@ var CodexCLIAdapter = class {
 	* Build spawn command for a coding task.
 	* Uses: `codex exec` with prompt delivered via stdin.
 	*
-	* `--sandbox workspace-write -c approval_policy=never` is required so the
-	* non-interactive `codex exec` can actually write files. Without these, exec
-	* defaults to a read-only sandbox + an approval policy that escalates to the
-	* user — but exec has no one to approve, so file writes fail with
-	* "file change approval is not supported in exec mode" (→ create-story-no-file).
+	* `--full-auto` is Codex's documented `exec` convenience alias for
+	* `-a on-request --sandbox workspace-write` — the standard low-friction
+	* non-interactive automation mode. We use this form for three reasons:
 	*
-	* Why `-c approval_policy=never` instead of `--ask-for-approval never`:
-	* `-a`/`--ask-for-approval` is a TOP-LEVEL flag in modern Codex CLI
-	* versions — it must appear BEFORE the `exec` subcommand. Placing it after
-	* `exec` errors out with `unexpected argument '--ask-for-approval' found`,
-	* which is what bit substrate v0.20.131–133. The `-c key=value` override
-	* IS a documented `exec` flag in every version (it overrides any
-	* `~/.codex/config.toml` setting via dotted-path), and `approval_policy`
-	* is the same underlying setting `-a` writes. The TOML value `never` falls
-	* back to a literal string when bare-keyword parsing fails (per Codex's
-	* own `-c` documentation), so the unquoted form is portable across shells.
+	*   1. **It parses cleanly on `exec`.** `--full-auto` is a documented
+	*      subcommand flag (`codex exec --help` lists it). The earlier substrate
+	*      attempts hit two failure modes: `--ask-for-approval` is top-level
+	*      only and errors `unexpected argument` after `exec` (v0.20.131–133),
+	*      and `-c approval_policy=never` parses but gets silently downshifted
+	*      under enterprise cloud-managed policies that disallow `Never`
+	*      (v0.20.134–135 — the operator's pv-core-harness case).
+	*   2. **`OnRequest` works with `apply_patch` in `workspace-write`.** Per
+	*      Codex source (`codex-rs/core/src/safety.rs:33-116`), `OnRequest`
+	*      falls through to `is_write_patch_constrained_to_writable_paths` and
+	*      AUTO-APPROVES `apply_patch` calls when every target path is inside
+	*      the writable roots of an active platform sandbox. So Codex writes
+	*      land in `exec` mode without any approval prompt or escalation.
+	*      `UnlessTrusted` is the only policy with the broken `TODO(ragona)`
+	*      branch that unconditionally asks for approval — we avoid it.
+	*   3. **`OnRequest` is broadly allow-listed.** Enterprise cloud policies
+	*      that disallow `Never` typically still permit `OnRequest`
+	*      (it's strictly more conservative). `--full-auto` is therefore the
+	*      form most likely to work across both unrestricted and managed Codex
+	*      installs.
 	*
-	* `never` is exactly what Codex's docs recommend for non-interactive runs,
-	* and this is normal automation mode — NOT the
-	* `--dangerously-bypass-approvals-and-sandbox` flag (which some org policies
-	* forbid). The planning command stays read-only (it must not write).
+	* Not the org-blocked `--dangerously-bypass-approvals-and-sandbox` flag.
+	* The planning command stays read-only (it must not write).
 	*
 	* Do NOT use --json: it produces a JSONL event stream that prevents
 	* extractYamlBlock from finding the structured result block in stdout.
 	* Raw text output is required (same rationale as Claude adapter).
 	*/
 	buildCommand(prompt, options) {
-		const args = [
-			"exec",
-			"--sandbox",
-			"workspace-write",
-			"-c",
-			"approval_policy=never"
-		];
+		const args = ["exec", "--full-auto"];
 		if (options.additionalFlags && options.additionalFlags.length > 0) args.push(...options.additionalFlags);
 		const envEntries = {};
 		if (options.apiKey) envEntries.OPENAI_API_KEY = options.apiKey;
@@ -11331,4 +11331,4 @@ async function callLLM(params) {
 
 //#endregion
 export { ADVISORY_NOTES, AdapterRegistry, AdtError, BudgetConfigSchema, CODEX_SANDBOX_BLOCK_HINT, CURRENT_CONFIG_FORMAT_VERSION, CURRENT_TASK_GRAPH_VERSION, Categorizer, ClaudeCodeAdapter, CodexCLIAdapter, ConfigError, ConfigIncompatibleFormatError, ConsumerAnalyzer, CostTrackerConfigSchema, DEFAULT_CONFIG, DEFAULT_GLOBAL_SETTINGS, DispatcherImpl, DoltClient, DoltNotInstalled, DoltQueryError, ESCALATION_DIAGNOSIS, EXPERIMENT_RESULT, EfficiencyScorer, GeminiCLIAdapter, GlobalSettingsSchema, InMemoryDatabaseAdapter, IngestionServer, LEARNING_FINDING, LogTurnAnalyzer, ModelRoutingConfigSchema, MonitorDatabaseImpl, OPERATIONAL_FINDING, PartialGlobalSettingsSchema, PartialProviderConfigSchema, ProviderPolicySchema, ProvidersSchema, Recommender, RoutingConfigError, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, STORY_METRICS, STORY_OUTCOME, SubstrateConfigSchema, TASK_TYPE_PHASE_MAP, TEST_EXPANSION_FINDING, TEST_PLAN, TelemetryConfigSchema, TelemetryNormalizer, TelemetryPipeline, TurnAnalyzer, VersionManagerImpl, addTokenUsage, aggregateTokenUsageForRun, aggregateTokenUsageForStory, buildAuditLogEntry, buildBranchName, buildModificationDirective, buildPRBody, buildWorktreePath, callLLM, checkDoltInstalled, classifyVersionGap, compareRunMetrics, createAmendmentRun, createConfigSystem, createDatabaseAdapter as createDatabaseAdapter$1, createDecision, createExperimenter, createPipelineRun, createRequirement, createStderrLogger, createVersionManager, detectCodexSandboxBlock, detectInterfaceChanges, determineVerdict, getActiveDecisions, getAllCostEntriesFiltered, getArtifactByTypeForRun, getArtifactsByRun, getBaselineRunMetrics, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestCompletedRun, getLatestRun, getModelTier, getPipelineRunById, getPlanningCostTotal, getRetryableEscalations, getRunMetrics, getRunningPipelineRuns, getSessionCostSummary, getSessionCostSummaryFiltered, getStoryMetricsForRun, getTokenUsageSummary, incrementRunRestarts, initSchema, initWorkGraphSchema, initializeDolt, listRequirements, listRunMetrics, loadModelRoutingConfig, loadParentRunDecisions, registerArtifact, resolvePromptFile, supersedeDecision, swallowDebug, tagRunAsBaseline, updateDecision, updatePipelineRun, updatePipelineRunConfig, upsertDecision, writeRunMetrics, writeStoryMetrics };
-//# sourceMappingURL=dist-FYMixuGN.js.map
+//# sourceMappingURL=dist-T6ZXe2Q2.js.map

package/dist/{errors-Qqm59kND.js → errors-C-9u7gCX.js}

@@ -1,4 +1,4 @@
-import { AdtError } from "./dist-FYMixuGN.js";
+import { AdtError } from "./dist-T6ZXe2Q2.js";
 
 //#region src/core/errors.ts
 /** Error thrown when task configuration is invalid */
@@ -71,4 +71,4 @@ var TaskGraphIncompatibleFormatError = class extends AdtError {
 
 //#endregion
 export { BudgetExceededError, GitError, RecoveryError, TaskConfigError, TaskGraphCycleError, TaskGraphError, TaskGraphIncompatibleFormatError, WorkerError, WorkerNotFoundError };
-//# sourceMappingURL=errors-Qqm59kND.js.map
+//# sourceMappingURL=errors-C-9u7gCX.js.map

package/dist/{experimenter-Dwti5ZXb.js → experimenter-BZ1rtNzK.js}

@@ -1,3 +1,3 @@
-import { buildAuditLogEntry, buildBranchName, buildModificationDirective, buildPRBody, buildWorktreePath, createExperimenter, determineVerdict, resolvePromptFile } from "./dist-FYMixuGN.js";
+import { buildAuditLogEntry, buildBranchName, buildModificationDirective, buildPRBody, buildWorktreePath, createExperimenter, determineVerdict, resolvePromptFile } from "./dist-T6ZXe2Q2.js";
 
 export { createExperimenter };

package/dist/{health-DiT_FlpE.js → health-COhVUNXM.js}

@@ -1,6 +1,6 @@
 import { createLogger } from "./logger-KeHncl-f.js";
-import { DoltClient, DoltQueryError, createDatabaseAdapter$1 as createDatabaseAdapter, getLatestRun, getPipelineRunById, initSchema } from "./dist-FYMixuGN.js";
-import { resolveMainRepoRoot, resolveRunManifest } from "./manifest-read-BCnoRvTV.js";
+import { DoltClient, DoltQueryError, createDatabaseAdapter$1 as createDatabaseAdapter, getLatestRun, getPipelineRunById, initSchema } from "./dist-T6ZXe2Q2.js";
+import { resolveMainRepoRoot, resolveRunManifest } from "./manifest-read-C84VX-CF.js";
 import { createRequire } from "module";
 import { dirname, join } from "path";
 import { existsSync, readFileSync } from "node:fs";
@@ -1000,4 +1000,4 @@ function registerHealthCommand(program, _version = "0.0.0", projectRoot = proces
 
 //#endregion
 export { BMAD_BASELINE_TOKENS_FULL, DEFAULT_STALL_THRESHOLD_SECONDS, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter$1 as createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, isOrchestratorProcessLine, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, runHealthAction, validateStoryKey };
-//# sourceMappingURL=health-DiT_FlpE.js.map
+//# sourceMappingURL=health-COhVUNXM.js.map

package/dist/{health-CmwLEwMG.js → health-Dt1yKeE5.js}

@@ -1,7 +1,7 @@
-import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-DiT_FlpE.js";
+import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-COhVUNXM.js";
 import "./logger-KeHncl-f.js";
-import "./dist-FYMixuGN.js";
-import "./manifest-read-BCnoRvTV.js";
+import "./dist-T6ZXe2Q2.js";
+import "./manifest-read-C84VX-CF.js";
 import "./work-graph-repository-DZyJv5pV.js";
 import "./decisions-CzSIEeGP.js";
 

package/dist/{index-CO-wmVvJ.d.ts → index-ChoQK2tb.d.ts}

@@ -1333,27 +1333,33 @@ declare class CodexCLIAdapter implements WorkerAdapter {
    * Build spawn command for a coding task.
    * Uses: `codex exec` with prompt delivered via stdin.
    *
-   * `--sandbox workspace-write -c approval_policy=never` is required so the
-   * non-interactive `codex exec` can actually write files. Without these, exec
-   * defaults to a read-only sandbox + an approval policy that escalates to the
-   * user — but exec has no one to approve, so file writes fail with
-   * "file change approval is not supported in exec mode" (→ create-story-no-file).
+   * `--full-auto` is Codex's documented `exec` convenience alias for
+   * `-a on-request --sandbox workspace-write` — the standard low-friction
+   * non-interactive automation mode. We use this form for three reasons:
    *
-   * Why `-c approval_policy=never` instead of `--ask-for-approval never`:
-   * `-a`/`--ask-for-approval` is a TOP-LEVEL flag in modern Codex CLI
-   * versions — it must appear BEFORE the `exec` subcommand. Placing it after
-   * `exec` errors out with `unexpected argument '--ask-for-approval' found`,
-   * which is what bit substrate v0.20.131–133. The `-c key=value` override
-   * IS a documented `exec` flag in every version (it overrides any
-   * `~/.codex/config.toml` setting via dotted-path), and `approval_policy`
-   * is the same underlying setting `-a` writes. The TOML value `never` falls
-   * back to a literal string when bare-keyword parsing fails (per Codex's
-   * own `-c` documentation), so the unquoted form is portable across shells.
+   *   1. **It parses cleanly on `exec`.** `--full-auto` is a documented
+   *      subcommand flag (`codex exec --help` lists it). The earlier substrate
+   *      attempts hit two failure modes: `--ask-for-approval` is top-level
+   *      only and errors `unexpected argument` after `exec` (v0.20.131–133),
+   *      and `-c approval_policy=never` parses but gets silently downshifted
+   *      under enterprise cloud-managed policies that disallow `Never`
+   *      (v0.20.134–135 — the operator's pv-core-harness case).
+   *   2. **`OnRequest` works with `apply_patch` in `workspace-write`.** Per
+   *      Codex source (`codex-rs/core/src/safety.rs:33-116`), `OnRequest`
+   *      falls through to `is_write_patch_constrained_to_writable_paths` and
+   *      AUTO-APPROVES `apply_patch` calls when every target path is inside
+   *      the writable roots of an active platform sandbox. So Codex writes
+   *      land in `exec` mode without any approval prompt or escalation.
+   *      `UnlessTrusted` is the only policy with the broken `TODO(ragona)`
+   *      branch that unconditionally asks for approval — we avoid it.
+   *   3. **`OnRequest` is broadly allow-listed.** Enterprise cloud policies
+   *      that disallow `Never` typically still permit `OnRequest`
+   *      (it's strictly more conservative). `--full-auto` is therefore the
+   *      form most likely to work across both unrestricted and managed Codex
+   *      installs.
    *
-   * `never` is exactly what Codex's docs recommend for non-interactive runs,
-   * and this is normal automation mode — NOT the
-   * `--dangerously-bypass-approvals-and-sandbox` flag (which some org policies
-   * forbid). The planning command stays read-only (it must not write).
+   * Not the org-blocked `--dangerously-bypass-approvals-and-sandbox` flag.
+   * The planning command stays read-only (it must not write).
    *
    * Do NOT use --json: it produces a JSONL event stream that prevents
    * extractYamlBlock from finding the structured result block in stdout.
@@ -1461,4 +1467,4 @@ interface Recommendation {
 
 //#endregion
 export { AdapterDiscoveryResult, AdapterRegistry as AdapterRegistry$1, AdtError as AdtError$1, ClaudeCodeAdapter as ClaudeCodeAdapter$1, CodexCLIAdapter as CodexCLIAdapter$1, ConfigError as ConfigError$1, ConfigIncompatibleFormatError as ConfigIncompatibleFormatError$1, CoreEvents, DatabaseAdapter, DiscoveryReport, GeminiCLIAdapter as GeminiCLIAdapter$1, Recommendation, TypedEventBus };
-//# sourceMappingURL=index-CO-wmVvJ.d.ts.map
+//# sourceMappingURL=index-ChoQK2tb.d.ts.map

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AdapterDiscoveryResult, AdapterRegistry$1 as AdapterRegistry, AdtError$1 as AdtError, ClaudeCodeAdapter$1 as ClaudeCodeAdapter, CodexCLIAdapter$1 as CodexCLIAdapter, ConfigError$1 as ConfigError, ConfigIncompatibleFormatError$1 as ConfigIncompatibleFormatError, DiscoveryReport, GeminiCLIAdapter$1 as GeminiCLIAdapter, Recommendation, TypedEventBus } from "./index-CO-wmVvJ.js";
+import { AdapterDiscoveryResult, AdapterRegistry$1 as AdapterRegistry, AdtError$1 as AdtError, ClaudeCodeAdapter$1 as ClaudeCodeAdapter, CodexCLIAdapter$1 as CodexCLIAdapter, ConfigError$1 as ConfigError, ConfigIncompatibleFormatError$1 as ConfigIncompatibleFormatError, DiscoveryReport, GeminiCLIAdapter$1 as GeminiCLIAdapter, Recommendation, TypedEventBus } from "./index-ChoQK2tb.js";
 import pino from "pino";
 import { z } from "zod";
 import { Readable, Writable } from "node:stream";

package/dist/index.js

@@ -1,8 +1,8 @@
 import { childLogger, createLogger, logger } from "./logger-KeHncl-f.js";
 import { assertDefined, createEventBus, createTuiApp, deepClone, formatDuration, generateId, isPlainObject, isTuiCapable, printNonTtyWarning, sleep, withRetry } from "./helpers-CElYrONe.js";
-import { AdapterRegistry, AdtError, ClaudeCodeAdapter, CodexCLIAdapter, ConfigError, ConfigIncompatibleFormatError, GeminiCLIAdapter } from "./dist-FYMixuGN.js";
+import { AdapterRegistry, AdtError, ClaudeCodeAdapter, CodexCLIAdapter, ConfigError, ConfigIncompatibleFormatError, GeminiCLIAdapter } from "./dist-T6ZXe2Q2.js";
 import "./adapter-registry-DIcrxjH8.js";
-import { BudgetExceededError, GitError, RecoveryError, TaskConfigError, TaskGraphCycleError, TaskGraphError, TaskGraphIncompatibleFormatError, WorkerError, WorkerNotFoundError } from "./errors-Qqm59kND.js";
+import { BudgetExceededError, GitError, RecoveryError, TaskConfigError, TaskGraphCycleError, TaskGraphError, TaskGraphIncompatibleFormatError, WorkerError, WorkerNotFoundError } from "./errors-C-9u7gCX.js";
 
 //#region src/core/di.ts
 /**

package/dist/{interactive-prompt-CHWGblJe.js → interactive-prompt-wZnuOAri.js}

@@ -1,5 +1,5 @@
 import { createLogger } from "./logger-KeHncl-f.js";
-import { readCurrentRunId, resolveMainRepoRoot } from "./manifest-read-BCnoRvTV.js";
+import { readCurrentRunId, resolveMainRepoRoot } from "./manifest-read-C84VX-CF.js";
 import { join } from "node:path";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import * as readline from "node:readline";
@@ -180,4 +180,4 @@ async function runInteractivePrompt(decisionContext) {
 
 //#endregion
 export { runInteractivePrompt };
-//# sourceMappingURL=interactive-prompt-CHWGblJe.js.map
+//# sourceMappingURL=interactive-prompt-wZnuOAri.js.map

package/dist/{manifest-read-BCnoRvTV.js → manifest-read-C84VX-CF.js}

@@ -1,5 +1,5 @@
 import { createLogger } from "./logger-KeHncl-f.js";
-import { LEARNING_FINDING, createDecision, getDecisionsByCategory } from "./dist-FYMixuGN.js";
+import { LEARNING_FINDING, createDecision, getDecisionsByCategory } from "./dist-T6ZXe2Q2.js";
 import * as path$1 from "path";
 import { join } from "path";
 import { readFile } from "fs/promises";
@@ -5851,4 +5851,4 @@ async function resolveRunManifest(dbRoot, runId) {
 
 //#endregion
 export { FindingsInjector, RunManifest, RuntimeProbeListSchema, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, readCurrentRunId, renderFindings, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck, runStaleVerificationRecovery };
-//# sourceMappingURL=manifest-read-BCnoRvTV.js.map
+//# sourceMappingURL=manifest-read-C84VX-CF.js.map

package/dist/modules/interactive-prompt/index.js

@@ -1,6 +1,6 @@
 import "../../logger-KeHncl-f.js";
-import "../../dist-FYMixuGN.js";
-import "../../manifest-read-BCnoRvTV.js";
-import { runInteractivePrompt } from "../../interactive-prompt-CHWGblJe.js";
+import "../../dist-T6ZXe2Q2.js";
+import "../../manifest-read-C84VX-CF.js";
+import { runInteractivePrompt } from "../../interactive-prompt-wZnuOAri.js";
 
 export { runInteractivePrompt };

package/dist/{routing-Bl3LFjFs.js → routing-2kbRZmr7.js}

@@ -1,4 +1,4 @@
-import { ModelRoutingConfigSchema, ProviderPolicySchema, RoutingConfigError, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, TASK_TYPE_PHASE_MAP, getModelTier, loadModelRoutingConfig } from "./dist-FYMixuGN.js";
+import { ModelRoutingConfigSchema, ProviderPolicySchema, RoutingConfigError, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, TASK_TYPE_PHASE_MAP, getModelTier, loadModelRoutingConfig } from "./dist-T6ZXe2Q2.js";
 import "./routing-DFxoKHDt.js";
 
 export { loadModelRoutingConfig };

package/dist/{run-DCcJjWhx.js → run-lBgnO-3E.js}

@@ -1,11 +1,11 @@
-import { BMAD_BASELINE_TOKENS_FULL, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, validateStoryKey } from "./health-DiT_FlpE.js";
+import { BMAD_BASELINE_TOKENS_FULL, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, validateStoryKey } from "./health-COhVUNXM.js";
 import { createLogger } from "./logger-KeHncl-f.js";
 import { TypedEventBusImpl, createEventBus, createTuiApp, isTuiCapable, printNonTtyWarning, sleep } from "./helpers-CElYrONe.js";
-import { ADVISORY_NOTES, CODEX_SANDBOX_BLOCK_HINT, Categorizer, ConsumerAnalyzer, DEFAULT_GLOBAL_SETTINGS, DispatcherImpl, DoltClient, ESCALATION_DIAGNOSIS, EXPERIMENT_RESULT, EfficiencyScorer, IngestionServer, LogTurnAnalyzer, OPERATIONAL_FINDING, Recommender, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, STORY_METRICS, STORY_OUTCOME, SubstrateConfigSchema, TEST_EXPANSION_FINDING, TEST_PLAN, TelemetryNormalizer, TelemetryPipeline, TurnAnalyzer, addTokenUsage, aggregateTokenUsageForRun, aggregateTokenUsageForStory, callLLM, classifyVersionGap, createConfigSystem, createDatabaseAdapter$1, createDecision, createPipelineRun, createRequirement, createStderrLogger, detectCodexSandboxBlock, detectInterfaceChanges, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunMetrics, getRunningPipelineRuns, getStoryMetricsForRun, getTokenUsageSummary, initSchema, listRequirements, loadModelRoutingConfig, registerArtifact, swallowDebug, updatePipelineRun, updatePipelineRunConfig, upsertDecision, writeRunMetrics, writeStoryMetrics } from "./dist-FYMixuGN.js";
-import { FindingsInjector, RunManifest, RuntimeProbeListSchema, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, renderFindings, resolveGraphPath, resolveMainRepoRoot, runAcTraceabilityCheck, runStaleVerificationRecovery } from "./manifest-read-BCnoRvTV.js";
+import { ADVISORY_NOTES, CODEX_SANDBOX_BLOCK_HINT, Categorizer, ConsumerAnalyzer, DEFAULT_GLOBAL_SETTINGS, DispatcherImpl, DoltClient, ESCALATION_DIAGNOSIS, EXPERIMENT_RESULT, EfficiencyScorer, IngestionServer, LogTurnAnalyzer, OPERATIONAL_FINDING, Recommender, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, STORY_METRICS, STORY_OUTCOME, SubstrateConfigSchema, TEST_EXPANSION_FINDING, TEST_PLAN, TelemetryNormalizer, TelemetryPipeline, TurnAnalyzer, addTokenUsage, aggregateTokenUsageForRun, aggregateTokenUsageForStory, callLLM, classifyVersionGap, createConfigSystem, createDatabaseAdapter$1, createDecision, createPipelineRun, createRequirement, createStderrLogger, detectCodexSandboxBlock, detectInterfaceChanges, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunMetrics, getRunningPipelineRuns, getStoryMetricsForRun, getTokenUsageSummary, initSchema, listRequirements, loadModelRoutingConfig, registerArtifact, swallowDebug, updatePipelineRun, updatePipelineRunConfig, upsertDecision, writeRunMetrics, writeStoryMetrics } from "./dist-T6ZXe2Q2.js";
+import { FindingsInjector, RunManifest, RuntimeProbeListSchema, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, renderFindings, resolveGraphPath, resolveMainRepoRoot, runAcTraceabilityCheck, runStaleVerificationRecovery } from "./manifest-read-C84VX-CF.js";
 import { WorkGraphRepository, detectCycles } from "./work-graph-repository-DZyJv5pV.js";
 import { deriveExitCode, routeDecision } from "./decision-router-DblHY8se.js";
-import { runInteractivePrompt } from "./interactive-prompt-CHWGblJe.js";
+import { runInteractivePrompt } from "./interactive-prompt-wZnuOAri.js";
 import { runRecoveryEngine } from "./recovery-engine-BKGBeBnW.js";
 import { basename, dirname, extname, join } from "path";
 import { access, readFile, readdir, stat } from "fs/promises";
@@ -47442,7 +47442,7 @@ async function runFullPipeline(options) {
 */
 async function emitPreDispatchVersionAdvisory(currentVersion) {
 	if (process.env["SUBSTRATE_NO_UPDATE_CHECK"] === "1") return;
-	const { createVersionManager } = await import("./version-manager-impl-CZKVyewX.js");
+	const { createVersionManager } = await import("./version-manager-impl-BLXt2ucf.js");
 	const vm = createVersionManager();
 	const result = await vm.checkForUpdates(true);
 	const gap = classifyVersionGap(currentVersion, result.latestVersion);
@@ -47539,4 +47539,4 @@ function registerRunCommand(program, version = "0.0.0", projectRoot = process.cw
 
 //#endregion
 export { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR$1 as GLOBSTAR, GitClient, GrammarLoader, Minimatch$1 as Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape$1 as escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, normalizeGraphSummaryToStatus, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runRunAction, runSolutioningPhase, unescape$1 as unescape, validateStopAfterFromConflict, wireNdjsonEmitter };
-//# sourceMappingURL=run-DCcJjWhx.js.map
+//# sourceMappingURL=run-lBgnO-3E.js.map

package/dist/{run-DBu_DjmA.js → run-rq4X93Bs.js}

@@ -1,14 +1,14 @@
-import "./health-DiT_FlpE.js";
+import "./health-COhVUNXM.js";
 import "./logger-KeHncl-f.js";
 import "./helpers-CElYrONe.js";
-import "./dist-FYMixuGN.js";
-import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, runRunAction, wireNdjsonEmitter } from "./run-DCcJjWhx.js";
-import "./manifest-read-BCnoRvTV.js";
+import "./dist-T6ZXe2Q2.js";
+import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, runRunAction, wireNdjsonEmitter } from "./run-lBgnO-3E.js";
+import "./manifest-read-C84VX-CF.js";
 import "./routing-DFxoKHDt.js";
 import "./work-graph-repository-DZyJv5pV.js";
 import "./decisions-CzSIEeGP.js";
 import "./decision-router-DblHY8se.js";
-import "./interactive-prompt-CHWGblJe.js";
+import "./interactive-prompt-wZnuOAri.js";
 import "./recovery-engine-BKGBeBnW.js";
 
 export { runRunAction };

package/dist/src/modules/recovery-engine/index.d.ts

@@ -1,4 +1,4 @@
-import { CoreEvents, DatabaseAdapter, TypedEventBus } from "../../../index-CO-wmVvJ.js";
+import { CoreEvents, DatabaseAdapter, TypedEventBus } from "../../../index-ChoQK2tb.js";
 import { z } from "zod";
 
 //#region packages/sdlc/dist/verification/findings.d.ts

package/dist/{upgrade-DWzAWGtt.js → upgrade-CZMWjtYN.js}

@@ -1,4 +1,4 @@
-import { createVersionManager } from "./dist-FYMixuGN.js";
+import { createVersionManager } from "./dist-T6ZXe2Q2.js";
 import { execSync, spawn } from "child_process";
 import * as readline from "readline";
 
@@ -123,4 +123,4 @@ function registerUpgradeCommand(program) {
 
 //#endregion
 export { isGlobalInstall, registerUpgradeCommand, runUpgradeCommand };
-//# sourceMappingURL=upgrade-DWzAWGtt.js.map
+//# sourceMappingURL=upgrade-CZMWjtYN.js.map

package/dist/{upgrade-Bq4SRZgH.js → upgrade-DjJ4uqLJ.js}

@@ -1,5 +1,5 @@
-import "./dist-FYMixuGN.js";
+import "./dist-T6ZXe2Q2.js";
 import "./version-manager-impl-qFBiO4Eh.js";
-import { isGlobalInstall, registerUpgradeCommand, runUpgradeCommand } from "./upgrade-DWzAWGtt.js";
+import { isGlobalInstall, registerUpgradeCommand, runUpgradeCommand } from "./upgrade-CZMWjtYN.js";
 
 export { isGlobalInstall, registerUpgradeCommand, runUpgradeCommand };

package/dist/{version-manager-impl-CZKVyewX.js → version-manager-impl-BLXt2ucf.js}

@@ -1,4 +1,4 @@
-import { VersionManagerImpl, createVersionManager } from "./dist-FYMixuGN.js";
+import { VersionManagerImpl, createVersionManager } from "./dist-T6ZXe2Q2.js";
 import "./version-manager-impl-qFBiO4Eh.js";
 
 export { createVersionManager };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "substrate-ai",
-  "version": "0.20.135",
+  "version": "0.20.136",
   "description": "Substrate — multi-agent orchestration daemon for AI coding agents",
   "type": "module",
   "license": "MIT",

package/dist/adapter-registry-61HN97Pb.js

@@ -1,4 +0,0 @@
-import { AdapterRegistry } from "./dist-FYMixuGN.js";
-import "./adapter-registry-DIcrxjH8.js";
-
-export { AdapterRegistry };