substrate-ai 0.20.143 → 0.20.145

package/dist/cli/index.js

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { FileKvStore, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, buildPipelineStatusOutput, createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion } from "../health-FUl73R5F.js";
+import { FileKvStore, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, buildPipelineStatusOutput, createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion } from "../health-muiK_xRZ.js";
 import { createLogger } from "../logger-KeHncl-f.js";
 import { createEventBus } from "../helpers-CElYrONe.js";
 import { AdapterRegistry, BudgetConfigSchema, CURRENT_CONFIG_FORMAT_VERSION, CURRENT_TASK_GRAPH_VERSION, ConfigError, CostTrackerConfigSchema, DEFAULT_CONFIG, DoltClient, DoltNotInstalled, GlobalSettingsSchema, InMemoryDatabaseAdapter, IngestionServer, MonitorDatabaseImpl, OPERATIONAL_FINDING, PartialGlobalSettingsSchema, PartialProviderConfigSchema, ProvidersSchema, RoutingRecommender, STORY_METRICS, TelemetryConfigSchema, addTokenUsage, aggregateTokenUsageForRun, checkDoltInstalled, compareRunMetrics, createAmendmentRun, createConfigSystem, createDecision, createPipelineRun, createStderrLogger, getActiveDecisions, getAllCostEntriesFiltered, getBaselineRunMetrics, getDecisionsByCategory, getDecisionsByPhaseForRun, getLatestCompletedRun, getLatestRun, getPipelineRunById, getPlanningCostTotal, getRetryableEscalations, getRunMetrics, getRunningPipelineRuns, getSessionCostSummary, getSessionCostSummaryFiltered, getStoryMetricsForRun, getTokenUsageSummary, incrementRunRestarts, initSchema, initWorkGraphSchema, initializeDolt, listRunMetrics, loadParentRunDecisions, supersedeDecision, swallowDebug, tagRunAsBaseline, updatePipelineRun } from "../dist-DiNK6QOD.js";
-import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR, GitClient, GrammarLoader, Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runSolutioningPhase, unescape, validateStopAfterFromConflict } from "../run-B2duge-W.js";
+import { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR, GitClient, GrammarLoader, Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runSolutioningPhase, unescape, validateStopAfterFromConflict } from "../run-DHPGxjlk.js";
 import "../adapter-registry-DIcrxjH8.js";
-import { RunManifest, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, parseRuntimeProbes, readCurrentRunId, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck } from "../manifest-read-BkijWyWk.js";
+import { RunManifest, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, parseRuntimeProbes, readCurrentRunId, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck } from "../manifest-read-CX6KKQHX.js";
 import "../errors-B21JUhcc.js";
 import "../routing-DFxoKHDt.js";
 import { WorkGraphRepository } from "../work-graph-repository-DZyJv5pV.js";
 import "../decisions-CzSIEeGP.js";
 import "../decision-router-BAPpON_C.js";
-import "../interactive-prompt-CtO5Tm6u.js";
+import "../interactive-prompt-PgHUXA-A.js";
 import "../recovery-engine-BKGBeBnW.js";
 import "../version-manager-impl-qFBiO4Eh.js";
 import { registerUpgradeCommand } from "../upgrade-DB7KzD9c.js";
@@ -7052,7 +7052,7 @@ async function runStatusAction(options) {
 			logger$15.debug({ err }, "Work graph query failed, continuing without work graph data");
 		}
 		if (run === void 0) {
-			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-CoxLvCcT.js");
+			const { inspectProcessTree: inspectProcessTree$1 } = await import("../health-Dk6gHNDC.js");
 			const substrateDirPath = join(projectRoot, ".substrate");
 			const processInfo = inspectProcessTree$1({
 				projectRoot,
@@ -8581,7 +8581,7 @@ async function runSupervisorAction(options, deps = {}) {
 								await initSchema(expAdapter);
 								const { runRunAction: runPipeline } = await import(
 									/* @vite-ignore */
-									"../run-DRwOPt3k.js"
+									"../run-C0uq3ETL.js"
 );
 								const runStoryFn = async (opts) => {
 									const exitCode = await runPipeline({

package/dist/{health-CoxLvCcT.js → health-Dk6gHNDC.js}

@@ -1,7 +1,7 @@
-import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-FUl73R5F.js";
+import { DEFAULT_STALL_THRESHOLD_SECONDS, getAllDescendantPids, getAutoHealthData, inspectProcessTree, isOrchestratorProcessLine, registerHealthCommand, runHealthAction } from "./health-muiK_xRZ.js";
 import "./logger-KeHncl-f.js";
 import "./dist-DiNK6QOD.js";
-import "./manifest-read-BkijWyWk.js";
+import "./manifest-read-CX6KKQHX.js";
 import "./work-graph-repository-DZyJv5pV.js";
 import "./decisions-CzSIEeGP.js";
 

package/dist/{health-FUl73R5F.js → health-muiK_xRZ.js}

@@ -1,6 +1,6 @@
 import { createLogger } from "./logger-KeHncl-f.js";
 import { DoltClient, DoltQueryError, createDatabaseAdapter$1 as createDatabaseAdapter, getLatestRun, getPipelineRunById, initSchema } from "./dist-DiNK6QOD.js";
-import { resolveMainRepoRoot, resolveRunManifest } from "./manifest-read-BkijWyWk.js";
+import { resolveMainRepoRoot, resolveRunManifest } from "./manifest-read-CX6KKQHX.js";
 import { createRequire } from "module";
 import { dirname, join } from "path";
 import { existsSync, readFileSync } from "node:fs";
@@ -1000,4 +1000,4 @@ function registerHealthCommand(program, _version = "0.0.0", projectRoot = proces
 
 //#endregion
 export { BMAD_BASELINE_TOKENS_FULL, DEFAULT_STALL_THRESHOLD_SECONDS, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, SUBSTRATE_OWNED_SETTINGS_KEYS, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter$1 as createDatabaseAdapter, createDoltOperatorReader, findPackageRoot, formatOutput, formatPipelineStatusHuman, formatPipelineSummary, formatTokenTelemetry, getAllDescendantPids, getAutoHealthData, getSubstrateDefaultSettings, inspectProcessTree, isOrchestratorProcessLine, parseDbTimestampAsUtc, registerHealthCommand, resolveBmadMethodSrcPath, resolveBmadMethodVersion, runHealthAction, validateStoryKey };
-//# sourceMappingURL=health-FUl73R5F.js.map
+//# sourceMappingURL=health-muiK_xRZ.js.map

package/dist/{interactive-prompt-CtO5Tm6u.js → interactive-prompt-PgHUXA-A.js}

@@ -1,5 +1,5 @@
 import { createLogger } from "./logger-KeHncl-f.js";
-import { readCurrentRunId, resolveMainRepoRoot } from "./manifest-read-BkijWyWk.js";
+import { readCurrentRunId, resolveMainRepoRoot } from "./manifest-read-CX6KKQHX.js";
 import { join } from "node:path";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import * as readline from "node:readline";
@@ -180,4 +180,4 @@ async function runInteractivePrompt(decisionContext) {
 
 //#endregion
 export { runInteractivePrompt };
-//# sourceMappingURL=interactive-prompt-CtO5Tm6u.js.map
+//# sourceMappingURL=interactive-prompt-PgHUXA-A.js.map

package/dist/{manifest-read-BkijWyWk.js → manifest-read-CX6KKQHX.js}

@@ -1737,6 +1737,16 @@ function extractAcceptanceCriteriaIds(storyContent) {
 				if (id !== void 0) ids.add(id);
 			}
 		}
+		if (ids.size === 0) {
+			const lines = acceptanceSection.split(/\r?\n/);
+			const scenarioHeadings = lines.filter((l) => /^\s*(?:#+\s*)?(?:\*\*)?Scenario\b/i.test(l)).length;
+			let scenarioCount = scenarioHeadings;
+			if (scenarioCount === 0) scenarioCount = lines.filter((l) => /^\s*(?:\*\*)?Given\b/i.test(l)).length;
+			for (let i = 1; i <= scenarioCount; i++) {
+				const id = normalizeAcId(String(i));
+				if (id !== void 0) ids.add(id);
+			}
+		}
 	}
 	return sortAcIds(ids);
 }
@@ -1783,7 +1793,7 @@ var AcceptanceCriteriaEvidenceCheck = class {
 			const findings = [{
 				category: "ac-context-missing",
 				severity: "warn",
-				message: "no numbered acceptance criteria found in story"
+				message: "no acceptance criteria could be extracted from the story (numbered, AC-ref, bullet, and Gherkin scenario forms all matched nothing) — AC-EVIDENCE ENFORCEMENT IS SKIPPED for this story. If the story genuinely has ACs, their format is unrecognized; number them (1. / AC1) or use Given/When/Then scenarios."
 			}];
 			return {
 				status: "warn",
@@ -2345,6 +2355,11 @@ var TestSuiteCheck = class {
 						stderrTail: tail$1(stderr),
 						durationMs: duration
 					}];
+					if (context.devStoryResult?.tests === "pass") findings.push({
+						category: "tests-claim-mismatch",
+						severity: "error",
+						message: `dev-story self-reported tests: pass, but the real suite failed (exit ${String(code)}) — the claim is contradicted by ground truth`
+					});
 					resolve$2({
 						status: "fail",
 						details: renderFindings(findings),
@@ -2357,6 +2372,204 @@ var TestSuiteCheck = class {
 	}
 };
 
+//#endregion
+//#region packages/sdlc/dist/verification/checks/contamination-check.js
+/** Map of language → source extensions used for foreign-language detection. */
+const LANGUAGE_EXTENSIONS = {
+	typescript: [
+		".ts",
+		".tsx",
+		".mts",
+		".cts"
+	],
+	javascript: [
+		".js",
+		".jsx",
+		".mjs",
+		".cjs"
+	],
+	python: [".py"],
+	go: [".go"],
+	rust: [".rs"],
+	java: [".java"],
+	kotlin: [".kt", ".kts"]
+};
+/** JS-family toolchain manifests whose appearance flips build detection. */
+const JS_TOOLCHAIN_MANIFESTS = [
+	"package.json",
+	"tsconfig.json",
+	"package-lock.json",
+	"pnpm-lock.yaml",
+	"yarn.lock",
+	"bun.lockb",
+	"vite.config.ts",
+	"vite.config.js"
+];
+/** Droppings that must never appear in a story diff, regardless of language. */
+const ALWAYS_DENY_SEGMENTS = [
+	"node_modules",
+	".venv",
+	"__pycache__"
+];
+/**
+* Collect every `language: <x>` declaration in the profile (single-project
+* `project.language` plus monorepo `packages[].language`). Line-based parse —
+* no yaml dependency. Returns [] when the profile is absent/unreadable.
+*/
+function readProfileLanguages(workingDir) {
+	const profilePath = join$1(workingDir, ".substrate", "project-profile.yaml");
+	if (!existsSync(profilePath)) return [];
+	try {
+		const content = readFileSync(profilePath, "utf-8");
+		const langs = new Set();
+		for (const m of content.matchAll(/^\s*(?:-\s+)?language:\s*['"]?([a-z]+)['"]?\s*$/gm)) if (m[1] !== void 0) langs.add(m[1]);
+		return [...langs];
+	} catch {
+		return [];
+	}
+}
+/** Language of a file per LANGUAGE_EXTENSIONS, or undefined for neutral files. */
+function fileLanguage(file) {
+	const lower = file.toLowerCase();
+	for (const [lang, exts] of Object.entries(LANGUAGE_EXTENSIONS)) if (exts.some((e) => lower.endsWith(e))) return lang;
+	return void 0;
+}
+/**
+* Pure classification of a changed-file list against the project's declared
+* languages. Exported for unit testing.
+*/
+function classifyContamination(changedFiles, allowedLanguages) {
+	const allowJs = allowedLanguages.includes("typescript") || allowedLanguages.includes("javascript");
+	const foreignSourceFiles = [];
+	const foreignToolchainManifests = [];
+	const droppings = [];
+	for (const raw of changedFiles) {
+		const file = raw.replace(/\\/g, "/").replace(/^\.\//, "");
+		const segments = file.split("/");
+		if (segments.some((s) => ALWAYS_DENY_SEGMENTS.includes(s))) {
+			droppings.push(file);
+			continue;
+		}
+		if (!allowJs && segments.includes("dist")) {
+			droppings.push(file);
+			continue;
+		}
+		const base = segments[segments.length - 1] ?? "";
+		if (!allowJs && JS_TOOLCHAIN_MANIFESTS.includes(base)) {
+			foreignToolchainManifests.push(file);
+			continue;
+		}
+		const lang = fileLanguage(file);
+		if (lang !== void 0 && !allowedLanguages.includes(lang)) {
+			if (allowJs && (lang === "typescript" || lang === "javascript")) continue;
+			foreignSourceFiles.push({
+				file,
+				language: lang
+			});
+		}
+	}
+	return {
+		foreignSourceFiles,
+		foreignToolchainManifests,
+		droppings
+	};
+}
+var ContaminationCheck = class {
+	name = "scope-contamination";
+	tier = "A";
+	async run(context) {
+		const start = Date.now();
+		const changedFiles = context.changedFiles ?? [];
+		if (changedFiles.length === 0) return {
+			status: "pass",
+			details: "no changed files to inspect",
+			duration_ms: Date.now() - start,
+			findings: []
+		};
+		const allowedLanguages = readProfileLanguages(context.workingDir);
+		if (allowedLanguages.length === 0) {
+			const findings$1 = [{
+				category: "contamination-skip",
+				severity: "warn",
+				message: `no project profile with declared languages at ${context.workingDir} — cannot check for foreign-toolchain contamination (run substrate init to generate one)`
+			}];
+			return {
+				status: "warn",
+				details: renderFindings(findings$1),
+				duration_ms: Date.now() - start,
+				findings: findings$1
+			};
+		}
+		const verdict = classifyContamination(changedFiles, allowedLanguages);
+		const findings = [];
+		if (verdict.droppings.length > 0) findings.push({
+			category: "contamination-droppings",
+			severity: "error",
+			message: `story diff contains build/dependency droppings that must never be committed: ${verdict.droppings.slice(0, 10).join(", ")}` + (verdict.droppings.length > 10 ? ` (+${String(verdict.droppings.length - 10)} more)` : "")
+		});
+		if (verdict.foreignToolchainManifests.length > 0) findings.push({
+			category: "contamination-toolchain",
+			severity: "error",
+			message: `story introduces a JS toolchain on a ${allowedLanguages.join("/")} project: ${verdict.foreignToolchainManifests.join(", ")}. This is the exact trigger that flips build detection to npm and masks real story outcomes (field finding #12).`
+		});
+		if (verdict.foreignSourceFiles.length > 0) findings.push({
+			category: "contamination-language",
+			severity: "error",
+			message: `story writes source files in language(s) the project does not use (declared: ${allowedLanguages.join(", ")}): ` + verdict.foreignSourceFiles.slice(0, 10).map((f) => `${f.file} [${f.language}]`).join(", ")
+		});
+		if (findings.length === 0) return {
+			status: "pass",
+			details: `no contamination across ${String(changedFiles.length)} changed file(s)`,
+			duration_ms: Date.now() - start,
+			findings: []
+		};
+		return {
+			status: "fail",
+			details: renderFindings(findings),
+			duration_ms: Date.now() - start,
+			findings
+		};
+	}
+};
+
+//#endregion
+//#region packages/sdlc/dist/verification/checks/test-mutation-check.js
+/** Heuristic: is this path a test file? Covers the JS/TS/Python/Go idioms. */
+function isTestPath(file) {
+	const norm = file.replace(/\\/g, "/").toLowerCase();
+	const base = norm.split("/").pop() ?? "";
+	if (/(^|\/)(__tests__|tests?)\//.test(norm)) return true;
+	if (/\.(test|spec)\.[a-z]+$/.test(base)) return true;
+	if (/^test_.*\.py$/.test(base) || /_test\.(py|go)$/.test(base)) return true;
+	return false;
+}
+var TestMutationCheck = class {
+	name = "test-mutation";
+	tier = "A";
+	async run(context) {
+		const start = Date.now();
+		const modified = context.modifiedTrackedFiles ?? [];
+		const mutatedTests = modified.filter(isTestPath);
+		if (mutatedTests.length === 0) return {
+			status: "pass",
+			details: "no pre-existing test files were modified",
+			duration_ms: Date.now() - start,
+			findings: []
+		};
+		const findings = [{
+			category: "test-mutation",
+			severity: "warn",
+			message: `story MODIFIED ${String(mutatedTests.length)} pre-existing test file(s): ${mutatedTests.slice(0, 10).join(", ")}` + (mutatedTests.length > 10 ? ` (+${String(mutatedTests.length - 10)} more)` : "") + ". Editing existing tests to satisfy a suite is the measured reward-hack pattern — review whether these edits weaken assertions the story was supposed to satisfy."
+		}];
+		return {
+			status: "warn",
+			details: renderFindings(findings),
+			duration_ms: Date.now() - start,
+			findings
+		};
+	}
+};
+
 //#endregion
 //#region packages/sdlc/dist/verification/probes/types.js
 /**
@@ -3846,7 +4059,7 @@ var SourceAcFidelityCheck = class {
 					}
 				}
 				const existsInCode = pathSatisfiedByCode(context.workingDir, clause.text);
-				const modifiedFiles = context.devStoryResult?.files_modified ?? [];
+				const modifiedFiles = context.changedFiles !== void 0 && context.changedFiles.length > 0 ? context.changedFiles : context.devStoryResult?.files_modified ?? [];
 				const referencedByStory = pathReferencedInModifiedFiles(context.workingDir, clause.text, modifiedFiles);
 				let severity;
 				let driftMessage;
@@ -4292,6 +4505,8 @@ function createDefaultVerificationPipeline(bus, config) {
 		new AcceptanceCriteriaEvidenceCheck(),
 		new BuildCheck(),
 		new TestSuiteCheck(),
+		new ContaminationCheck(),
+		new TestMutationCheck(),
 		new RuntimeProbeCheck(),
 		new SourceAcFidelityCheck(),
 		new SourceAcShelloutCheck(),
@@ -6075,4 +6290,4 @@ async function resolveRunManifest(dbRoot, runId) {
 
 //#endregion
 export { FindingsInjector, RunManifest, RuntimeProbeListSchema, SupervisorLock, ZERO_FINDINGS_BY_AUTHOR, ZERO_FINDING_COUNTS, ZERO_PROBE_AUTHOR_METRICS, aggregateProbeAuthorMetrics, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, readCurrentRunId, renderFindings, resolveGraphPath, resolveMainRepoRoot, resolveRunManifest, rollupFindingCounts, rollupFindingsByAuthor, rollupProbeAuthorByClass, rollupProbeAuthorMetrics, runAcTraceabilityCheck, runStaleVerificationRecovery };
-//# sourceMappingURL=manifest-read-BkijWyWk.js.map
+//# sourceMappingURL=manifest-read-CX6KKQHX.js.map

package/dist/modules/interactive-prompt/index.js

@@ -1,6 +1,6 @@
 import "../../logger-KeHncl-f.js";
 import "../../dist-DiNK6QOD.js";
-import "../../manifest-read-BkijWyWk.js";
-import { runInteractivePrompt } from "../../interactive-prompt-CtO5Tm6u.js";
+import "../../manifest-read-CX6KKQHX.js";
+import { runInteractivePrompt } from "../../interactive-prompt-PgHUXA-A.js";
 
 export { runInteractivePrompt };

package/dist/{run-DRwOPt3k.js → run-C0uq3ETL.js}

@@ -1,14 +1,14 @@
-import "./health-FUl73R5F.js";
+import "./health-muiK_xRZ.js";
 import "./logger-KeHncl-f.js";
 import "./helpers-CElYrONe.js";
 import "./dist-DiNK6QOD.js";
-import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, runRunAction, wireNdjsonEmitter } from "./run-B2duge-W.js";
-import "./manifest-read-BkijWyWk.js";
+import { normalizeGraphSummaryToStatus, registerRunCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, runRunAction, wireNdjsonEmitter } from "./run-DHPGxjlk.js";
+import "./manifest-read-CX6KKQHX.js";
 import "./routing-DFxoKHDt.js";
 import "./work-graph-repository-DZyJv5pV.js";
 import "./decisions-CzSIEeGP.js";
 import "./decision-router-BAPpON_C.js";
-import "./interactive-prompt-CtO5Tm6u.js";
+import "./interactive-prompt-PgHUXA-A.js";
 import "./recovery-engine-BKGBeBnW.js";
 
 export { runRunAction };

package/dist/{run-B2duge-W.js → run-DHPGxjlk.js}

@@ -1,11 +1,11 @@
-import { BMAD_BASELINE_TOKENS_FULL, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, validateStoryKey } from "./health-FUl73R5F.js";
+import { BMAD_BASELINE_TOKENS_FULL, FileKvStore, STOP_AFTER_VALID_PHASES, STORY_KEY_PATTERN, VALID_PHASES, __commonJS, __require, __toESM, buildPipelineStatusOutput, createDatabaseAdapter, formatOutput, formatPipelineSummary, formatTokenTelemetry, inspectProcessTree, parseDbTimestampAsUtc, validateStoryKey } from "./health-muiK_xRZ.js";
 import { createLogger } from "./logger-KeHncl-f.js";
 import { TypedEventBusImpl, createEventBus, createTuiApp, isTuiCapable, printNonTtyWarning, sleep } from "./helpers-CElYrONe.js";
 import { ADVISORY_NOTES, CLAUDE_AUTH_FAILURE_HINT, CODEX_SANDBOX_BLOCK_HINT, Categorizer, ConsumerAnalyzer, DEFAULT_GLOBAL_SETTINGS, DispatcherImpl, DoltClient, ESCALATION_DIAGNOSIS, EXPERIMENT_RESULT, EfficiencyScorer, IngestionServer, LogTurnAnalyzer, OPERATIONAL_FINDING, Recommender, RoutingRecommender, RoutingResolver, RoutingTelemetry, RoutingTokenAccumulator, RoutingTuner, STORY_METRICS, STORY_OUTCOME, SubstrateConfigSchema, TEST_EXPANSION_FINDING, TEST_PLAN, TelemetryNormalizer, TelemetryPipeline, TurnAnalyzer, addTokenUsage, aggregateTokenUsageForRun, aggregateTokenUsageForStory, callLLM, classifyVersionGap, createConfigSystem, createDatabaseAdapter$1, createDecision, createPipelineRun, createRequirement, createStderrLogger, detectClaudeAuthFailure, detectCodexSandboxBlock, detectInterfaceChanges, getArtifactByTypeForRun, getArtifactsByRun, getDecisionsByCategory, getDecisionsByPhase, getDecisionsByPhaseForRun, getLatestRun, getPipelineRunById, getRunMetrics, getRunningPipelineRuns, getStoryMetricsForRun, getTokenUsageSummary, initSchema, listRequirements, loadModelRoutingConfig, registerArtifact, swallowDebug, updatePipelineRun, updatePipelineRunConfig, upsertDecision, writeRunMetrics, writeStoryMetrics } from "./dist-DiNK6QOD.js";
-import { FindingsInjector, RunManifest, RuntimeProbeListSchema, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, renderFindings, resolveGraphPath, resolveMainRepoRoot, runAcTraceabilityCheck, runStaleVerificationRecovery } from "./manifest-read-BkijWyWk.js";
+import { FindingsInjector, RunManifest, RuntimeProbeListSchema, applyConfigToGraph, createDefaultVerificationPipeline, createGraphOrchestrator, createSdlcCodeReviewHandler, createSdlcCreateStoryHandler, createSdlcDevStoryHandler, createSdlcPhaseHandler, detectsEventDrivenAC, detectsStateIntegratingAC, extractTargetFilesFromStoryContent, parseRuntimeProbes, renderFindings, resolveGraphPath, resolveMainRepoRoot, runAcTraceabilityCheck, runStaleVerificationRecovery } from "./manifest-read-CX6KKQHX.js";
 import { WorkGraphRepository, detectCycles } from "./work-graph-repository-DZyJv5pV.js";
 import { deriveExitCode, routeDecision } from "./decision-router-BAPpON_C.js";
-import { runInteractivePrompt } from "./interactive-prompt-CtO5Tm6u.js";
+import { runInteractivePrompt } from "./interactive-prompt-PgHUXA-A.js";
 import { runRecoveryEngine } from "./recovery-engine-BKGBeBnW.js";
 import { basename, dirname, extname, join } from "path";
 import { access, readFile, readdir, stat } from "fs/promises";
@@ -5999,6 +5999,43 @@ function runBuildVerification(options) {
 * @param workingDir - Directory to run git commands in (defaults to process.cwd())
 * @returns Array of changed file paths; empty when nothing changed
 */
+/**
+* H1.7 (hardening program): the PRE-EXISTING files this story modified or
+* deleted — the tracked-diff portion of the working-tree change (unstaged
+* HEAD diff + staged), deliberately EXCLUDING untracked/new files. A tracked
+* file in this list existed before the dispatch; new tests the story wrote
+* never appear here. Feeds the reward-hack tripwire (agents editing existing
+* tests to go green — the measured exploit pattern).
+*/
+function checkGitModifiedTrackedFiles(workingDir = process.cwd()) {
+	const results = new Set();
+	try {
+		execSync("git rev-parse --verify HEAD", {
+			cwd: workingDir,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			timeout: 3e3
+		});
+	} catch {
+		return [];
+	}
+	for (const args of ["git diff --name-only HEAD", "git diff --cached --name-only"]) try {
+		execSync(args, {
+			cwd: workingDir,
+			encoding: "utf-8",
+			timeout: 5e3,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		}).split("\n").map((l) => l.trim()).filter((l) => l.length > 0).forEach((f$1) => results.add(f$1));
+	} catch {}
+	return [...results];
+}
 function checkGitDiffFiles(workingDir = process.cwd()) {
 	const results = new Set();
 	let repoHasCommits = true;
@@ -7542,6 +7579,12 @@ const logger$20 = createLogger("compiled-workflows:git-helpers");
 * @returns Structured result for the orchestrator to inspect
 */
 async function commitDevStoryOutput(storyKey, storyTitle, filesModified, workingDir) {
+	const COMMIT_DENY_SEGMENTS = [
+		"node_modules",
+		".venv",
+		"__pycache__",
+		".substrate-worktrees"
+	];
 	const insideWorktree = [];
 	for (const p of filesModified) {
 		const abs = isAbsolute(p) ? p : resolve$1(workingDir, p);
@@ -7554,6 +7597,14 @@ async function commitDevStoryOutput(storyKey, storyTitle, filesModified, working
 			}, "commitDevStoryOutput: filtered out path outside worktree");
 			continue;
 		}
+		const segments = rel.replace(/\\/g, "/").split("/");
+		if (segments.some((s$1) => COMMIT_DENY_SEGMENTS.includes(s$1))) {
+			logger$20.warn({
+				path: rel,
+				storyKey
+			}, "commitDevStoryOutput: denylisted dependency/artifact path excluded from substrate commit");
+			continue;
+		}
 		insideWorktree.push(rel);
 	}
 	if (insideWorktree.length === 0) return {
@@ -12619,6 +12670,8 @@ function assembleVerificationContext(opts) {
 		outputTokenCount: opts.outputTokenCount,
 		sourceEpicContent: opts.sourceEpicContent,
 		runId: opts.runId,
+		...opts.changedFiles !== void 0 ? { changedFiles: opts.changedFiles } : {},
+		...opts.modifiedTrackedFiles !== void 0 ? { modifiedTrackedFiles: opts.modifiedTrackedFiles } : {},
 		...profileBuildCommand !== void 0 ? { buildCommand: profileBuildCommand } : {},
 		...profileTestCommand !== void 0 ? { testCommand: profileTestCommand } : {}
 	};
@@ -14714,6 +14767,33 @@ function createImplementationOrchestrator(deps) {
 					await persistState();
 					return;
 				}
+				if (effectiveProjectRoot !== void 0 && effectiveProjectRoot !== projectRoot && isAbsolute(createResult.story_file)) {
+					const relToWorktree = relative(effectiveProjectRoot, createResult.story_file);
+					const outsideWorktree = relToWorktree.startsWith("..") || isAbsolute(relToWorktree);
+					if (outsideWorktree) {
+						const errMsg = `create-story wrote its artifact OUTSIDE the story worktree: ${createResult.story_file} (worktree: ${effectiveProjectRoot}). The agent escaped its working directory — this is the parent/home-directory write-leak class (field finding #15). The stray file was NOT adopted; inspect and remove it.`;
+						logger$27.error({
+							storyKey,
+							storyFile: createResult.story_file,
+							worktree: effectiveProjectRoot
+						}, "create-story artifact outside worktree — escalating");
+						updateStory(storyKey, {
+							phase: "ESCALATED",
+							error: "create-story-outside-project",
+							completedAt: new Date().toISOString()
+						});
+						await writeStoryMetricsBestEffort(storyKey, "escalated", 0);
+						await emitEscalation({
+							storyKey,
+							lastVerdict: "create-story-outside-project",
+							reviewCycles: 0,
+							issues: [errMsg],
+							escalationReason: "create-story-outside-project"
+						});
+						await persistState();
+						return;
+					}
+				}
 				if (effectiveProjectRoot !== void 0) {
 					const expectedArtifactsDir = join$1(effectiveProjectRoot, "_bmad-output", "implementation-artifacts");
 					const escapedExpectedDir = expectedArtifactsDir.replace("/_bmad-output/", "/\\_bmad-output/");
@@ -15660,8 +15740,14 @@ function createImplementationOrchestrator(deps) {
 			return;
 		}
 		let gitDiffFiles;
+		let modifiedTrackedFiles;
 		if (devStoryWasSuccess) {
 			gitDiffFiles = checkGitDiffFiles(effectiveProjectRoot ?? process.cwd());
+			try {
+				modifiedTrackedFiles = checkGitModifiedTrackedFiles(effectiveProjectRoot ?? process.cwd());
+			} catch {
+				modifiedTrackedFiles = void 0;
+			}
 			if (gitDiffFiles.length === 0) {
 				let hasNewCommits = false;
 				if (baselineHeadSha) try {
@@ -16109,6 +16195,8 @@ function createImplementationOrchestrator(deps) {
 					devStoryResult: devStorySignals,
 					outputTokenCount: devOutputTokenCount,
 					sourceEpicContent,
+					...gitDiffFiles !== void 0 ? { changedFiles: gitDiffFiles } : {},
+					...modifiedTrackedFiles !== void 0 ? { modifiedTrackedFiles } : {},
 					runId: config.pipelineRunId
 				});
 				const verifSummary = await verificationPipeline.run(verifContext, "A");
@@ -48121,4 +48209,4 @@ function registerRunCommand(program, version = "0.0.0", projectRoot = process.cw
 
 //#endregion
 export { AdapterTelemetryPersistence, AppError, DoltRepoMapMetaRepository, DoltSymbolRepository, ERR_REPO_MAP_STORAGE_WRITE, EpicIngester, GLOBSTAR$1 as GLOBSTAR, GitClient, GrammarLoader, Minimatch$1 as Minimatch, Minipass, RepoMapInjector, RepoMapModule, RepoMapQueryEngine, RepoMapStorage, SymbolParser, createContextCompiler, createDispatcher, createEventEmitter, createGitWorktreeManager, createImplementationOrchestrator, createPackLoader, createPhaseOrchestrator, createStopAfterGate, createTelemetryAdvisor, escape$1 as escape, formatPhaseCompletionSummary, getFactoryRunSummaries, getScenarioResultsForRun, getTwinRunsForRun, listGraphRuns, normalizeGraphSummaryToStatus, registerExportCommand, registerFactoryCommand, registerRunCommand, registerScenariosCommand, resolveMaxReviewCycles, resolveProbeAuthorStateIntegrating, resolveStoryKeys, runAnalysisPhase, runPlanningPhase, runProbeAuthor, runRunAction, runSolutioningPhase, unescape$1 as unescape, validateStopAfterFromConflict, wireNdjsonEmitter };
-//# sourceMappingURL=run-B2duge-W.js.map
+//# sourceMappingURL=run-DHPGxjlk.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "substrate-ai",
-  "version": "0.20.143",
+  "version": "0.20.145",
   "description": "Substrate — multi-agent orchestration daemon for AI coding agents",
   "type": "module",
   "license": "MIT",