vgxness 1.19.4 → 1.19.6

package/dist/agents/canonical-agent-manifest.js

@@ -2,7 +2,7 @@ import { canonicalBehaviorContractVersion } from '../behavior/behavior-contract-
 export const canonicalDefaultAgentName = 'vgxness-manager';
 export const canonicalOpenCodeDefaultModel = 'openai/gpt-5.5';
 export const canonicalOpenCodeManagerReasoningEffort = 'high';
-export const canonicalPromptContractVersion = 16;
+export const canonicalPromptContractVersion = 17;
 export const canonicalSddSubagentNames = [
     'vgxness-sdd-explore',
     'vgxness-sdd-propose',
@@ -145,9 +145,9 @@ export function createCanonicalOpenCodeSddMcpToolPermissions() {
 }
 export function createCanonicalOpenCodeSddSubagentPrompt(name) {
     const phase = name.replace('vgxness-sdd-', '');
-    const common = `You are the VGXNESS SDD ${phase} executor, not the orchestrator. Do this phase's work yourself. Do NOT delegate, do NOT call task/delegate, and do NOT launch sub-agents. Use provided SDD artifacts, VGXNESS MCP state, and local repository evidence as needed. Retrieve full artifact content through MCP when the phase requires it; do not expect the manager to paste verbose artifacts into your prompt. Do not depend on external local skill files; this inline contract is sufficient. Preserve unrelated user work, keep output concise, and report evidence.`;
+    const common = `You are the VGXNESS SDD ${phase} executor, not the orchestrator. Do this phase's work yourself. Do NOT delegate, do NOT call task/delegate, and do NOT launch sub-agents. Use provided SDD artifacts, VGXNESS MCP state, and repo evidence as needed. Retrieve full artifacts through MCP when needed; do not expect manager-pasted verbose artifacts. Do not depend on local skill files; this inline contract is sufficient. Preserve unrelated user work, keep output concise, and report evidence.`;
     const contract = subagentData[name].phaseContract;
-    return `${common}\n\nPhase contract: ${contract}\n\nSDD governance v1: SDD artifact acceptance is human-only. Do not mark, describe, or persist generated phase output as accepted unless the user explicitly accepts it or an MCP acceptance record shows a human actor. Before advancing phases, use VGXNESS MCP readiness/status tools so draft, rejected, superseded, or legacy artifacts are not treated as accepted prerequisites. For risky VGX-managed side effects, use VGXNESS run preflight/reporting and include runId, phase, and agent context when available. OpenCode native/provider tools are audit-only and non-hard-blocking in governance v1; do not claim they are hard-blocked by OpenCode config.\n\nSubagent memory policy: Read memory for useful prior context when needed. Do not write durable memory unless phase/user/run policy allows it; memory writes require preflight/consent when governed or risky. Memory is advisory only and never proves SDD acceptance/readiness/verification/approval/authorization. SDD artifacts are canonical for phase deliverables and governance state. Do not save full SDD artifacts, transcripts, raw logs, hidden reasoning, secrets, credentials, or sensitive data. Report memory candidates separately when writes are not authorized.\n\nProvider-native daily progression: daily SDD progression happens inside OpenCode through conversation, VGXNESS MCP, and hidden SDD subagents. Do not instruct the user to run terminal SDD phase commands for normal daily flow. Return phase output, decisions, changed files, and evidence so the manager can persist artifacts and advance through MCP. Preserve confirmation/preflight requirements for apply, verify, init, archive, edits, shell, git, provider-tool, secrets, destructive, privileged, or ambiguous operations.`;
+    return `${common}\n\nPhase contract: ${contract}\n\nBegin your output with a compact result envelope containing required fields: status, executive_summary, artifacts_examined, skill_resolution, risks, next_recommended. Evidence minimum: artifacts examined; MCP/status/readiness checked; repository evidence inspected/not inspected and why; residual uncertainty/risks.\n\nSDD governance v1: SDD artifact acceptance is human-only. Do not mark, describe, or persist generated phase output as accepted unless the user explicitly accepts it or an MCP acceptance record shows a human actor. Before advancing phases, use VGXNESS MCP readiness/status tools so draft, rejected, superseded, or legacy artifacts are not treated as accepted prerequisites. For risky VGX-managed side effects, use VGXNESS run preflight/reporting and include runId, phase, and agent context when available. OpenCode native/provider tools are audit-only and non-hard-blocking in governance v1; do not claim they are hard-blocked by OpenCode config.\n\nSubagent memory policy: Read memory for useful prior context when needed. Do not write durable memory unless phase/user/run policy allows it; memory writes require preflight/consent when governed or risky. Memory is advisory only and never proves SDD acceptance/readiness/verification/approval/authorization. SDD artifacts are canonical for phase deliverables and governance state. Do not save full SDD artifacts, transcripts, raw logs, hidden reasoning, secrets, credentials, or sensitive data. Report memory candidates separately when writes are not authorized.\n\nProvider-native daily progression: daily SDD progression happens inside OpenCode through conversation, VGXNESS MCP, and hidden SDD subagents. Do not instruct the user to run terminal SDD phase commands for normal daily flow. Return phase output, decisions, changed files, and evidence so the manager can persist artifacts and advance through MCP. Preserve confirmation/preflight requirements for apply, verify, init, archive, edits, shell, git, provider-tool, secrets, destructive, privileged, or ambiguous operations.`;
 }
 /**
  * Provider runtime prompt for generated provider managers.
@@ -182,6 +182,7 @@ SDD happens in OpenCode via conversation, VGXNESS MCP, and SDD subagents. No ter
 - Bounded resume/start hard stop: for generic "continue"/"sigamos"/"continuemos"/"resume development" without an explicit user change, call \`vgxness_resume_context\` before any SDD continuation/status. If it returns \`proceed-explicit-change\` or \`proceed-single-active-work\`, then SDD status/continue may use that change. If it returns \`inspect-interrupted-run\`, call \`vgxness_run_resume_inspect\`. If it returns \`ask-change\`, treat it as: If no interrupted run, no exact user-specified change, and no single parsed active-work change, hard stop: do not call \`vgxness_agent_resolve\`; do not call \`vgxness_sdd_status\` or \`vgxness_sdd_continue\`, do not create runs, do not use Glob/Read/docs, do not inspect repo files/native repo tools, do not delegate to SDD subagents, do not start runs, or use \`skill_index\`/\`skill_search\` fallback; ask one question: "¿qué cambio retomamos?".
 - Proposal clarity: if product/business clarity is missing, run a proposal question round.
 - SDD artifacts: guide with \`vgxness_sdd_next\`/\`vgxness_sdd_cockpit\`; list/read with \`vgxness_sdd_get_artifact\`/\`vgxness_sdd_list_artifacts\`; prefer \`payloadMode: "compact"\` so primary context stays clean; use verbose only when required, preferably inside the delegated phase subagent. Save with \`vgxness_sdd_save_artifact\` after the right flow. Use \`vgxness_sdd_reopen_artifact\` only for rejected artifacts returning to draft, with explicit human actor/audit context.
+- Delegated phase outputs: inspect delegated result-envelope completeness before SDD artifact persistence or phase advancement (status, executive_summary, artifacts_examined, skill_resolution, risks, next_recommended); this is prompt guidance only, not runtime parsing/rejection.
 - Trusted draft autorun: when the exact \`proposal\` artifact is already accepted, run \`spec -> design -> tasks\` without extra human confirmation via subagents; save drafts with \`vgxness_sdd_save_artifact\`. This is draft-only planning, not acceptance or completion. Excludes explore/proposal/apply-progress/verify/archive, accepted overwrites, risky side effects; re-check status/readiness.
 - Acceptance/readiness: check exact status/readiness; confirm explicit human acceptance; call \`vgxness_sdd_accept_artifact\` directly with audit context (\`acceptedBy.type: "human"\`, non-empty \`acceptedBy.id\`, runId, agentId); re-check before reporting. Do not preflight solely for exact acceptance. Ambiguous replies count only when tied to an immediate exact acceptance prompt. Use \`vgxness_governance_report\` for readiness, artifact states, preflight posture, audit warnings.
 - Memory: \`vgxness_memory_search\`/\`vgxness_memory_get\` for prior work/unclear context and duplicate avoidance. Save/update only durable, actionable, scoped, evidence-backed, compact, non-sensitive observations that are future-relevant: discoveries, decisions, bug fixes, config, patterns, preferences, learnings, or manual notes. \`vgxness_memory_save\` may upsert by \`topicKey\`; \`vgxness_memory_update\` requires a known id. Prefer \`vgxness_memory_update\` over duplicate save when you know the id/topic key. Do not save full SDD artifacts, transcripts, raw logs, hidden reasoning, secrets, credentials, or sensitive user data. Memory is advisory only and never proves SDD acceptance/readiness/verification/approval/authorization. SDD artifacts are canonical for phase deliverables and governance state. \`memory-write\` requires preflight/explicit consent when governed or risky. Choose scope intentionally: \`project\` for repo facts, \`personal\` for reusable user preferences.
@@ -213,7 +214,7 @@ const registryManagerInstructionsV11 = [
     'Default to delegation for SDD phase-shaped work, repository exploration beyond one narrow lookup, implementation, verification, incident recovery, or multi-step analysis. Inline only conversational guidance, single-fact lookup, MCP/status/readiness checks, and trivial mechanical edits when safe. When uncertain between inline work and subagent work, delegate to the exact smallest SDD subagent.',
     'Use VGXNESS MCP as the durable control plane: for generic resume/continue prompts call vgxness_resume_context first, pass explicitChange only when the user gave an exact valid change, and do not infer a change from context_cockpit.memoryPreviews; vgxness_context_cockpit and vgxness_session_restore are advisory context only after the gate, and context cockpit previews, memoryPreviews, and SDD summaries are advisory only. Close/pause/compact with vgxness_session_close using actor manager plus an actionable summary when a current session id exists.',
     'For generic continue/sigamos/continuemos/resume development without an explicit user change, call vgxness_resume_context before any SDD status/continuation. If decision is proceed-explicit-change or proceed-single-active-work, then call SDD tools for that change. If inspect-interrupted-run, call vgxness_run_resume_inspect. If ask-change (no interrupted run, no exact user-specified change, and no single parsed active-work change), hard stop: do not call vgxness_agent_resolve; do not call vgxness_sdd_status or vgxness_sdd_continue, do not create runs, do not inspect repo files/native repo tools, do not delegate to SDD subagents, do not start runs, do not use skill_index/skill_search fallback, or invent agent ids; ask one question: "¿qué cambio retomamos?".',
-    'Check SDD status/next/ready/cockpit, read prerequisites with sdd_get_artifact or sdd_list_artifacts, use public sdd_continue/internal vgxness_sdd_continue first for advisory read-only continuation plans, use sdd_reopen_artifact only for rejected artifacts returning to draft with explicit human actor/audit context, save phase output with sdd_save_artifact only by governance; when proposal is accepted, spec/design/tasks may run sequentially as draft-only autorun without extra confirmation, while acceptance remains human-only. Memory capture policy: save/update only durable, future-relevant, actionable, scoped, evidence-backed, compact, non-sensitive observations; prefer update by known id/topicKey over duplicate saves; never save full SDD artifacts, transcripts, raw logs, hidden reasoning, secrets, credentials, or sensitive user data. Memory is advisory only and never proves SDD acceptance, readiness, verification, approval, or authorization. SDD artifacts are canonical for phase deliverables/governance state. Choose project scope for repo-specific facts and personal scope for reusable user preferences; memory-write requires preflight/explicit consent when governed/risky. Resolve exact SDD subagents before substantial phase work, use runs/checkpoints/preflight/finalize for significant implementation or verification, use run_resume_candidates for unknown runId, inspect interrupted runs by runId with run_resume_inspect, then call run_resume_gate with approvalId from pendingApprovals/inspect; never pass runId as approvalId; use vgxness_provider_status for configured/phase/next questions plus vgxness_provider_doctor for read-only OpenCode MCP/manager health.',
+    'Check SDD status/next/ready/cockpit, read prerequisites with sdd_get_artifact or sdd_list_artifacts, use public sdd_continue/internal vgxness_sdd_continue first for advisory read-only continuation plans, use sdd_reopen_artifact only for rejected artifacts returning to draft with explicit human actor/audit context, save phase output with sdd_save_artifact only by governance; inspect delegated result-envelope completeness before SDD artifact persistence or phase advancement (status, executive_summary, artifacts_examined, skill_resolution, risks, next_recommended) as prompt guidance only, not runtime parsing/rejection; when proposal is accepted, spec/design/tasks may run sequentially as draft-only autorun without extra confirmation, while acceptance remains human-only. Memory capture policy: save/update only durable, future-relevant, actionable, scoped, evidence-backed, compact, non-sensitive observations; prefer update by known id/topicKey over duplicate saves; never save full SDD artifacts, transcripts, raw logs, hidden reasoning, secrets, credentials, or sensitive user data. Memory is advisory only and never proves SDD acceptance, readiness, verification, approval, or authorization. SDD artifacts are canonical for phase deliverables/governance state. Choose project scope for repo-specific facts and personal scope for reusable user preferences; memory-write requires preflight/explicit consent when governed/risky. Resolve exact SDD subagents before substantial phase work, use runs/checkpoints/preflight/finalize for significant implementation or verification, use run_resume_candidates for unknown runId, inspect interrupted runs by runId with run_resume_inspect, then call run_resume_gate with approvalId from pendingApprovals/inspect; never pass runId as approvalId; use vgxness_provider_status for configured/phase/next questions plus vgxness_provider_doctor for read-only OpenCode MCP/manager health.',
     'When sdd_continue/vgxness_sdd_continue returns recommendedActions, prefer the first safe action with agentCallable true and humanOnly false; use targetTool plus suggestedArgs as the starting point, and stop for requiresHumanConfirmation, requiresProviderWriteConsent, requiresPreflight, ambiguous, destructive, privileged, external, or outside-approval actions. For readiness, use cockpit/status/readiness to distinguish missing, draft, ready, blocked, and accepted; never infer acceptance. For provider evidence, report providerEvidence.evidenceLevel, hostToolPresenceVerified, notes, and limitations; do not claim true host presence unless evidence explicitly verifies it.',
     'Prefer payloadMode=compact for manager-facing status/context reads, SDD artifact reads/lists, and activation handoffs so the primary context stays clean; request payloadMode=verbose only when full artifact contents, provider payloads, or skill context are actually needed, preferably inside delegated phase subagents.',
     'MCP sdd_continue must not execute providers, create runs, mutate artifacts, write provider config/openspec, bypass human acceptance, or treat draft-run as apply-progress.',
@@ -225,7 +226,7 @@ const subagentData = {
     'vgxness-sdd-propose': { seedDescription: 'Creates focused change proposals from exploration findings.', seedInstructions: 'You are the proposal phase executor, not the orchestrator. Do not delegate. Create a focused SDD proposal from exploration evidence. Do not implement code changes. Identify scope, tradeoffs, non-goals, and acceptance direction.', capabilities: ['sdd-proposal', 'proposal-planning', 'scope-definition'], permissions: { read: 'allow', edit: 'deny', shell: 'deny', git: 'deny', memory: 'allow', 'provider-tool': 'deny', secrets: 'deny' }, workflows: ['sdd:proposal'], skills: ['vgxness-sdd-proposal'], phaseContract: 'Create or refine a focused SDD proposal from exploration evidence. Do not implement code changes. Include scope, tradeoffs, non-goals, and acceptance direction.' },
     'vgxness-sdd-spec': { seedDescription: 'Writes detailed requirements and acceptance criteria for SDD changes.', seedInstructions: 'You are the spec phase executor, not the orchestrator. Do not delegate. Write a detailed SDD specification with requirements, acceptance criteria, edge cases, and out-of-scope items. Do not implement code changes.', capabilities: ['sdd-specification', 'requirements', 'acceptance-criteria'], permissions: { read: 'allow', edit: 'deny', shell: 'deny', git: 'deny', memory: 'allow', 'provider-tool': 'deny', secrets: 'deny' }, workflows: ['sdd:spec'], skills: ['vgxness-sdd-spec'], phaseContract: 'Write requirements, acceptance criteria, edge cases, and out-of-scope items. Do not implement code changes.' },
     'vgxness-sdd-design': { seedDescription: 'Creates technical design from accepted proposals and accepted or trusted draft specs.', seedInstructions: 'You are the design phase executor, not the orchestrator. Do not delegate. Create a technical design grounded in the repository. Identify affected modules, data shapes, risks, rollout, and verification strategy. Do not implement code changes.', capabilities: ['sdd-design', 'technical-design', 'architecture-planning'], permissions: { read: 'allow', edit: 'deny', shell: 'ask', git: 'deny', memory: 'allow', 'provider-tool': 'deny', secrets: 'deny' }, workflows: ['sdd:design'], skills: ['vgxness-sdd-design'], phaseContract: 'Create technical design grounded in the repository: affected modules, data shapes, safety, rollout, and verification. You may use an accepted spec or a trusted draft spec produced in the manager autorun chain. Do not implement code changes.' },
-    'vgxness-sdd-tasks': { seedDescription: 'Breaks accepted or trusted draft specs and designs into implementation tasks.', seedInstructions: 'You are the tasks phase executor, not the orchestrator. Do not delegate. Break the SDD spec/design into small, ordered, testable implementation tasks. Do not implement code changes.', capabilities: ['sdd-tasks', 'task-breakdown', 'implementation-planning'], permissions: { read: 'allow', edit: 'deny', shell: 'deny', git: 'deny', memory: 'allow', 'provider-tool': 'deny', secrets: 'deny' }, workflows: ['sdd:tasks'], skills: ['vgxness-sdd-tasks'], phaseContract: 'Break accepted or trusted draft spec/design into small ordered testable implementation tasks. Do not implement code changes.' },
+    'vgxness-sdd-tasks': { seedDescription: 'Breaks accepted or trusted draft specs and designs into implementation tasks.', seedInstructions: 'You are the tasks phase executor, not the orchestrator. Do not delegate. Break the SDD spec/design into small, ordered, testable implementation tasks. Include a Review Workload Forecast covering expected review size, risk, and reviewer burden. Do not implement code changes.', capabilities: ['sdd-tasks', 'task-breakdown', 'implementation-planning'], permissions: { read: 'allow', edit: 'deny', shell: 'deny', git: 'deny', memory: 'allow', 'provider-tool': 'deny', secrets: 'deny' }, workflows: ['sdd:tasks'], skills: ['vgxness-sdd-tasks'], phaseContract: 'Break accepted or trusted draft spec/design into small ordered testable implementation tasks. Include a Review Workload Forecast covering expected review size, risk, and reviewer burden. Do not implement code changes.' },
     'vgxness-sdd-apply': { seedDescription: 'Implements code changes from SDD task definitions.', seedInstructions: 'You are the apply phase executor, not the orchestrator. Implement only the assigned SDD tasks directly. Do not delegate. Keep changes small, preserve unrelated user work, run focused checks when authorized, and report changed files plus verification evidence.', capabilities: ['sdd-apply', 'implementation', 'code-change'], permissions: { read: 'allow', edit: 'ask', shell: 'allow', git: 'ask', memory: 'allow', 'provider-tool': 'deny', secrets: 'deny' }, workflows: ['sdd:apply-progress'], skills: ['vgxness-sdd-apply'], phaseContract: 'Implement only assigned SDD tasks. Preserve unrelated dirty files and user work. Use focused tests when authorized. Report changed files, tests/evidence, and residual risks.' },
     'vgxness-sdd-verify': { seedDescription: 'Validates implementation against specs, tasks, and evidence.', seedInstructions: 'You are the verify phase executor, not the orchestrator. Do not delegate. Verify the implementation against SDD artifacts. Prefer focused local tests, inspect evidence, and report residual risk. Do not implement unrelated changes.', capabilities: ['sdd-verify', 'verification', 'test-review', 'risk-review'], permissions: { read: 'allow', edit: 'deny', shell: 'ask', git: 'deny', memory: 'allow', 'provider-tool': 'deny', secrets: 'deny' }, workflows: ['sdd:verify'], skills: ['vgxness-sdd-verify'], phaseContract: 'Validate implementation against SDD artifacts and task acceptance criteria. Prefer focused local tests and evidence review. Do not implement unrelated changes.' },
     'vgxness-sdd-archive': { seedDescription: 'Archives completed SDD change artifacts and outcomes.', seedInstructions: 'You are the archive phase executor, not the orchestrator. Do not delegate. Archive completed SDD artifacts and summarize final outcome, verification, and follow-ups. Confirm before writes beyond the requested archive artifact.', capabilities: ['sdd-archive', 'artifact-archive', 'release-notes'], permissions: { read: 'allow', edit: 'ask', shell: 'deny', git: 'deny', memory: 'allow', 'provider-tool': 'deny', secrets: 'deny' }, workflows: ['sdd:archive'], skills: ['vgxness-sdd-archive'], phaseContract: 'Archive completed SDD outcome with summary, verification evidence, follow-ups, and residual risks. Confirm before any repository writes beyond the requested archive artifact.' },

package/dist/runs/resume-after-approval-result.js

@@ -0,0 +1,84 @@
+export function buildResumeAfterApprovalResult(input) {
+    const operationKind = stringFromObject(input.executorOutput, 'operationKind') ?? operationKindFromOperation(input.operation);
+    const command = operationKind === 'allowlisted-command' ? extractAllowlistedCommandMetadata(input.executorOutput) : undefined;
+    return {
+        kind: 'resume-after-approval-result',
+        version: 1,
+        operationKind,
+        runId: input.runId,
+        approvalId: input.approvalId,
+        attemptId: input.attemptId,
+        permissionEventId: input.permissionEventId,
+        pendingExecutionEventId: input.pendingExecutionEventId,
+        operationFingerprint: input.operationFingerprint,
+        executor: input.executorName,
+        status: input.status,
+        ...(command === undefined ? {} : { command }),
+        error: input.error === undefined ? null : { code: input.error.code, message: input.error.message },
+        safety: buildSafety(input.executorOutput),
+    };
+}
+function extractAllowlistedCommandMetadata(output) {
+    if (!isObject(output))
+        return undefined;
+    const command = isObject(output.command) ? output.command : output;
+    const commandId = stringField(command.commandId) ?? stringField(output.commandId);
+    const argv = stringArray(command.argv) ?? stringArray(output.argv);
+    if (commandId === undefined || argv === undefined)
+        return undefined;
+    const result = { commandId, argv };
+    setOptionalNumberOrNull(result, 'exitCode', command.exitCode);
+    setOptionalStringOrNull(result, 'signal', command.signal);
+    setOptionalBoolean(result, 'timedOut', command.timedOut);
+    setOptionalBoolean(result, 'outputTruncated', command.outputTruncated);
+    setOptionalNumber(result, 'stdoutBytes', command.stdoutBytes);
+    setOptionalNumber(result, 'stderrBytes', command.stderrBytes);
+    return result;
+}
+function buildSafety(output) {
+    const source = isObject(output) && isObject(output.command) && isObject(output.command.safety) ? output.command.safety : isObject(output) && isObject(output.safety) ? output.safety : undefined;
+    return {
+        metadataOnly: true,
+        rawStdoutPersisted: false,
+        rawStderrPersisted: false,
+        providerPayloadPersisted: false,
+        executorOutputWhitelisted: true,
+        ...(typeof source?.boundedProcess === 'boolean' ? { boundedProcess: source.boundedProcess } : {}),
+        ...(typeof source?.shellDisabled === 'boolean' ? { shellDisabled: source.shellDisabled } : {}),
+        ...(typeof source?.argvArrayOnly === 'boolean' ? { argvArrayOnly: source.argvArrayOnly } : {}),
+        ...(typeof source?.providerConfigWritesBlocked === 'boolean' ? { providerConfigWritesBlocked: source.providerConfigWritesBlocked } : {}),
+        ...(typeof source?.createsSandbox === 'boolean' ? { createsSandbox: source.createsSandbox } : {}),
+        ...(typeof source?.createsWorktree === 'boolean' ? { createsWorktree: source.createsWorktree } : {}),
+    };
+}
+function operationKindFromOperation(operation) {
+    return isObject(operation.input) && typeof operation.input.operationKind === 'string' ? operation.input.operationKind : 'generic-operation';
+}
+function stringFromObject(value, key) {
+    return isObject(value) ? stringField(value[key]) : undefined;
+}
+function stringField(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function stringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === 'string') ? value : undefined;
+}
+function setOptionalNumber(target, key, value) {
+    if (typeof value === 'number')
+        target[key] = value;
+}
+function setOptionalBoolean(target, key, value) {
+    if (typeof value === 'boolean')
+        target[key] = value;
+}
+function setOptionalNumberOrNull(target, key, value) {
+    if (typeof value === 'number' || value === null)
+        target[key] = value;
+}
+function setOptionalStringOrNull(target, key, value) {
+    if (typeof value === 'string' || value === null)
+        target[key] = value;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/runs/run-service.js

@@ -7,6 +7,7 @@ import { evaluateOperationRetry as evaluateOperationRetryPolicy } from './operat
 import { AllowlistedApplyProgressCommandExecutor } from '../workflows/command-allowlist-adapter.js';
 import { RunRepository, } from './repositories/runs.js';
 import { buildRunInsights, buildRunOperatorResumePlan } from './run-insights.js';
+import { buildResumeAfterApprovalResult } from './resume-after-approval-result.js';
 const preflightSafety = {
     operationExecuted: false,
     executorInvoked: false,
@@ -459,7 +460,19 @@ export class RunService {
         const executed = input.executor.execute({ runId: approval.value.runId, operation });
         if (!executed.ok) {
             const error = { code: executed.error.code, message: executed.error.message };
-            const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'failed', error });
+            const result = buildResumeAfterApprovalResult({
+                runId: approval.value.runId,
+                approvalId: approval.value.id,
+                attemptId: reserved.value.id,
+                permissionEventId: permissionEvent.id,
+                pendingExecutionEventId: pendingExecutionEvent.id,
+                operationFingerprint: replayGuard.operationFingerprint,
+                executorName: input.executor.name,
+                operation,
+                status: 'failed',
+                error,
+            });
+            const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'failed', output: result, error });
             if (!attempt.ok)
                 return attempt;
             const executionEvent = this.runs.appendEvent({
@@ -478,6 +491,7 @@ export class RunService {
                     operationFingerprint: replayGuard.operationFingerprint,
                     resumedFromApprovalId: approval.value.id,
                     executorInvoked: true,
+                    result,
                     error,
                 }),
                 relatedType: 'approval',
@@ -486,7 +500,7 @@ export class RunService {
             if (!executionEvent.ok)
                 return { ok: false, error: executionEvent.error };
             const linkedAttempt = this.runs.attachAttemptResultEvent(attempt.value.id, executionEvent.value.id);
-            const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, undefined, error);
+            const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, result);
             if (!evidence.ok)
                 return { ok: false, error: evidence.error };
             return {
@@ -498,12 +512,25 @@ export class RunService {
                     attempt: linkedAttempt.ok ? linkedAttempt.value : attempt.value,
                     executionEvent: executionEvent.value,
                     status: 'failed',
+                    output: result,
                     ...(evidence.value === undefined ? {} : evidence.value),
                 },
             };
         }
         const output = executed.value.output;
-        const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'succeeded', ...(output === undefined ? {} : { output }) });
+        const result = buildResumeAfterApprovalResult({
+            runId: approval.value.runId,
+            approvalId: approval.value.id,
+            attemptId: reserved.value.id,
+            permissionEventId: permissionEvent.id,
+            pendingExecutionEventId: pendingExecutionEvent.id,
+            operationFingerprint: replayGuard.operationFingerprint,
+            executorName: input.executor.name,
+            operation,
+            status: 'succeeded',
+            ...(output === undefined ? {} : { executorOutput: output }),
+        });
+        const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'succeeded', output: result });
         if (!attempt.ok)
             return attempt;
         const executionEvent = this.runs.appendEvent({
@@ -522,7 +549,7 @@ export class RunService {
                 operationFingerprint: replayGuard.operationFingerprint,
                 resumedFromApprovalId: approval.value.id,
                 executorInvoked: true,
-                output: output ?? null,
+                result,
             }),
             relatedType: 'approval',
             relatedId: approval.value.id,
@@ -530,7 +557,7 @@ export class RunService {
         if (!executionEvent.ok)
             return { ok: false, error: executionEvent.error };
         const linkedAttempt = this.runs.attachAttemptResultEvent(attempt.value.id, executionEvent.value.id);
-        const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, output, undefined);
+        const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, result);
         if (!evidence.ok)
             return { ok: false, error: evidence.error };
         return {
@@ -542,7 +569,7 @@ export class RunService {
                 attempt: linkedAttempt.ok ? linkedAttempt.value : attempt.value,
                 executionEvent: executionEvent.value,
                 status: 'succeeded',
-                ...(output === undefined ? {} : { output }),
+                output: result,
                 ...(evidence.value === undefined ? {} : evidence.value),
             },
         };
@@ -1002,24 +1029,21 @@ function workflowConflictDecision(input, runWorkflow) {
         auditEvidence: [`runWorkflow:${runWorkflow}`, `explicitWorkflow:${input.workflow}`],
     };
 }
-function appendApplyProgressAllowlistEvidenceIfNeeded(runs, approvalId, permissionEvent, pendingExecutionEvent, attempt, executionEvent, operationFingerprint, executorName, operation, output, error) {
+function appendApplyProgressAllowlistEvidenceIfNeeded(runs, approvalId, permissionEvent, pendingExecutionEvent, attempt, executionEvent, operationFingerprint, executorName, operation, result) {
     if (!isApplyProgressAllowlistedCommandOperation(operation))
         return { ok: true, value: undefined };
     const base = {
-        kind: 'apply-progress-operation',
-        operationKind: 'allowlisted-command',
-        runId: attempt.runId,
-        approvalId,
-        attemptId: attempt.id,
-        pendingExecutionEventId: pendingExecutionEvent.id,
-        permissionEventId: permissionEvent.id,
+        ...result,
         executionEventId: executionEvent.id,
-        operationFingerprint,
-        executor: executorName,
-        operation: operationMetadata(operation),
-        status: attempt.status,
-        output: output ?? null,
-        error: error ?? null,
+        audit: {
+            metadataOnly: true,
+            operationFingerprint,
+            executor: executorName,
+            approvalId,
+            pendingExecutionEventId: pendingExecutionEvent.id,
+            permissionEventId: permissionEvent.id,
+            attemptId: attempt.id,
+        },
     };
     const evidence = runs.appendEvent({
         runId: attempt.runId,

package/dist/runs/sandbox-process-execution.js

@@ -162,6 +162,11 @@ function acceptedEvidence(workspaceRoot, cwd, checks) {
         enforceable: true,
         createsSandbox: false,
         createsWorktree: false,
+        filesystemIsolation: false,
+        networkIsolation: false,
+        shellDisabled: true,
+        argvArrayOnly: true,
+        providerConfigWritesBlocked: true,
         workspaceRoot,
         cwd,
         capabilities: {

package/dist/workflows/command-allowlist-adapter.js

@@ -55,16 +55,31 @@ export class CommandAllowlistAdapter {
         const result = this.runner(this.request);
         if (!result.ok)
             throw new Error(`${result.error.code}: ${result.error.message}`);
+        const stdoutBytes = Buffer.byteLength(result.value.stdout);
+        const stderrBytes = Buffer.byteLength(result.value.stderr);
+        const safety = {
+            strategy: result.value.evidence.strategy,
+            boundedProcess: true,
+            createsSandbox: result.value.evidence.createsSandbox,
+            createsWorktree: result.value.evidence.createsWorktree,
+            filesystemIsolation: result.value.evidence.filesystemIsolation,
+            networkIsolation: result.value.evidence.networkIsolation,
+            shellDisabled: result.value.evidence.shellDisabled,
+            argvArrayOnly: result.value.evidence.argvArrayOnly,
+            providerConfigWritesBlocked: result.value.evidence.providerConfigWritesBlocked,
+        };
         const output = {
-            command: this.commandId,
+            commandId: this.commandId,
             executable: this.entry.executable,
-            args: this.entry.args,
+            argv: [this.entry.executable, ...this.entry.args],
+            cwd: this.plan.request.cwd,
             exitCode: result.value.exitCode,
             signal: result.value.signal,
             timedOut: result.value.timedOut,
             outputTruncated: result.value.outputTruncated,
-            stdout: result.value.stdout,
-            stderr: result.value.stderr,
+            stdoutBytes,
+            stderrBytes,
+            safety,
         };
         const failed = result.value.timedOut || result.value.exitCode !== 0;
         return {
@@ -77,6 +92,11 @@ export class CommandAllowlistAdapter {
                 shell: false,
                 argv: [this.entry.executable, ...this.entry.args],
                 cwd: this.plan.request.cwd,
+                stdoutBytes,
+                stderrBytes,
+                outputTruncated: result.value.outputTruncated,
+                timedOut: result.value.timedOut,
+                safety,
             },
             ...(failed
                 ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vgxness",
-  "version": "1.19.4",
+  "version": "1.19.6",
   "description": "CLI and MCP control plane for guided AI-agent workflows, SDD, memory, and OpenCode setup.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {