vgxness 1.19.5 → 1.19.7

package/dist/agents/canonical-agent-manifest.js

@@ -2,7 +2,7 @@ import { canonicalBehaviorContractVersion } from '../behavior/behavior-contract-
 export const canonicalDefaultAgentName = 'vgxness-manager';
 export const canonicalOpenCodeDefaultModel = 'openai/gpt-5.5';
 export const canonicalOpenCodeManagerReasoningEffort = 'high';
-export const canonicalPromptContractVersion = 17;
+export const canonicalPromptContractVersion = 18;
 export const canonicalSddSubagentNames = [
     'vgxness-sdd-explore',
     'vgxness-sdd-propose',
@@ -140,6 +140,7 @@ export function createCanonicalOpenCodeSddMcpToolPermissions() {
         vgxness_memory_save: 'allow',
         vgxness_memory_update: 'allow',
         vgxness_skill_payload: 'allow',
+        vgxness_run_list: 'allow',
         vgxness_run_preflight: 'allow',
     };
 }
@@ -178,7 +179,7 @@ Use lightest safe path: T0-2 direct, T3 preflight, T4 SDD for governance/permiss
 SDD happens in OpenCode via conversation, VGXNESS MCP, and SDD subagents. No terminal SDD phase commands. CLI is an escape hatch for bootstrap, doctor, recovery, setup gaps, or explicit request.
 
 ## MCP playbook
-- For starting, resuming, or recovering context: use \`vgxness_resume_context\` first for generic resume/continue prompts; pass \`explicitChange\` only when the user gave an exact valid change. \`resume_context\` is read-only/no-trace/no-mutation and is the selector gate. \`vgxness_context_cockpit\` and \`vgxness_session_restore\` are advisory context only after the gate; \`vgxness_session_restore\` is one signal, not truth. Do not infer a change from \`context_cockpit.memoryPreviews\`; context cockpit previews, \`memoryPreviews\`, and SDD summaries are advisory only. For ending, pausing, handing off, or compacting: \`vgxness_session_close\` with id and actor \`manager\`; if no id, do not invent one; summarize.
+- For starting, resuming, or recovering context: use \`vgxness_resume_context\` first for generic resume/continue prompts; pass \`explicitChange\` only when the user gave an exact valid change. \`resume_context\` is read-only/no-trace/no-mutation and is the selector gate. For retrospective/status prompts like "what did we do?" or "qué habíamos hecho", use recent completed run history first (\`vgxness_run_list completed\`) and mention interrupted candidates only as old blockers, not as latest truth. \`vgxness_context_cockpit\` and \`vgxness_session_restore\` are advisory context only after the gate; \`vgxness_session_restore\` is one signal, not truth. Do not infer a change from \`context_cockpit.memoryPreviews\`; context cockpit previews, \`memoryPreviews\`, and SDD summaries are advisory only. For ending, pausing, handing off, or compacting: \`vgxness_session_close\` with id and actor \`manager\`; if no id, do not invent one; summarize.
 - Bounded resume/start hard stop: for generic "continue"/"sigamos"/"continuemos"/"resume development" without an explicit user change, call \`vgxness_resume_context\` before any SDD continuation/status. If it returns \`proceed-explicit-change\` or \`proceed-single-active-work\`, then SDD status/continue may use that change. If it returns \`inspect-interrupted-run\`, call \`vgxness_run_resume_inspect\`. If it returns \`ask-change\`, treat it as: If no interrupted run, no exact user-specified change, and no single parsed active-work change, hard stop: do not call \`vgxness_agent_resolve\`; do not call \`vgxness_sdd_status\` or \`vgxness_sdd_continue\`, do not create runs, do not use Glob/Read/docs, do not inspect repo files/native repo tools, do not delegate to SDD subagents, do not start runs, or use \`skill_index\`/\`skill_search\` fallback; ask one question: "¿qué cambio retomamos?".
 - Proposal clarity: if product/business clarity is missing, run a proposal question round.
 - SDD artifacts: guide with \`vgxness_sdd_next\`/\`vgxness_sdd_cockpit\`; list/read with \`vgxness_sdd_get_artifact\`/\`vgxness_sdd_list_artifacts\`; prefer \`payloadMode: "compact"\` so primary context stays clean; use verbose only when required, preferably inside the delegated phase subagent. Save with \`vgxness_sdd_save_artifact\` after the right flow. Use \`vgxness_sdd_reopen_artifact\` only for rejected artifacts returning to draft, with explicit human actor/audit context.
@@ -212,7 +213,7 @@ Be concise.`;
 const registryManagerInstructionsV11 = [
     'You are the VGXNESS SDD coordinator, not a monolithic executor. Coach briefly while coordinating: explain useful tradeoffs, be realistic about risks and unknowns, respectfully challenge weak assumptions with better options, keep the user comfortable and in control, and stay concise.',
     'Default to delegation for SDD phase-shaped work, repository exploration beyond one narrow lookup, implementation, verification, incident recovery, or multi-step analysis. Inline only conversational guidance, single-fact lookup, MCP/status/readiness checks, and trivial mechanical edits when safe. When uncertain between inline work and subagent work, delegate to the exact smallest SDD subagent.',
-    'Use VGXNESS MCP as the durable control plane: for generic resume/continue prompts call vgxness_resume_context first, pass explicitChange only when the user gave an exact valid change, and do not infer a change from context_cockpit.memoryPreviews; vgxness_context_cockpit and vgxness_session_restore are advisory context only after the gate, and context cockpit previews, memoryPreviews, and SDD summaries are advisory only. Close/pause/compact with vgxness_session_close using actor manager plus an actionable summary when a current session id exists.',
+    'Use VGXNESS MCP as the durable control plane: for generic resume/continue prompts call vgxness_resume_context first, pass explicitChange only when the user gave an exact valid change, and do not infer a change from context_cockpit.memoryPreviews; for retrospective/status prompts such as "what did we do?" or "qué habíamos hecho", inspect recent completed run history first with vgxness_run_list completed and mention interrupted candidates only as old blockers, not as latest truth; vgxness_context_cockpit and vgxness_session_restore are advisory context only after the gate, and context cockpit previews, memoryPreviews, and SDD summaries are advisory only. Close/pause/compact with vgxness_session_close using actor manager plus an actionable summary when a current session id exists.',
     'For generic continue/sigamos/continuemos/resume development without an explicit user change, call vgxness_resume_context before any SDD status/continuation. If decision is proceed-explicit-change or proceed-single-active-work, then call SDD tools for that change. If inspect-interrupted-run, call vgxness_run_resume_inspect. If ask-change (no interrupted run, no exact user-specified change, and no single parsed active-work change), hard stop: do not call vgxness_agent_resolve; do not call vgxness_sdd_status or vgxness_sdd_continue, do not create runs, do not inspect repo files/native repo tools, do not delegate to SDD subagents, do not start runs, do not use skill_index/skill_search fallback, or invent agent ids; ask one question: "¿qué cambio retomamos?".',
     'Check SDD status/next/ready/cockpit, read prerequisites with sdd_get_artifact or sdd_list_artifacts, use public sdd_continue/internal vgxness_sdd_continue first for advisory read-only continuation plans, use sdd_reopen_artifact only for rejected artifacts returning to draft with explicit human actor/audit context, save phase output with sdd_save_artifact only by governance; inspect delegated result-envelope completeness before SDD artifact persistence or phase advancement (status, executive_summary, artifacts_examined, skill_resolution, risks, next_recommended) as prompt guidance only, not runtime parsing/rejection; when proposal is accepted, spec/design/tasks may run sequentially as draft-only autorun without extra confirmation, while acceptance remains human-only. Memory capture policy: save/update only durable, future-relevant, actionable, scoped, evidence-backed, compact, non-sensitive observations; prefer update by known id/topicKey over duplicate saves; never save full SDD artifacts, transcripts, raw logs, hidden reasoning, secrets, credentials, or sensitive user data. Memory is advisory only and never proves SDD acceptance, readiness, verification, approval, or authorization. SDD artifacts are canonical for phase deliverables/governance state. Choose project scope for repo-specific facts and personal scope for reusable user preferences; memory-write requires preflight/explicit consent when governed/risky. Resolve exact SDD subagents before substantial phase work, use runs/checkpoints/preflight/finalize for significant implementation or verification, use run_resume_candidates for unknown runId, inspect interrupted runs by runId with run_resume_inspect, then call run_resume_gate with approvalId from pendingApprovals/inspect; never pass runId as approvalId; use vgxness_provider_status for configured/phase/next questions plus vgxness_provider_doctor for read-only OpenCode MCP/manager health.',
     'When sdd_continue/vgxness_sdd_continue returns recommendedActions, prefer the first safe action with agentCallable true and humanOnly false; use targetTool plus suggestedArgs as the starting point, and stop for requiresHumanConfirmation, requiresProviderWriteConsent, requiresPreflight, ambiguous, destructive, privileged, external, or outside-approval actions. For readiness, use cockpit/status/readiness to distinguish missing, draft, ready, blocked, and accepted; never infer acceptance. For provider evidence, report providerEvidence.evidenceLevel, hostToolPresenceVerified, notes, and limitations; do not claim true host presence unless evidence explicitly verifies it.',

package/dist/mcp/resume-context-gate-service.js

@@ -29,7 +29,8 @@ export class ResumeContextGateService {
             };
         });
         const distinctActiveWorkChanges = [...new Set(activeWorkHits.map((hit) => hit.change).filter(isString))];
-        const decision = decide(explicitChange, interrupted.value, distinctActiveWorkChanges);
+        const retrospectiveStatusPrompt = isRetrospectiveStatusPrompt(input.userPrompt);
+        const decision = decide(explicitChange, interrupted.value, distinctActiveWorkChanges, retrospectiveStatusPrompt);
         const selectedChange = decision === 'proceed-explicit-change' ? explicitChange : decision === 'proceed-single-active-work' ? distinctActiveWorkChanges[0] : undefined;
         return {
             ok: true,
@@ -44,7 +45,7 @@ export class ResumeContextGateService {
                 ...(decision === 'proceed-explicit-change' ? { selectedBy: 'explicit-change' } : {}),
                 ...(decision === 'proceed-single-active-work' ? { selectedBy: 'single-active-work' } : {}),
                 ...(decision === 'ask-change' ? { question: '¿qué cambio retomamos?' } : {}),
-                nextAction: nextAction(decision),
+                nextAction: nextAction(decision, retrospectiveStatusPrompt),
                 allowedNextTools: allowedNextTools(decision),
                 prohibitedNextTools: prohibitedNextTools(decision),
                 evidence: {
@@ -112,9 +113,11 @@ export class ResumeContextGateService {
         return this.dependencies.memory.searchObservationPreviewsNoTrace({ project, topicKey: 'active-work', limit });
     }
 }
-function decide(explicitChange, interruptedRuns, distinctActiveWorkChanges) {
+function decide(explicitChange, interruptedRuns, distinctActiveWorkChanges, retrospectiveStatusPrompt) {
     if (explicitChange !== undefined)
         return 'proceed-explicit-change';
+    if (retrospectiveStatusPrompt)
+        return 'ask-change';
     const interrupted = interruptedRuns[0];
     if (interrupted !== undefined)
         return 'inspect-interrupted-run';
@@ -122,6 +125,28 @@ function decide(explicitChange, interruptedRuns, distinctActiveWorkChanges) {
         return 'proceed-single-active-work';
     return 'ask-change';
 }
+function isRetrospectiveStatusPrompt(prompt) {
+    if (prompt === undefined)
+        return false;
+    const normalized = prompt
+        .normalize('NFD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .toLocaleLowerCase('en-US');
+    return retrospectiveStatusPhrases.some((phrase) => normalized.includes(phrase));
+}
+const retrospectiveStatusPhrases = [
+    'what did we do',
+    'what happened',
+    'latest completed',
+    'recent work',
+    'what was done',
+    'last release',
+    'que hicimos',
+    'que habiamos hecho',
+    'que se hizo',
+    'ultimo trabajo',
+    'ultima version',
+];
 function allowedNextTools(decision) {
     if (decision === 'inspect-interrupted-run')
         return ['vgxness_run_resume_inspect', 'vgxness_run_resume_gate'];
@@ -159,7 +184,10 @@ function prohibitedNextTools(decision) {
         ];
     return [...base, 'mutating-artifact-tools', 'vgxness_run_start'];
 }
-function nextAction(decision) {
+function nextAction(decision, retrospectiveStatusPrompt = false) {
+    if (decision === 'ask-change' && retrospectiveStatusPrompt) {
+        return 'For retrospective/status prompts, do not treat interrupted runs as latest truth; inspect recent completed run history first, and mention interrupted candidates only as advisory blockers.';
+    }
     switch (decision) {
         case 'proceed-explicit-change':
             return 'Proceed with SDD read/progression tools for the explicit selectedChange only.';

package/dist/runs/resume-after-approval-result.js

@@ -0,0 +1,84 @@
+export function buildResumeAfterApprovalResult(input) {
+    const operationKind = stringFromObject(input.executorOutput, 'operationKind') ?? operationKindFromOperation(input.operation);
+    const command = operationKind === 'allowlisted-command' ? extractAllowlistedCommandMetadata(input.executorOutput) : undefined;
+    return {
+        kind: 'resume-after-approval-result',
+        version: 1,
+        operationKind,
+        runId: input.runId,
+        approvalId: input.approvalId,
+        attemptId: input.attemptId,
+        permissionEventId: input.permissionEventId,
+        pendingExecutionEventId: input.pendingExecutionEventId,
+        operationFingerprint: input.operationFingerprint,
+        executor: input.executorName,
+        status: input.status,
+        ...(command === undefined ? {} : { command }),
+        error: input.error === undefined ? null : { code: input.error.code, message: input.error.message },
+        safety: buildSafety(input.executorOutput),
+    };
+}
+function extractAllowlistedCommandMetadata(output) {
+    if (!isObject(output))
+        return undefined;
+    const command = isObject(output.command) ? output.command : output;
+    const commandId = stringField(command.commandId) ?? stringField(output.commandId);
+    const argv = stringArray(command.argv) ?? stringArray(output.argv);
+    if (commandId === undefined || argv === undefined)
+        return undefined;
+    const result = { commandId, argv };
+    setOptionalNumberOrNull(result, 'exitCode', command.exitCode);
+    setOptionalStringOrNull(result, 'signal', command.signal);
+    setOptionalBoolean(result, 'timedOut', command.timedOut);
+    setOptionalBoolean(result, 'outputTruncated', command.outputTruncated);
+    setOptionalNumber(result, 'stdoutBytes', command.stdoutBytes);
+    setOptionalNumber(result, 'stderrBytes', command.stderrBytes);
+    return result;
+}
+function buildSafety(output) {
+    const source = isObject(output) && isObject(output.command) && isObject(output.command.safety) ? output.command.safety : isObject(output) && isObject(output.safety) ? output.safety : undefined;
+    return {
+        metadataOnly: true,
+        rawStdoutPersisted: false,
+        rawStderrPersisted: false,
+        providerPayloadPersisted: false,
+        executorOutputWhitelisted: true,
+        ...(typeof source?.boundedProcess === 'boolean' ? { boundedProcess: source.boundedProcess } : {}),
+        ...(typeof source?.shellDisabled === 'boolean' ? { shellDisabled: source.shellDisabled } : {}),
+        ...(typeof source?.argvArrayOnly === 'boolean' ? { argvArrayOnly: source.argvArrayOnly } : {}),
+        ...(typeof source?.providerConfigWritesBlocked === 'boolean' ? { providerConfigWritesBlocked: source.providerConfigWritesBlocked } : {}),
+        ...(typeof source?.createsSandbox === 'boolean' ? { createsSandbox: source.createsSandbox } : {}),
+        ...(typeof source?.createsWorktree === 'boolean' ? { createsWorktree: source.createsWorktree } : {}),
+    };
+}
+function operationKindFromOperation(operation) {
+    return isObject(operation.input) && typeof operation.input.operationKind === 'string' ? operation.input.operationKind : 'generic-operation';
+}
+function stringFromObject(value, key) {
+    return isObject(value) ? stringField(value[key]) : undefined;
+}
+function stringField(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function stringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === 'string') ? value : undefined;
+}
+function setOptionalNumber(target, key, value) {
+    if (typeof value === 'number')
+        target[key] = value;
+}
+function setOptionalBoolean(target, key, value) {
+    if (typeof value === 'boolean')
+        target[key] = value;
+}
+function setOptionalNumberOrNull(target, key, value) {
+    if (typeof value === 'number' || value === null)
+        target[key] = value;
+}
+function setOptionalStringOrNull(target, key, value) {
+    if (typeof value === 'string' || value === null)
+        target[key] = value;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/runs/run-service.js

@@ -7,6 +7,7 @@ import { evaluateOperationRetry as evaluateOperationRetryPolicy } from './operat
 import { AllowlistedApplyProgressCommandExecutor } from '../workflows/command-allowlist-adapter.js';
 import { RunRepository, } from './repositories/runs.js';
 import { buildRunInsights, buildRunOperatorResumePlan } from './run-insights.js';
+import { buildResumeAfterApprovalResult } from './resume-after-approval-result.js';
 const preflightSafety = {
     operationExecuted: false,
     executorInvoked: false,
@@ -459,7 +460,19 @@ export class RunService {
         const executed = input.executor.execute({ runId: approval.value.runId, operation });
         if (!executed.ok) {
             const error = { code: executed.error.code, message: executed.error.message };
-            const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'failed', error });
+            const result = buildResumeAfterApprovalResult({
+                runId: approval.value.runId,
+                approvalId: approval.value.id,
+                attemptId: reserved.value.id,
+                permissionEventId: permissionEvent.id,
+                pendingExecutionEventId: pendingExecutionEvent.id,
+                operationFingerprint: replayGuard.operationFingerprint,
+                executorName: input.executor.name,
+                operation,
+                status: 'failed',
+                error,
+            });
+            const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'failed', output: result, error });
             if (!attempt.ok)
                 return attempt;
             const executionEvent = this.runs.appendEvent({
@@ -478,6 +491,7 @@ export class RunService {
                     operationFingerprint: replayGuard.operationFingerprint,
                     resumedFromApprovalId: approval.value.id,
                     executorInvoked: true,
+                    result,
                     error,
                 }),
                 relatedType: 'approval',
@@ -486,7 +500,7 @@ export class RunService {
             if (!executionEvent.ok)
                 return { ok: false, error: executionEvent.error };
             const linkedAttempt = this.runs.attachAttemptResultEvent(attempt.value.id, executionEvent.value.id);
-            const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, undefined, error);
+            const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, result);
             if (!evidence.ok)
                 return { ok: false, error: evidence.error };
             return {
@@ -498,12 +512,25 @@ export class RunService {
                     attempt: linkedAttempt.ok ? linkedAttempt.value : attempt.value,
                     executionEvent: executionEvent.value,
                     status: 'failed',
+                    output: result,
                     ...(evidence.value === undefined ? {} : evidence.value),
                 },
             };
         }
         const output = executed.value.output;
-        const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'succeeded', ...(output === undefined ? {} : { output }) });
+        const result = buildResumeAfterApprovalResult({
+            runId: approval.value.runId,
+            approvalId: approval.value.id,
+            attemptId: reserved.value.id,
+            permissionEventId: permissionEvent.id,
+            pendingExecutionEventId: pendingExecutionEvent.id,
+            operationFingerprint: replayGuard.operationFingerprint,
+            executorName: input.executor.name,
+            operation,
+            status: 'succeeded',
+            ...(output === undefined ? {} : { executorOutput: output }),
+        });
+        const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'succeeded', output: result });
         if (!attempt.ok)
             return attempt;
         const executionEvent = this.runs.appendEvent({
@@ -522,7 +549,7 @@ export class RunService {
                 operationFingerprint: replayGuard.operationFingerprint,
                 resumedFromApprovalId: approval.value.id,
                 executorInvoked: true,
-                output: output ?? null,
+                result,
             }),
             relatedType: 'approval',
             relatedId: approval.value.id,
@@ -530,7 +557,7 @@ export class RunService {
         if (!executionEvent.ok)
             return { ok: false, error: executionEvent.error };
         const linkedAttempt = this.runs.attachAttemptResultEvent(attempt.value.id, executionEvent.value.id);
-        const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, output, undefined);
+        const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, result);
         if (!evidence.ok)
             return { ok: false, error: evidence.error };
         return {
@@ -542,7 +569,7 @@ export class RunService {
                 attempt: linkedAttempt.ok ? linkedAttempt.value : attempt.value,
                 executionEvent: executionEvent.value,
                 status: 'succeeded',
-                ...(output === undefined ? {} : { output }),
+                output: result,
                 ...(evidence.value === undefined ? {} : evidence.value),
             },
         };
@@ -1002,24 +1029,21 @@ function workflowConflictDecision(input, runWorkflow) {
         auditEvidence: [`runWorkflow:${runWorkflow}`, `explicitWorkflow:${input.workflow}`],
     };
 }
-function appendApplyProgressAllowlistEvidenceIfNeeded(runs, approvalId, permissionEvent, pendingExecutionEvent, attempt, executionEvent, operationFingerprint, executorName, operation, output, error) {
+function appendApplyProgressAllowlistEvidenceIfNeeded(runs, approvalId, permissionEvent, pendingExecutionEvent, attempt, executionEvent, operationFingerprint, executorName, operation, result) {
     if (!isApplyProgressAllowlistedCommandOperation(operation))
         return { ok: true, value: undefined };
     const base = {
-        kind: 'apply-progress-operation',
-        operationKind: 'allowlisted-command',
-        runId: attempt.runId,
-        approvalId,
-        attemptId: attempt.id,
-        pendingExecutionEventId: pendingExecutionEvent.id,
-        permissionEventId: permissionEvent.id,
+        ...result,
         executionEventId: executionEvent.id,
-        operationFingerprint,
-        executor: executorName,
-        operation: operationMetadata(operation),
-        status: attempt.status,
-        output: output ?? null,
-        error: error ?? null,
+        audit: {
+            metadataOnly: true,
+            operationFingerprint,
+            executor: executorName,
+            approvalId,
+            pendingExecutionEventId: pendingExecutionEvent.id,
+            permissionEventId: permissionEvent.id,
+            attemptId: attempt.id,
+        },
     };
     const evidence = runs.appendEvent({
         runId: attempt.runId,

package/dist/runs/sandbox-process-execution.js

@@ -162,6 +162,11 @@ function acceptedEvidence(workspaceRoot, cwd, checks) {
         enforceable: true,
         createsSandbox: false,
         createsWorktree: false,
+        filesystemIsolation: false,
+        networkIsolation: false,
+        shellDisabled: true,
+        argvArrayOnly: true,
+        providerConfigWritesBlocked: true,
         workspaceRoot,
         cwd,
         capabilities: {

package/dist/workflows/command-allowlist-adapter.js

@@ -55,16 +55,31 @@ export class CommandAllowlistAdapter {
         const result = this.runner(this.request);
         if (!result.ok)
             throw new Error(`${result.error.code}: ${result.error.message}`);
+        const stdoutBytes = Buffer.byteLength(result.value.stdout);
+        const stderrBytes = Buffer.byteLength(result.value.stderr);
+        const safety = {
+            strategy: result.value.evidence.strategy,
+            boundedProcess: true,
+            createsSandbox: result.value.evidence.createsSandbox,
+            createsWorktree: result.value.evidence.createsWorktree,
+            filesystemIsolation: result.value.evidence.filesystemIsolation,
+            networkIsolation: result.value.evidence.networkIsolation,
+            shellDisabled: result.value.evidence.shellDisabled,
+            argvArrayOnly: result.value.evidence.argvArrayOnly,
+            providerConfigWritesBlocked: result.value.evidence.providerConfigWritesBlocked,
+        };
         const output = {
-            command: this.commandId,
+            commandId: this.commandId,
             executable: this.entry.executable,
-            args: this.entry.args,
+            argv: [this.entry.executable, ...this.entry.args],
+            cwd: this.plan.request.cwd,
             exitCode: result.value.exitCode,
             signal: result.value.signal,
             timedOut: result.value.timedOut,
             outputTruncated: result.value.outputTruncated,
-            stdout: result.value.stdout,
-            stderr: result.value.stderr,
+            stdoutBytes,
+            stderrBytes,
+            safety,
         };
         const failed = result.value.timedOut || result.value.exitCode !== 0;
         return {
@@ -77,6 +92,11 @@ export class CommandAllowlistAdapter {
                 shell: false,
                 argv: [this.entry.executable, ...this.entry.args],
                 cwd: this.plan.request.cwd,
+                stdoutBytes,
+                stderrBytes,
+                outputTruncated: result.value.outputTruncated,
+                timedOut: result.value.timedOut,
+                safety,
             },
             ...(failed
                 ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vgxness",
-  "version": "1.19.5",
+  "version": "1.19.7",
   "description": "CLI and MCP control plane for guided AI-agent workflows, SDD, memory, and OpenCode setup.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {