bpsai-pair 2.28.1__tar.gz → 2.28.2__tar.gz

{bpsai_pair-2.28.1/bpsai_pair.egg-info → bpsai_pair-2.28.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bpsai-pair
-Version: 2.28.1
+Version: 2.28.2
 Summary: AI-augmented pair programming framework with 220+ CLI commands for planning, orchestration, Trello/GitHub integration, and autonomous workflows
 Author-email: BPS AI Software <support@paircoder.ai>
 License-Expression: LicenseRef-Proprietary
@@ -29,6 +29,7 @@ Requires-Dist: pyyaml>=6.0
 Requires-Dist: tiktoken>=0.5.0
 Requires-Dist: pydantic>=2.0
 Requires-Dist: cryptography>=41.0
+Requires-Dist: keyring>=25.0
 Requires-Dist: fastapi>=0.109.0
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: uvicorn>=0.27.0
@@ -182,6 +183,11 @@ Check your license: `bpsai-pair license status`
 
 > Full release history and detailed notes: [paircoder.ai](https://paircoder.ai).
 
+**v2.28.2 — Latest-model support + engage durability (patch)**
+- Claude Sonnet 5 and Fable 5 selectable in the wizard/config; current-gen context limits corrected to 1M for accurate budgets.
+- Engage pushes its branch at kickoff and after every task — crash durability + mid-run visibility.
+- Fixes: engage on Windows, `support create`/`list` scope, `upgrade` artifact hygiene, fail-closed `review pr`, engage auto-PR `--head`.
+
 **v2.28.0 — Cross-repo engage, provider-agnostic PM, plan-time arch headroom (minor)**
 
 - **Cross-repo engage.** A sprint can target sibling repos — engage commits, branches, opens PRs, and verifies in the right repo per task; backlogs declare a `Target repo:` (backlog-level or per-task), and QA/security/review fan out across every touched repo.

{bpsai_pair-2.28.1 → bpsai_pair-2.28.2}/README.md

@@ -108,6 +108,11 @@ Check your license: `bpsai-pair license status`
 
 > Full release history and detailed notes: [paircoder.ai](https://paircoder.ai).
 
+**v2.28.2 — Latest-model support + engage durability (patch)**
+- Claude Sonnet 5 and Fable 5 selectable in the wizard/config; current-gen context limits corrected to 1M for accurate budgets.
+- Engage pushes its branch at kickoff and after every task — crash durability + mid-run visibility.
+- Fixes: engage on Windows, `support create`/`list` scope, `upgrade` artifact hygiene, fail-closed `review pr`, engage auto-PR `--head`.
+
 **v2.28.0 — Cross-repo engage, provider-agnostic PM, plan-time arch headroom (minor)**
 
 - **Cross-repo engage.** A sprint can target sibling repos — engage commits, branches, opens PRs, and verifies in the right repo per task; backlogs declare a `Target repo:` (backlog-level or per-task), and QA/security/review fan out across every touched repo.

{bpsai_pair-2.28.1 → bpsai_pair-2.28.2}/bpsai_pair/cli_startup.py

@@ -25,26 +25,54 @@ def version_callback(value: bool):
         raise typer.Exit()
 
 
+def _check_expired_license():
+    """Hard-fail if an expired subscription/trial license is installed (LA3.3).
+
+    Perpetual licenses are unaffected (is_expired returns False for them).
+    """
+    import sys
+
+    from .licensing.core import is_expired
+    from .licensing.unchecked import load_license_unchecked
+
+    unchecked = load_license_unchecked()
+    if unchecked is None or not is_expired(unchecked):
+        return
+
+    ltype = unchecked.payload.type
+    if ltype not in ("subscription", "trial"):
+        return
+
+    exp = unchecked.payload.expires_at
+    date_str = exp.strftime("%Y-%m-%d") if exp else "unknown"
+    err_console = Console(file=sys.stderr)
+    err_console.print(
+        f"[bold red]Your {ltype} license expired on {date_str}.[/bold red]\n"
+        f"Renew at [cyan]https://paircoder.ai/pricing[/cyan] "
+        f"or run: [cyan]bpsai-pair license renew[/cyan]"
+    )
+    sys.exit(2)
+
+
 def _run_license_validation():
     """Run license validation on startup (silent for non-critical signals).
 
-    License validation runs in background. Errors are NOT printed here to avoid
-    polluting JSON output and quiet mode commands. Users can check license status
-    with `bpsai-pair license status`.
-
     Hard-fail conditions (exit non-zero with stderr message):
+      - Expired subscription/trial license — LA3.3
       - Revoked license — always
       - machine_activated=False AND past grace period — T45.22 (#157)
 
-    Other signals (license-not-found, expired warnings, etc.) stay silent;
-    `bpsai-pair license status` exposes the full state.
+    Network/import errors are caught gracefully (offline grace preserved).
     """
     try:
         import sys
 
+        from .licensing.online import NetworkError
         from .licensing.startup import run_startup_validation
         from .licensing.binding import is_in_grace_period
 
+        _check_expired_license()
+
         result = run_startup_validation()
         if result is None:
             return
@@ -56,10 +84,6 @@ def _run_license_validation():
             err_console.print(f"[bold red]License revoked:[/bold red] {reason}")
             sys.exit(2)
 
-        # T45.22 #157: server says this machine isn't activated. The local
-        # binding.is_machine_activated check uses grace period as a fallback;
-        # mirror that here so a fresh install isn't immediately locked out.
-        # Once the grace window passes, fail closed with the activation prompt.
         if not result.machine_activated and not is_in_grace_period():
             err_console.print(
                 "[bold red]License not activated on this machine.[/bold red]\n"
@@ -68,9 +92,9 @@ def _run_license_validation():
             )
             sys.exit(2)
     except SystemExit:
-        raise  # honor sys.exit calls above
-    except Exception:
-        pass  # Don't block CLI on validation errors (network, parse, etc.)
+        raise
+    except (NetworkError, ConnectionError, TimeoutError, OSError, ImportError):
+        pass  # Don't block CLI on network/import errors
 
 
 def _find_project_root():

{bpsai_pair-2.28.1 → bpsai_pair-2.28.2}/bpsai_pair/commands/arch_lint_commands.py

@@ -129,15 +129,25 @@ def _register_wiring(app: typer.Typer) -> None:
             False, "--strict",
             help="Exit non-zero on any finding (default: advisory, exit 0)",
         ),
+        gen_baseline: bool = typer.Option(
+            False, "--generate-baseline",
+            help="Write .wiring-baseline.json with current findings and exit",
+        ),
     ):
         """Flag public symbols/modules written but never wired in (#384).
 
         Catches the dead-on-arrival class: a public symbol/module unit-tested but
         never invoked/imported in the package. Exempts ``__all__``, CLI callbacks,
         tests, dunders/``main``, string refs, and ``[project.scripts]``. ADVISORY
-        by default (exit 0); use --strict to gate in CI. See ``arch_wiring`` /
-        ``core.reachability_lint`` for details and caveats.
+        by default (exit 0); use --strict to gate in CI.
+
+        Use --generate-baseline to snapshot current findings into
+        ``.wiring-baseline.json`` (committed, reviewable debt allowlist).
         """
-        from .arch_wiring import run_check_wiring
+        from .arch_wiring import generate_baseline, run_check_wiring
 
+        if gen_baseline:
+            outpath = generate_baseline(path, Path.cwd())
+            console.print(f"[green]✓ Baseline written to {outpath}[/green]")
+            raise typer.Exit(code=0)
         run_check_wiring(path, strict)

bpsai_pair-2.28.2/bpsai_pair/commands/arch_wiring.py

@@ -0,0 +1,161 @@
+"""Render logic for ``bpsai-pair arch check-wiring`` (#384, #WG2.3).
+
+Kept separate from ``arch.py`` so the Typer wrapper there stays thin and the
+module stays under the architecture line limit. The command body reads
+``[project.scripts]`` entry points from the nearest ``pyproject.toml`` so
+console-script symbols are not flagged as unwired.
+
+WG2.3 additions:
+- ``generate_baseline()`` writes ``.wiring-baseline.json`` for a repo.
+- ``run_check_wiring_core()`` returns filtered findings (baseline-aware).
+- ``run_check_wiring()`` uses baseline filtering before reporting.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import typer
+from rich.console import Console
+
+from ..core.reachability_lint import Finding, check_directory
+from ..orchestration.wiring_review import filter_baseline, load_baseline
+
+console = Console()
+
+_BASELINE_FILE = ".wiring-baseline.json"
+
+
+def _entry_point_symbols(start: Path) -> set[str]:
+    """Read symbol names from the nearest pyproject ``[project.scripts]``.
+
+    ``foo = "pkg.mod:func"`` contributes the symbol ``func``. Best-effort:
+    returns an empty set if no pyproject or tomllib is available.
+    """
+    try:
+        import tomllib
+    except ModuleNotFoundError:  # pragma: no cover - py<3.11
+        return set()
+    for parent in [start, *start.resolve().parents]:
+        candidate = parent / "pyproject.toml"
+        if not candidate.is_file():
+            continue
+        try:
+            data = tomllib.loads(candidate.read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            return set()
+        scripts = data.get("project", {}).get("scripts", {})
+        return {str(v).rsplit(":", 1)[-1] for v in scripts.values() if ":" in str(v)}
+    return set()
+
+
+def _relativize(finding_path: Path, scan_root: Path) -> str:
+    """Return the finding path relative to scan_root, as posix."""
+    try:
+        return finding_path.resolve().relative_to(scan_root.resolve()).as_posix()
+    except ValueError:
+        return finding_path.as_posix()
+
+
+def _findings_to_baseline_json(
+    findings: list[Finding], scan_root: Path,
+) -> list[dict]:
+    """Convert findings to the baseline JSON format with relative paths."""
+    return [
+        {
+            "file": _relativize(f.file, scan_root),
+            "symbol": f.symbol,
+            "kind": f.kind,
+        }
+        for f in findings
+    ]
+
+
+def generate_baseline(path: str, project_root: Path) -> Path:
+    """Produce ``.wiring-baseline.json`` from current findings.
+
+    Scans ``path`` for unwired symbols/modules and writes the full set
+    as the baseline allowlist at ``project_root / .wiring-baseline.json``.
+    Paths are stored relative to the scan root for portability.
+    Returns the path to the written file.
+    """
+    target = Path(path)
+    findings = check_directory(target, entry_points=_entry_point_symbols(target))
+    data = _findings_to_baseline_json(findings, target)
+    outpath = project_root / _BASELINE_FILE
+    outpath.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+    return outpath
+
+
+def _normalize_findings_for_baseline(
+    findings: list[Finding], scan_root: Path,
+) -> list[Finding]:
+    """Rewrite finding paths to be relative to scan_root (for baseline matching)."""
+    out: list[Finding] = []
+    for f in findings:
+        rel = _relativize(f.file, scan_root)
+        out.append(Finding(kind=f.kind, symbol=f.symbol, file=Path(rel), line=f.line))
+    return out
+
+
+def run_check_wiring_core(
+    path: str, *, baseline_root: Path | None = None,
+) -> list[Finding]:
+    """Return non-baselined findings (no I/O side-effects).
+
+    Scans ``path`` for unwired symbols, loads the baseline from
+    ``baseline_root`` (if provided), and returns only NEW findings
+    that are not in the baseline allowlist.  Baseline entries use
+    paths relative to ``baseline_root``, so findings are normalized
+    relative to ``baseline_root`` (not the scan root) when filtering.
+    """
+    target = Path(path)
+    findings = check_directory(target, entry_points=_entry_point_symbols(target))
+    if baseline_root is not None:
+        baseline = load_baseline(baseline_root)
+        if baseline:
+            findings = _normalize_findings_for_baseline(findings, baseline_root)
+            findings = filter_baseline(findings, baseline)
+    return findings
+
+
+def run_check_wiring(path: str, strict: bool) -> None:
+    """Execute the wiring/reachability advisory lint and print findings.
+
+    Loads ``.wiring-baseline.json`` from the nearest project root and
+    excludes baselined findings. Advisory: exits 0 unless ``strict``
+    is set. Raises ``typer.Exit``.
+    """
+    target = Path(path)
+    if not target.exists():
+        console.print(f"[red]Error: Path not found: {target}[/red]")
+        raise typer.Exit(code=2)
+
+    baseline_root = _find_baseline_root(target)
+    findings = run_check_wiring_core(path, baseline_root=baseline_root)
+    if not findings:
+        console.print(f"[green]✓ No unwired public symbols/modules in {target}[/green]")
+        raise typer.Exit(code=0)
+
+    symbols = [f for f in findings if f.kind == "symbol"]
+    modules = [f for f in findings if f.kind == "module"]
+    console.print(
+        f"[yellow]⚠ {len(findings)} possibly-unwired item(s) in {target} "
+        f"({len(symbols)} symbol(s), {len(modules)} module(s)) — "
+        f"advisory, confirm before acting:[/yellow]\n"
+    )
+    for f in findings:
+        console.print(f"  {f.message()}")
+    console.print(
+        "\n[dim]Static analysis cannot see dynamic dispatch; treat these as "
+        "candidates, not proof.[/dim]"
+    )
+    raise typer.Exit(code=1 if strict else 0)
+
+
+def _find_baseline_root(start: Path) -> Path | None:
+    """Walk up from ``start`` to find a directory with .wiring-baseline.json."""
+    for parent in [start, *start.resolve().parents]:
+        if (parent / _BASELINE_FILE).is_file():
+            return parent
+    return None

{bpsai_pair-2.28.1 → bpsai_pair-2.28.2}/bpsai_pair/commands/budget.py

@@ -128,6 +128,7 @@ def _find_task_file(task_id: str, root: Path) -> Optional[Path]:
 
 _MODEL_COST_PER_1K = {
     "opus": 0.005,    # Opus 4.5/4.6: $5/MTok input
+    "fable": 0.010,   # Fable 5: $10/MTok input
     "sonnet": 0.003,  # Sonnet 4.0/4.5: $3/MTok input
     "haiku": 0.001,   # Haiku 4.5: $1/MTok input
 }

{bpsai_pair-2.28.1 → bpsai_pair-2.28.2}/bpsai_pair/commands/engage.py

@@ -13,6 +13,7 @@ from bpsai_pair.commands.engage_branch import (  # noqa: F401
     _cleanup_orphan_branch,
     _create_feature_branch,
     _validate_branch_name,
+    push_branch_at_kickoff,
 )
 from bpsai_pair.commands.engage_guards import (  # noqa: F401
     _check_protected_branch,
@@ -124,7 +125,7 @@ def engage(
     if dry_run:
         project_root = repo_root()
         _run_containment_audit_display(parsed.tasks, project_root)
-        return _show_dry_run(parsed, json_out)
+        return _show_dry_run(parsed, json_out, project_root=project_root)
     env_overrides = _resolve_provider(provider) if provider else {}
     if not sprint:
         sprint = _infer_sprint(parsed)
@@ -157,7 +158,11 @@ from bpsai_pair.commands.engage_plan_id import (  # noqa: E402, F401
     _dispatch_navigator,  # re-exported for tests importing it from engage
     resolve_reuse_plan_id as _resolve_reuse_plan_id,
 )
-from bpsai_pair.commands.engage_executor import execute_sprint as _execute_sprint  # noqa: E402, F401
+from bpsai_pair.commands.engage_executor import (  # noqa: E402, F401
+    execute_sprint as _execute_sprint,
+    fan_out_sibling_branches as _fan_out_sibling_branches,
+    preflight_parallel_same_target as _preflight_parallel_same_target,
+)
 # CR.4.1 (#411): result rendering lives in ``engage_result`` (line cap);
 # re-exported so ``engage._output_result`` / ``engage._show_result`` /
 # ``engage._result_dict`` patch targets keep resolving.
@@ -296,24 +301,6 @@ def _run_preflight(
     return outcome, preflight_block
 
 
-def _fan_out_sibling_branches(
-    parsed: Any, project_root: Path, active_branch: str,
-    touched_siblings: list[tuple[Path, str | None]] | None,
-) -> None:
-    """Create the SIBLING engage branches (CR-R7) and record them (CR-R9).
-
-    Runs only AFTER the preflight gate passes and BEFORE dispatch. Records each
-    touched sibling (with its prior branch) into ``touched_siblings`` so a later
-    sprint failure can restore those working trees (see ``_run_engage``).
-    """
-    if not active_branch:
-        return
-    touched = _branch_multi.create_cross_repo_branch(
-        parsed, project_root, active_branch)
-    if touched_siblings is not None:
-        touched_siblings.extend(touched)
-
-
 def _run_sprint_pipeline(
     run_root: Path, backlog_path: Path, parsed: Any,
     sprint: str, max_parallel: int,
@@ -324,9 +311,7 @@ def _run_sprint_pipeline(
     touched_siblings: list[tuple[Path, str | None]] | None = None,
 ) -> dict[str, Any]:
     """Execute planning, sprint, and finalization in *run_root*."""
-    if project_root is None:
-        project_root = run_root
-
+    project_root = project_root or run_root
     reuse_plan_id = _resolve_reuse_plan_id(
         run_root, backlog_path, parsed, skip_planning, resume,
     )  # paircoder#388: reconcile onto Navigator id, not divergent engage id
@@ -336,13 +321,14 @@ def _run_sprint_pipeline(
     backlog_target, per_task_repos = _preflight.resolve_targets_or_refuse(
         parsed, project_root,
     )
-    _, preflight_block = _run_preflight(
-        backlog_target, per_task_repos, project_root,
-    )
+    _, preflight_block = _run_preflight(backlog_target, per_task_repos, project_root)
+    # EH2.3: parallel-same-target guard is a preflight -> run BEFORE fan-out (below) so a refused plan branches no siblings.
+    _preflight_parallel_same_target(run_root, plan_id, max_parallel, backlog_target, per_task_repos)
     from bpsai_pair.pm_trello.backlog_engage import create_backlog_tree_for_engage as _create_bt  # noqa: E402
     _create_bt(run_root, plan_id, parsed)  # #430: after preflight → refused runs leave no orphan PM cards
-    _fan_out_sibling_branches(
-        parsed, project_root, active_branch, touched_siblings)
+    # EH1.1 (#427): push the branch to origin before dispatch (best-effort durability).
+    push_branch_at_kickoff(run_root, active_branch)
+    _fan_out_sibling_branches(parsed, project_root, active_branch, touched_siblings)
     result = _execute_sprint(
         run_root, plan_id, max_parallel, completed_tasks=completed,
         target_repo=backlog_target,

{bpsai_pair-2.28.1 → bpsai_pair-2.28.2}/bpsai_pair/commands/engage_branch.py

@@ -15,6 +15,12 @@ from bpsai_pair.commands.engage_guards import (
     _check_protected_branch,
     _derive_branch_slug,
 )
+# EH1.1 (#427): kickoff push helper lives in ``orchestration.engage_push``
+# (keeps engage.py under the arch cap); re-exported here so engage.py can call
+# it via its existing ``engage_branch`` import block without a new import stmt.
+from bpsai_pair.orchestration.engage_push import (  # noqa: F401
+    push_branch_at_kickoff,
+)
 
 logger = logging.getLogger(__name__)
 

{bpsai_pair-2.28.1 → bpsai_pair-2.28.2}/bpsai_pair/commands/engage_branch_multi.py

@@ -121,7 +121,10 @@ def restore_siblings_on_failure(
     for repo, prior in touched:
         if prior:
             restored = subprocess.run(
-                ["git", "checkout", prior],
+                # EH2.1: ``switch --`` end-of-options guard so a flag-like prior
+                # branch name is never parsed as an option (defense-in-depth;
+                # refs are ``_validate_branch_name``-checked upstream).
+                ["git", "switch", "--", prior],
                 cwd=repo, capture_output=True, check=False,
                 encoding="utf-8", errors="replace",
             )
@@ -289,18 +292,22 @@ def _safe_checkout_engage_branch(repo: Path, branch: str) -> None:
     branch from whatever the sibling had checked out (stale feature branch /
     dirty ``main``), so the later PR diff could carry unrelated work. We now
     resolve the repo's base/default branch and cut FROM it. Idempotent: if the
-    engage branch already exists (re-run), ``checkout -b`` fails and we fall
-    back to a plain checkout.
+    engage branch already exists (re-run), ``switch -c`` fails and we fall
+    back to a plain ``switch``.
     """
     base = _detect_pr_base(repo)
     created = subprocess.run(
-        ["git", "checkout", "-b", branch, base],
+        # EH2.1: ``switch -c … -- <base>`` end-of-options guard so a flag-like
+        # base ref is never parsed as an option (the new branch name is safe as
+        # the ``-c`` argument). Mirrors the push/rev-list/gh hardening.
+        ["git", "switch", "-c", branch, "--", base],
         cwd=repo, capture_output=True, check=False,
         encoding="utf-8", errors="replace",
     )
     if created.returncode != 0:
         fallback = subprocess.run(
-            ["git", "checkout", branch],
+            # EH2.1: ``switch --`` end-of-options guard on the fallback ref too.
+            ["git", "switch", "--", branch],
             cwd=repo, capture_output=True, check=False,
             encoding="utf-8", errors="replace",
         )
@@ -321,7 +328,7 @@ def create_branch_in_repos(repos: list[Path], branch: str) -> None:
     each repo is also checked for a clean tree and a non-protected branch name
     (CR-R2, Finding B), mirroring the run repo's ``_setup_branch`` rigor. The
     branch is created FROM the repo's resolved base; if it already exists
-    (re-run) the checkout falls back to a plain checkout instead of failing.
+    (re-run) the create falls back to a plain ``switch`` instead of failing.
     """
     # CR-R3 (P2-1): the sibling fan-out is a funnel for the run-repo slug, an
     # explicit ``--branch`` flag, AND the derived engage name -- validate the

bpsai_pair-2.28.2/bpsai_pair/commands/engage_executor.py

@@ -0,0 +1,116 @@
+"""Sprint execution helper extracted from engage.py to keep that file
+under the 400-line architecture limit.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+from bpsai_pair.orchestration.headless import HEADLESS_ALLOWED_TOOLS
+
+
+def preflight_parallel_same_target(
+    project_root: Path, plan_id: str, max_parallel: int,
+    backlog_target: Path | None = None,
+    per_task_target_repos: dict[str, Path] | None = None,
+) -> None:
+    """Refuse a parallel-same-target plan BEFORE any sibling mutation (EH2.3).
+
+    The parallel-same-target check is logically a PREFLIGHT: it refuses a
+    ``ExecutionMode.PARALLEL`` phase whose tasks share one un-isolated sibling
+    target repo. ``_run_sprint_pipeline`` calls this BEFORE
+    ``_fan_out_sibling_branches`` so a refused plan branches no siblings (nothing
+    to restore). ``execute_sprint`` still runs the same guard as an idempotent
+    backstop -- that call also covers the resume path, which re-enters through
+    ``execute_sprint`` rather than the fresh pipeline.
+
+    A same-repo run (no per-task overrides and no sibling backlog target) has no
+    sibling target at all, so no parallel-same-sibling conflict is possible --
+    return early without building the plan graph. Only a sibling target (set via
+    ``per_task_target_repos`` or a cross-repo ``backlog_target``) can conflict.
+    """
+    if not per_task_target_repos and backlog_target is None:
+        return
+    from bpsai_pair.orchestration import plan_graph
+    from bpsai_pair.orchestration.target_repo_resolution import (
+        guard_parallel_same_target,
+    )
+    graph = plan_graph.PlanGraphBuilder(project_root).build(plan_id)
+    guard_parallel_same_target(
+        graph, per_task_target_repos, backlog_target, project_root,
+        max_parallel=max_parallel,
+    )
+
+
+def fan_out_sibling_branches(
+    parsed: Any, project_root: Path, active_branch: str,
+    touched_siblings: list[tuple[Path, str | None]] | None,
+) -> None:
+    """Create the SIBLING engage branches (CR-R7) and record them (CR-R9).
+
+    Runs after the preflight gate + parallel-same-target guard pass and before
+    dispatch; records each touched sibling (with its prior branch) into
+    ``touched_siblings`` so a later sprint failure can restore those working
+    trees (see ``_run_engage``). EH2.3 relocated this here (from ``engage``) so
+    the guard can run before it while keeping ``engage`` under the arch line cap.
+    """
+    from bpsai_pair.commands import engage_branch_multi as _branch_multi
+
+    if not active_branch:
+        return
+    touched = _branch_multi.create_cross_repo_branch(
+        parsed, project_root, active_branch)
+    if touched_siblings is not None:
+        touched_siblings.extend(touched)
+
+
+def execute_sprint(
+    project_root: Path, plan_id: str, max_parallel: int,
+    completed_tasks: list[str] | None = None,
+    target_repo: Path | None = None,
+    per_task_target_repos: dict[str, Path] | None = None,
+    env_overrides: dict[str, str] | None = None,
+) -> Any:
+    """Build plan graph and execute tasks via headless runner.
+
+    EH1.6: ``target_repo`` (from backlog ``**Target repo:**``) sets
+    SprintConfig.target_repo so the no-output detector reads the
+    sibling repo instead of the orchestrator cwd.
+
+    PD4 (2026-05-27): ``per_task_target_repos`` carries per-task
+    overrides for multi-repo backlogs. Each task whose
+    ``ParsedTask.target_repo`` resolved cleanly contributes a
+    ``{task_id: Path}`` entry; the executor picks the per-task value
+    when present, then falls back to ``target_repo``.
+    """
+    from bpsai_pair.orchestration import (
+        sprint_executor, plan_graph, headless_runner,
+    )
+    from bpsai_pair.orchestration.target_repo_resolution import (
+        guard_parallel_same_target,
+    )
+    graph = plan_graph.PlanGraphBuilder(project_root).build(plan_id)
+    for tid in completed_tasks or []:
+        graph.mark_done(tid)
+    # CR-R8 (P1) + R10 Fix 3 (Codex P1): refuse a PARALLEL phase sharing one
+    # sibling target before dispatch, but only when effective parallelism > 1
+    # (``--max-parallel 1`` serializes -> safe; the executor uses min(mp, n)).
+    guard_parallel_same_target(
+        graph, per_task_target_repos, target_repo, project_root,
+        max_parallel=max_parallel,
+    )
+    config = sprint_executor.SprintConfig(
+        max_parallel=max_parallel, target_repo=target_repo,
+        per_task_target_repos=per_task_target_repos or {},
+        env_overrides=env_overrides or {},
+    )
+    task_runner = headless_runner._make_headless_runner(
+        project_root, permission_mode="auto",
+        allowed_tools=HEADLESS_ALLOWED_TOOLS, approved_by="engage-cli",
+        sprint_config=config,
+    )
+    task_hook = sprint_executor.make_default_task_hook(project_root)
+    return sprint_executor.SprintExecutor(
+        project_root, graph, config,
+        task_runner=task_runner, task_complete_hook=task_hook,
+    ).execute()

{bpsai_pair-2.28.1 → bpsai_pair-2.28.2}/bpsai_pair/commands/engage_pause_resume.py

@@ -31,6 +31,10 @@ from bpsai_pair.commands.engage_guards import (
 from bpsai_pair.commands.engage_executor import execute_sprint as _execute_sprint
 from bpsai_pair.core.utils import repo_root
 from bpsai_pair.orchestration.backlog_parser import BacklogParser
+from bpsai_pair.commands.engage_resume_integrity import (
+    _confine_persisted_repos,
+    enforce_repo_set_agreement_or_exit,
+)
 from bpsai_pair.orchestration.engage_run_state import (
     load_run_state, save_pause_state, verify_paused_task_done,
 )
@@ -96,36 +100,6 @@ def handle_pause(
     return _result_dict(result, paused_task=result.paused_task, run_id=run_id)
 
 
-def _confine_persisted_repos(
-    raw: dict[str, str], project_root: Path,
-) -> dict[str, Path]:
-    """Re-apply the workspace-boundary check to every persisted
-    ``per_task_target_repos`` entry on resume.
-
-    P2-Laverna on PR #348 re-review: persisted paths come from a state.json an
-    attacker with local write access could tamper with -- a planted ``"/etc"``
-    (outside ``project_root.parent``) would become the ``cwd`` of git
-    subprocess calls. Drop+WARN on escapes so the run continues with the fresh
-    backlog re-resolution rather than trusting the poisoned state.
-    """
-    boundary = project_root.resolve().parent
-    cleaned: dict[str, Path] = {}
-    for tid, raw_path in raw.items():
-        candidate = Path(raw_path).resolve()
-        try:
-            candidate.relative_to(boundary)
-        except ValueError:
-            logger.warning(
-                "resume: persisted target_repo for %s (%s) escapes the "
-                "workspace boundary (%s); dropping. Will re-resolve from "
-                "backlog if the task is still listed.",
-                tid, raw_path, boundary,
-            )
-            continue
-        cleaned[tid] = candidate
-    return cleaned
-
-
 def _rehydrate_per_task_repos(
     state, project_root: Path,
 ) -> tuple[Path | None, dict[str, Path]]:
@@ -300,13 +274,14 @@ def resume_engage(run_id: str) -> dict[str, Any]:
     so the security scan + PR + review cover EVERY touched repo on resume.
 
     CR-followup (Codex P1, drift): the ``parsed`` driving the fan-out AND
-    finalize is now SYNTHESIZED from the rehydrated ``per_task_repos`` map (the
-    SAME set ``_execute_sprint`` commits to), NOT a freshly re-parsed backlog. A
-    backlog edited between pause and resume can no longer make the
-    branched/scanned/PR'd set diverge from the committed set -- the invariant is
-    branched == scanned == PR'd == committed. CR-R11 Fix 1: dispatch + finalize
-    run inside a failure guard (``_execute_and_finalize_resume``) that restores
-    stranded siblings on a raised exception.
+    finalize is SYNTHESIZED from the rehydrated ``per_task_repos`` map (the SAME
+    set ``_execute_sprint`` commits to), NOT a freshly re-parsed backlog -- the
+    invariant is branched == scanned == PR'd == committed. EH2.4: that set must
+    also agree with a fresh re-resolution of the on-disk backlog -- divergence
+    (an edited backlog) refuses loudly BEFORE fan-out/dispatch. CR-R11 Fix 1:
+    dispatch + finalize run inside a failure guard
+    (``_execute_and_finalize_resume``) that restores stranded siblings on a
+    raised exception.
     """
     project_root = repo_root()
     state = load_run_state(project_root, run_id)
@@ -325,6 +300,11 @@ def resume_engage(run_id: str) -> dict[str, Any]:
     parsed = _branch_multi.build_parsed_from_repo_map(
         per_task_repos, project_root, target_repo_path,
     )
+    # EH2.4: the set dispatch/fan-out act on must agree with the on-disk
+    # backlog -- an edited backlog fails loud here, before any fan-out.
+    enforce_repo_set_agreement_or_exit(
+        parsed, state.backlog_path or "", project_root,
+    )
     touched_siblings = _fan_out_resume_siblings(
         parsed, project_root, active_branch,
     )