@appchy/jarvis 0.1.85 → 0.1.86

package/dist/bin.js

@@ -10114,7 +10114,7 @@ import { createRequire as createRequire2 } from "module";
 var _require = createRequire2(import.meta.url);
 var VERSION2 = _require("../package.json").version ?? "0.0.0";
 var IS_DEV = String(_require("../package.json").name ?? "").endsWith("-dev");
-var SHA = "f9f9db3";
+var SHA = "5acb5ea";
 var BUILT = "2026-09-11";
 var BUILD = SHA ?? "source";
 var BUILD_LABEL = `${SHA ? `${VERSION2} (${SHA}${BUILT ? ` ${BUILT}` : ""})` : `${VERSION2} (source)`}${IS_DEV ? " \u2014 development build" : ""}`;

package/harness/harness/config.py

@@ -548,12 +548,11 @@ def _validate(cfg: dict) -> None:
         # would commit files nobody asked about. Refused at load, where it is one
         # message, rather than at the commit, where it is a surprise in somebody's
         # history.
-        if Path(p).is_absolute() or ".." in Path(p).parts:
+        if _escapes(p):
             raise ConfigError(f"git.paths entry {p!r} must be repo-relative and stay "
                               f"inside the repo")
     shard = cfg["coverage"]["shard"]
-    if (not isinstance(shard, str) or not shard.strip()
-            or Path(shard).is_absolute() or ".." in Path(shard).parts):
+    if not isinstance(shard, str) or not shard.strip() or _escapes(shard):
         raise ConfigError("coverage.shard must be a repo-relative directory where "
                           "test runners drop their evidence, e.g. \".work/coverage\"")
     at = cfg["wrap"]["at_percent"]
@@ -587,6 +586,19 @@ def _validate(cfg: dict) -> None:
                           "session up, or null to remind without naming one")
 
 
+def _escapes(value: str) -> bool:
+    """Could this path reach outside the repo it is written in?
+
+    Every path a repo names in its config is joined onto the repo root, so an
+    absolute one silently becomes the whole answer and a `..` walks out. One reader
+    for the question, because the two places that ask it — what a board write
+    commits, and where the runners drop their evidence — would otherwise each carry
+    their own copy of the same two conditions.
+    """
+    p = Path(value)
+    return p.is_absolute() or ".." in p.parts
+
+
 def load(repo: Path) -> dict:
     """The merged config for a repo. Missing file → the defaults, which is a
     working configuration and not an error: a fresh install must run."""
@@ -1425,7 +1437,13 @@ def _cmd_config_write(args) -> int:
         # and refusing to remove it would leave the only tool that can fix it
         # refusing on the grounds that the thing being fixed is broken.
         parts = [seg for seg in dotted.split(".") if seg]
-        if args["_verb"] != "unset" or not _present(raw, parts):
+        # `not parts` is the empty key, and it is the one thing this branch must not
+        # take for a repair: `_present` answers True for a path of no segments — the
+        # file trivially "contains" nothing — so an empty name walked straight past
+        # the check and into `parts[-1]`, which is an IndexError traceback on the
+        # command an installer shells out to. A key that names nothing is refused
+        # with the message the loader already wrote for it.
+        if args["_verb"] != "unset" or not parts or not _present(raw, parts):
             raise
         unknown = True
 

package/harness/harness/coverage.py

@@ -90,8 +90,15 @@ def cmd_coverage(args) -> int:
         return 0
 
     only = args.get("feature")
-    rows, totals = [], {"declared": 0, "built": 0, "proven": 0, "failed": 0,
-                        "todo": 0, "gap": 0, "ahead": 0, "eyes": 0, "unbuilt": 0,
+    # `built` is every criterion TICKED, and `provable` is the run-provable part of
+    # it — built minus the ones only a person can settle. They were one number under
+    # the name `built`, holding the value of `provable`, and that single misnomer is
+    # what produced both of the report's disagreements: the table's `built` column
+    # printed one of them while the ratio underneath divided by the other, and the
+    # roadmap line read `declared - built` and so counted every criterion a person
+    # had already looked at as behaviour nobody had written.
+    rows, totals = [], {"declared": 0, "built": 0, "provable": 0, "proven": 0,
+                        "failed": 0, "todo": 0, "gap": 0, "ahead": 0,
                         "unlevelled": 0}
     mismatched = []
 
@@ -125,7 +132,6 @@ def cmd_coverage(args) -> int:
         ahead = passed - built
         provable = built - eyes
         proven = (built & passed) - eyes
-
         for ac in sorted(declared):
             level = levels[ac][0]
             complaint = _wrong_level(level, runners.get(f"{name}/{ac}", set())) if level else None
@@ -133,21 +139,16 @@ def cmd_coverage(args) -> int:
                 mismatched.append(f"{name}/{ac}: {complaint}")
 
         totals["declared"] += len(declared)
-        totals["built"] += len(provable)
+        totals["built"] += len(built)
+        totals["provable"] += len(provable)
         totals["proven"] += len(proven)
         totals["failed"] += len(failed)
         totals["todo"] += len(built & todo)
         totals["gap"] += len(gap)
         totals["ahead"] += len(ahead)
-        totals["eyes"] += len(eyes)
-        # COUNTED, not derived from `declared - built`. An eyes-on criterion is
-        # built and comes out of the ratio, so subtracting the ratio's denominator
-        # reported every one of them as behaviour nobody had written yet.
-        totals["unbuilt"] += len(declared - built)
         totals["unlevelled"] += sum(1 for ac in declared if levels[ac][0] is None)
-        # The column is the ratio's own denominator. Counting all of `built` here
-        # while the ratio counted `provable` made the table disagree with the number
-        # printed under it, by exactly the eyes-on criteria.
+        # The column is the ratio's own denominator, so it counts what the ratio
+        # divides by and not everything ticked.
         rows.append((name, len(provable), len(proven), len(eyes),
                      len(built & todo), len(declared - built),
                      sorted(failed), sorted(gap), sorted(ahead)))
@@ -189,16 +190,20 @@ def cmd_coverage(args) -> int:
               f"{unbuilt:>8}   {note}")
 
     t = totals
-    rate = f"{100 * t['proven'] // t['built']}%" if t["built"] else "—"
-    print(f"\n  BUILT COVERAGE  {t['proven']}/{t['built']} = {rate} "
+    # Every count the tail reports is DERIVED from the three the loop kept, because
+    # a total that can be worked out and is stored anyway is a total that can
+    # disagree with the ones it was worked out from.
+    eyes, unbuilt = t["built"] - t["provable"], t["declared"] - t["built"]
+    rate = f"{100 * t['proven'] // t['provable']}%" if t["provable"] else "—"
+    print(f"\n  BUILT COVERAGE  {t['proven']}/{t['provable']} = {rate} "
           f"— of the RUN-PROVABLE promises this app keeps, how many a run proves\n"
           f"  {t['gap']} claimed with nothing to show · {t['todo']} declared-but-unwritten · "
           f"{t['failed']} failing\n")
-    print(f"  Settled by eyes, not by a run: {t['eyes']}. A look is a level, not an\n"
+    print(f"  Settled by eyes, not by a run: {eyes}. A look is a level, not an\n"
           f"  excuse — no assertion is evidence about weight, colour or rhythm — so\n"
           f"  these sit beside the ratio with the dated ✔ in the feature file as their\n"
           f"  evidence, never inside it.\n")
-    print(f"  Not built yet: {t['unbuilt']} of {t['declared']} promises. "
+    print(f"  Not built yet: {unbuilt} of {t['declared']} promises. "
           f"That is a roadmap, NOT a coverage hole —\n"
           f"  an unticked criterion is behaviour nobody has written, so counting it\n"
           f"  against coverage measures ambition rather than honesty.\n")

package/harness/harness/epic.py

@@ -196,10 +196,15 @@ def cmd_epic_move(args) -> int:
     # `epic.md` removed, so an epic promoted out of one arrives with nothing to
     # write — and reading it anyway raised after the folders had already moved,
     # leaving a half-moved tree no CLI command could put back.
-    md = dest / "epic.md"
-    if md.is_file():
+    #
+    # The model owns that fact and is asked for it, rather than re-stat'ing the
+    # moved path: `release` asks the same question the same way, and two
+    # implementations of "does this epic have a plan doc" is one more than there
+    # should be. The move relocates the file rather than replacing it, so what was
+    # read before it is still true after.
+    if epic.planned:
         rewrite_file(
-            md,
+            dest / "epic.md",
             lambda d: d.update({"updated": date.today().isoformat()}),
             EPIC_FM_ORDER,
         )

package/harness/harness/git.py

@@ -665,16 +665,6 @@ def _push(repo) -> tuple:
                    f"`{cli()} sync` sends it when you can reach {remote}.")
 
 
-#: Git's own complaint, wherever it sits in the stream. It is extracted rather than
-#: read off the first line because the first lines are a fetch banner and a progress
-#: counter — and the counter carries no newline, so `Rebasing (1/1)error: could not
-#: apply …` arrives as ONE line with the reason buried at the end of it. Measured
-#: under four concurrent board writes: three refusals in a row explained themselves
-#: as "From /tmp/…/origin", "warning: fetch updated the current branch head.." and
-#: "Rebasing (1/4)." — three non-answers to the only question being asked.
-_COMPLAINT = re.compile(r"(?:error|fatal): (.+)")
-
-
 def _why_no_rebase(err: str) -> str:
     """Why the rebase onto the moved branch did not run, in the caller's terms.
 
@@ -693,9 +683,7 @@ def _why_no_rebase(err: str) -> str:
                 "the way of rebasing onto it — nothing was moved or stashed. They "
                 "may be yours or another board write that has not committed yet; "
                 "commit what is yours and the next board write pushes both")
-    m = _COMPLAINT.search(err or "")
-    return ("the branch moved and the rebase onto it did not apply: "
-            f"{m.group(1).strip()[:200] if m else _tail(err)}")
+    return f"the branch moved and the rebase onto it did not apply: {_tail(err)}"
 
 
 def _message(item: str, rows: list) -> tuple:
@@ -779,9 +767,9 @@ def _events(record: str) -> list:
     who = (trailers.get(SESSION) or [""])[0]
     host = (trailers.get(MACHINE) or [""])[0]
     out = []
-    # How many of this kind have been handed out already, so the second `verified`
-    # in a commit gets the second body line rather than the first's.
-    taken: dict = {}
+    # One pool per kind, drawn from in order, so the second `verified` in a commit
+    # gets the second body line rather than the first's.
+    pools = {kind: iter(payloads) for kind, payloads in details.items()}
     for kind in kinds:
         e = {"ts": _utc(when), "event": kind, "name": item, "sha": sha[:12],
              "author": author}
@@ -789,11 +777,7 @@ def _events(record: str) -> list:
             e["by"] = who
         if host:
             e["machine"] = host
-        payloads = details.get(kind) or []
-        i = taken.get(kind, 0)
-        if i < len(payloads):
-            e.update(payloads[i])
-        taken[kind] = i + 1
+        e.update(next(pools.get(kind, iter(())), {}))
         out.append(e)
     return out
 
@@ -924,12 +908,31 @@ def cmd_sync(args=None) -> int:
     return 0 if pushed else 1
 
 
+#: Git saying what went wrong, wherever in its output that sits.
+_COMPLAINT = re.compile(r"(?:error|fatal): (.+)")
+
+
 def _tail(text: str) -> str:
-    """Git's first real complaint. The FIRST line, not the last: git follows a
-    `fatal:` with a paragraph of advice, and the closing line of that paragraph
-    ("…and the repository exists.") reads as gibberish on its own."""
-    for line in (text or "").splitlines():
-        line = line.strip()
-        if line and not line.startswith("hint:"):
-            return line[:200]
-    return "no reason given"
+    """Git's real complaint, in the words it used.
+
+    Never the LAST line: git follows a `fatal:` with a paragraph of advice, and the
+    closing line of that paragraph ("…and the repository exists.") reads as gibberish
+    on its own. And no longer the FIRST line either, because the first line is
+    routinely a banner — `To <url>` on a rejected push, `From <url>` on a fetch,
+    `Rebasing (1/4)` on a rebase — and the progress counter carries no newline, so
+    `Rebasing (1/1)error: could not apply …` arrives as ONE line with the reason
+    buried at the end of it.
+
+    Measured, both shapes: a rejected push explained itself as "To /tmp/…/o.git",
+    and three concurrent board writes explained their refusals as a fetch banner, a
+    warning and a progress counter — four non-answers to the only question being
+    asked. So the complaint is looked for first and the first line is the fallback,
+    which is what this always did and is still right when git leads with `fatal:`.
+    """
+    lines = [ln.strip() for ln in (text or "").splitlines()]
+    lines = [ln for ln in lines if ln and not ln.startswith("hint:")]
+    for line in lines:
+        found = _COMPLAINT.search(line)
+        if found:
+            return found.group(1).strip()[:200]
+    return lines[0][:200] if lines else "no reason given"

package/harness/harness/lint.py

@@ -481,6 +481,15 @@ def _coverage_lint(root: Path, s: dict) -> list:
     if not product_dir.is_dir():
         return warns
 
+    # THE QUESTION FIRST, then the evidence for it. Only a `shipped` feature is
+    # checked, so a repo with none has nothing to answer and the gathering below is
+    # pure waste — and it is not free: this runs after every board write, and the
+    # filed-cut half of it grows with every release and never shrinks.
+    shipped = [md for md in scan_features(root)
+               if parse_frontmatter(md.read_text()).get("state") == "shipped"]
+    if not shipped:
+        return warns
+
     covered: dict = {}
     # The cuts that have LEFT the board carry evidence too — a criterion delivered
     # by a task in a shipped cut is delivered. Reading the live board alone turned
@@ -500,10 +509,8 @@ def _coverage_lint(root: Path, s: dict) -> list:
     # matched nothing and this whole rollup was dead code wearing a passing
     # test. `scan_features` is now the single owner of that glob, so the next
     # layout change cannot leave one caller behind.)
-    for feature_md in scan_features(root):
+    for feature_md in shipped:
         text = feature_md.read_text()
-        if parse_frontmatter(text).get("state") != "shipped":
-            continue
         have = covered.get(feature_md.stem, set())
         for ac in sorted(_feature_ac_ids(text)):
             if ac not in have:

package/harness/schema/work.config.schema.json

@@ -330,7 +330,7 @@
         "shard": {
           "type": "string",
           "default": ".work/coverage",
-          "description": "Where runners drop coverage shards. Gitignored on purpose — evidence is a fresh run, not a file somebody checked in."
+          "description": "Where runners drop coverage shards, repo-relative. Gitignored on purpose — evidence is a fresh run, not a file somebody checked in."
         }
       }
     },

package/harness/test_work.py

@@ -6894,6 +6894,49 @@ def test_four_board_writes_racing_a_rejected_push_lose_nothing():
             config.apply(config.DEFAULTS)
 
 
+def test_config_unset_with_no_key_says_so_rather_than_throwing():
+    # The repair branch — `unset` may remove a key the schema does not know — took
+    # the empty key for one of those, because `_present` answers True for a path of
+    # no segments. It then indexed the last of zero parts, so the command an
+    # installer shells out to answered with an IndexError traceback.
+    with tempfile.TemporaryDirectory() as tmp:
+        repo = _repo_with_config(tmp, {"ids": {"prefix": "G"}})
+        for key in ("", ".", "  "):
+            try:
+                _cli(repo, "config", "unset", key)
+                assert False, f"unset {key!r} should refuse"
+            except SystemExit as e:
+                assert e.code, f"unset {key!r} exited 0"
+        assert json.loads((repo / ".claude" / "work.config.json").read_text()) == \
+            {"ids": {"prefix": "G"}}, "a refused unset changed the file"
+
+
+def test_asking_where_the_gates_stand_never_commits_the_board():
+    # `verify` writes the result of a run it EXECUTES, and two of its four doors
+    # execute nothing: `--async` starts a detached child that commits its own
+    # result, `--status` only reports. Both were driving a commit that swept up
+    # whatever the person had open in work/, as "docs(work): board edits" under no
+    # item — seen twice on this repo's own board in one session, while polling for a
+    # gate to finish, which is exactly the call a session repeats.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo_cli(tmp)
+            (repo / ".claude" / "work.config.json").write_text(json.dumps(
+                {"git": {"commit": True, "push": False, "remote": "origin",
+                         "paths": ["work"]},
+                 "verify": {"tests": "true"}}))
+            _git(repo, "add", "-A"); _git(repo, "commit", "-qm", "gates configured")
+            (repo / "work" / "product" / "README.md").write_text("a hand edit\n")
+            before = _git(repo, "rev-parse", "HEAD").stdout.strip()
+
+            _entry(repo, "verify", "--task", "alpha", "--status")
+            assert _git(repo, "rev-parse", "HEAD").stdout.strip() == before, \
+                "asking where the gates stand committed the board"
+            assert "work/product/README.md" in _git(repo, "status", "--porcelain").stdout
+        finally:
+            config.apply(config.DEFAULTS)
+
+
 if __name__ == "__main__":
     tests = [v for k, v in sorted(globals().items())
              if k.startswith("test_") and callable(v)]

package/harness/work.py

@@ -284,7 +284,7 @@ def main() -> int:
     # person happened to have open in `work/` at that moment, filed as
     # "docs(work): board edits" under no item, at a moment nobody chose. The pull
     # was already scoped this way; now both halves ask the same question.
-    if cmd not in git.WRITES or not git.enabled():
+    if not _writes(cmd, flags) or not git.enabled():
         return dispatch(cmd, pos, flags, cfg)
 
     # Pull → write → commit → push. The commit runs in a `finally`: a command that
@@ -314,6 +314,25 @@ def main() -> int:
         _say(note)
 
 
+def _writes(cmd: str, flags: dict) -> bool:
+    """Does THIS invocation change the board?
+
+    The command name answers it for all but one. `verify` writes the result of a run
+    it EXECUTES, and two of its four doors execute nothing: `--async` starts a
+    detached child that commits its own result, and `--status` only reports. Both
+    write to `work/.verify`, which is gitignored, so neither has anything of its own
+    to land — and both were driving a commit that swept up whatever the person had
+    open in `work/`, filed as "docs(work): board edits" under no item. Seen twice on
+    this repo's own board in one session, while polling for a gate to finish, which
+    is exactly the call a session repeats.
+    """
+    if cmd not in git.WRITES:
+        return False
+    if cmd == "verify" and (flags.get("async") or flags.get("status")):
+        return False
+    return True
+
+
 def _say(note: str) -> None:
     """A git note the caller has to see. stderr, because it is the difference
     between a write that is safe and one that is only safe on this machine — and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appchy/jarvis",
-  "version": "0.1.85",
+  "version": "0.1.86",
   "description": "Jarvis — local AI coding assistant CLI",
   "private": false,
   "type": "module",
@@ -57,16 +57,16 @@
     "typescript": "^5.7.0",
     "vitest": "^2.1.0",
     "@jarvis/agents": "1.0.0",
-    "@jarvis/anthropic": "1.0.0",
-    "@jarvis/board": "0.1.0",
     "@jarvis/data": "0.1.0",
-    "@jarvis/errors": "1.0.0",
-    "@jarvis/rpc": "1.0.0",
     "@jarvis/logger": "1.0.0",
-    "@jarvis/types": "1.0.0",
+    "@jarvis/rpc": "1.0.0",
+    "@jarvis/anthropic": "1.0.0",
     "@jarvis/typescript-config": "1.0.0",
+    "@jarvis/types": "1.0.0",
     "@jarvis/ui": "0.1.0",
-    "@jarvis/vitest-config": "1.0.0"
+    "@jarvis/vitest-config": "1.0.0",
+    "@jarvis/errors": "1.0.0",
+    "@jarvis/board": "0.1.0"
   },
   "scripts": {
     "dev": "tsx watch src/bin.ts start --foreground",