@claude-flow/cli 3.64.0 → 3.65.1

package/dist/src/memory/verified-outcomes.js

@@ -19,10 +19,18 @@
  * verified outcomes produced, those at or above the SONA routing gate as
  * lessons, and repeated verified failures as cautions. The mod reads that
  * file and adds at most three cited lessons to a prompt.
+ *
+ * ADR-503 hardens it against gamed signals (verified-guards.ts,
+ * verified-reverify.ts): a tainted success does not train unless the project
+ * allows its taint class, an opt-in re-verify can downgrade a success before
+ * it trains, and an anomaly gate holds suspicious patterns back from the
+ * prompt. Every one of these can only downgrade.
  */
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { addOutcome, blockedTaints, emptyStats, holdReason, parseStats, parseTaint, readLoopConfig } from './verified-guards.js';
+import { gitWorktreeRunner, ReverifySession } from './verified-reverify.js';
 export const VERIFIED_PATH = join('.claude-flow', 'data', 'verified-trajectories.jsonl');
 export const LEDGER_PATH = join('.claude-flow', 'data', 'verified-ingest.json');
 export const LESSONS_PATH = join('.claude-flow', 'data', 'learned-lessons.json');
@@ -35,6 +43,7 @@ export const MAX_FILE_BYTES = 2 * 1024 * 1024;
 export const MAX_LESSONS = 20;
 /** Verified failures (and more failures than successes) before a pattern becomes a caution. */
 export const CAUTION_MIN_FAILURES = 2;
+export const MAX_REVERIFY_LOG = 50;
 const OUTCOMES = ['verified-success', 'verified-failure', 'unknown'];
 const KINDS = ['test', 'build', 'typecheck', 'lint'];
 const ID = /^vt-[A-Za-z0-9_-]{1,80}$/;
@@ -81,10 +90,12 @@ export function parseRecord(line) {
             .filter((s) => !!s && typeof s === 'object' && typeof s.tool === 'string' && TOOL.test(s.tool))
             .map(s => ({ tool: s.tool, ok: s.ok === true }))
         : [];
-    return { id: r.id, task, agent, outcome, verifier, steps, edits: num(r.edits, 10_000), startedAt: num(r.startedAt), endedAt: num(r.endedAt) };
+    const taint = outcome === 'verified-success' ? parseTaint(r.taint) : [];
+    const session = typeof r.session === 'string' && /^[A-Za-z0-9_-]{1,40}$/.test(r.session) ? r.session : null;
+    return { id: r.id, task, agent, outcome, verifier, steps, edits: num(r.edits, 10_000), taint, session, startedAt: num(r.startedAt), endedAt: num(r.endedAt) };
 }
 export function emptyLedger() {
-    return { version: 1, ids: [], lastMtimeMs: 0, totals: { verifiedSuccess: 0, verifiedFailure: 0, unknown: 0, rejected: 0 }, patterns: {} };
+    return { version: 1, ids: [], lastMtimeMs: 0, totals: { verifiedSuccess: 0, verifiedFailure: 0, unknown: 0, rejected: 0, tainted: 0 }, patterns: {}, reverify: { cursor: 0, log: [] } };
 }
 /** A ledger file read back; a corrupt or hostile one starts over (re-ingest is bounded by the mod's 500-line cap). */
 export function readLedger(raw) {
@@ -99,14 +110,21 @@ export function readLedger(raw) {
         for (const [k, v] of Object.entries(j.patterns && typeof j.patterns === 'object' ? j.patterns : {})) {
             if (k === '__proto__' || typeof k !== 'string' || k.length > 400 || !v || typeof v !== 'object')
                 continue;
-            patterns[k] = { evidence: text(v.evidence, 80), at: num(v.at) };
+            patterns[k] = { evidence: text(v.evidence, 80), at: num(v.at), stats: parseStats(v.stats) };
         }
+        const rv = (j.reverify && typeof j.reverify === 'object' ? j.reverify : {});
+        const STATUS = ['pass', 'fail', 'timeout', 'error'];
+        const log = (Array.isArray(rv.log) ? rv.log : [])
+            .filter((e) => !!e && typeof e === 'object' && typeof e.id === 'string' && ID.test(e.id) && STATUS.includes(e.status))
+            .slice(-MAX_REVERIFY_LOG)
+            .map(e => ({ id: e.id, check: typeof e.check === 'string' ? text(e.check, 40) : null, commit: typeof e.commit === 'string' && /^[0-9a-f]{40,64}$/.test(e.commit) ? e.commit : null, status: e.status, at: num(e.at) }));
         return {
             version: 1,
             ids: j.ids.filter((id) => typeof id === 'string' && ID.test(id)).slice(-MAX_LEDGER_IDS),
             lastMtimeMs: num(j.lastMtimeMs),
-            totals: { verifiedSuccess: num(t.verifiedSuccess), verifiedFailure: num(t.verifiedFailure), unknown: num(t.unknown), rejected: num(t.rejected) },
+            totals: { verifiedSuccess: num(t.verifiedSuccess), verifiedFailure: num(t.verifiedFailure), unknown: num(t.unknown), rejected: num(t.rejected), tainted: num(t.tainted) },
             patterns,
+            reverify: { cursor: num(rv.cursor, 1_000_000_000), log },
         };
     }
     catch {
@@ -127,9 +145,13 @@ async function redact(task) {
 const SAFE_KEYWORD = /^[a-z0-9][a-z0-9 _./-]{0,40}$/;
 /** A lesson's citation: a short hash of the SONA pattern key, so the key's own text never reaches a prompt. */
 export const lessonId = (patternKey) => `L-${createHash('sha256').update(patternKey).digest('hex').slice(0, 10)}`;
-/** Builds the lessons file from SONA's patterns, keeping only the ones verified outcomes trained. */
+/**
+ * Builds the lessons file from SONA's patterns, keeping only the ones verified outcomes trained. A would-be lesson the
+ * anomaly gate holds (ADR-503 §2.4) is listed under `held` instead: it stays in SONA, never in a prompt.
+ */
 export function buildLessons(patterns, verified, now) {
     const lessons = [];
+    const held = [];
     let belowGate = 0;
     for (const [id, p] of Object.entries(patterns)) {
         const v = verified[id];
@@ -141,13 +163,19 @@ export function buildLessons(patterns, verified, now) {
         const base = { id: lessonId(id), agent: p.agent, keywords, confidence: Math.round(p.confidence * 1000) / 1000, successes: p.successCount, failures: p.failureCount, evidence: v.evidence };
         if (p.failureCount >= CAUTION_MIN_FAILURES && p.failureCount > p.successCount)
             lessons.push({ ...base, kind: 'caution' });
-        else if (p.confidence >= LESSON_GATE)
-            lessons.push({ ...base, kind: 'lesson' });
+        else if (p.confidence >= LESSON_GATE) {
+            const reason = holdReason(v.stats ?? emptyStats(), p.successCount);
+            if (reason)
+                held.push({ id: base.id, reason });
+            else
+                lessons.push({ ...base, kind: 'lesson' });
+        }
         else
             belowGate++;
     }
     lessons.sort((a, b) => b.confidence - a.confidence || b.successes + b.failures - (a.successes + a.failures));
-    return { version: 1, gate: LESSON_GATE, generatedAt: now, lessons: lessons.slice(0, MAX_LESSONS), belowGate };
+    held.sort((a, b) => a.id.localeCompare(b.id));
+    return { version: 1, gate: LESSON_GATE, generatedAt: now, lessons: lessons.slice(0, MAX_LESSONS), belowGate, held: held.slice(0, MAX_LESSONS) };
 }
 function writeAtomic(path, body) {
     mkdirSync(dirname(path), { recursive: true });
@@ -165,11 +193,13 @@ export async function ingestVerifiedOutcomes(options = {}) {
     const root = options.root ?? process.cwd();
     const now = options.now ?? Date.now();
     const file = join(root, VERIFIED_PATH);
+    const config = options.config ?? readLoopConfig(root);
+    const reverify = { enabled: config.reverify, ran: 0, passed: 0, downgraded: 0, deferred: 0 };
     if (!options.force && !options.dryRun && options.sona !== null) {
         try {
             const memo = lastIngested.get(root);
             if (memo && memo.mtimeMs === statSync(file).mtimeMs) {
-                return { ingested: { verifiedSuccess: 0, verifiedFailure: 0, unknown: 0, rejected: 0 }, trained: 0, skipped: 'unchanged', lessons: 0, cautions: 0, belowGate: 0, totals: { ...memo.totals }, sonaAvailable: true };
+                return { ingested: { verifiedSuccess: 0, verifiedFailure: 0, unknown: 0, rejected: 0, tainted: 0 }, trained: 0, skipped: 'unchanged', lessons: 0, cautions: 0, belowGate: 0, held: [], reverify, totals: { ...memo.totals }, sonaAvailable: true };
             }
         }
         catch {
@@ -178,7 +208,7 @@ export async function ingestVerifiedOutcomes(options = {}) {
     }
     const ledgerPath = join(root, LEDGER_PATH);
     const ledger = readLedger(existsSync(ledgerPath) ? readFileSync(ledgerPath, 'utf8') : null);
-    const ingested = { verifiedSuccess: 0, verifiedFailure: 0, unknown: 0, rejected: 0 };
+    const ingested = { verifiedSuccess: 0, verifiedFailure: 0, unknown: 0, rejected: 0, tainted: 0 };
     const done = (skipped, sonaAvailable, lessons) => ({
         ingested,
         trained: ingested.verifiedSuccess + ingested.verifiedFailure,
@@ -186,6 +216,8 @@ export async function ingestVerifiedOutcomes(options = {}) {
         lessons: lessons?.lessons.filter(l => l.kind === 'lesson').length ?? 0,
         cautions: lessons?.lessons.filter(l => l.kind === 'caution').length ?? 0,
         belowGate: lessons?.belowGate ?? 0,
+        held: lessons?.held ?? [],
+        reverify,
         totals: ledger.totals,
         sonaAvailable,
     });
@@ -206,6 +238,9 @@ export async function ingestVerifiedOutcomes(options = {}) {
             sona = null;
         }
     }
+    // ADR-503 §2.3: one re-verify session per ingest; the cursor advances once, so checks rotate across ingests.
+    const runReverify = config.reverify && !options.dryRun && options.allowReverify === true;
+    const session = runReverify ? new ReverifySession(root, ledger.reverify.cursor, config.reverifyTimeoutMs, options.reverifier ?? gitWorktreeRunner) : null;
     const seen = new Set(ledger.ids);
     for (const line of readFileSync(file, 'utf8').split('\n')) {
         if (!line.trim())
@@ -220,20 +255,42 @@ export async function ingestVerifiedOutcomes(options = {}) {
         // Without SONA nothing verified can train yet: leave it un-ingested for the next call.
         if (record.outcome !== 'unknown' && !sona)
             continue;
+        const success = record.outcome === 'verified-success';
+        // ADR-503 §2.2: a success with a taint its project did not allow is counted and never trains.
+        const tainted = success && blockedTaints(record.taint, config).length > 0;
+        // ADR-503 §2.3: with re-verify on, a caller that may not run project code leaves a trainable success for later.
+        if (success && !tainted && config.reverify && !options.dryRun && !runReverify) {
+            reverify.deferred++;
+            continue;
+        }
         seen.add(record.id);
         ledger.ids.push(record.id);
         if (record.outcome === 'unknown') {
             ingested.unknown++;
             continue;
         }
+        if (tainted) {
+            ingested.tainted++;
+            continue;
+        }
         if (options.dryRun) {
-            if (record.outcome === 'verified-success')
+            if (success)
                 ingested.verifiedSuccess++;
             else
                 ingested.verifiedFailure++;
             continue;
         }
-        const success = record.outcome === 'verified-success';
+        if (success && session) {
+            // Only the record's verifier KIND is used, to pick a different allowlisted check; its text never runs.
+            const { check, outcome } = await session.verify(record.verifier.kind);
+            ledger.reverify.log.push({ id: record.id, check, commit: outcome.commit, status: outcome.status, at: now });
+            if (outcome.status !== 'pass') {
+                reverify.downgraded++;
+                ingested.unknown++;
+                continue;
+            }
+            reverify.passed++;
+        }
         const result = sona.processTrajectoryOutcome({
             trajectoryId: record.id,
             task: await redact(record.task),
@@ -243,8 +300,13 @@ export async function ingestVerifiedOutcomes(options = {}) {
             duration: record.endedAt > record.startedAt ? record.endedAt - record.startedAt : 0,
             feedback: `verified by ${record.verifier.kind}: ${record.verifier.command}`,
         });
-        if (result.learned && result.patternKey)
-            ledger.patterns[result.patternKey] = { evidence: record.verifier.command, at: now };
+        if (result.learned && result.patternKey) {
+            const entry = ledger.patterns[result.patternKey] ?? { evidence: '', at: now, stats: emptyStats() };
+            entry.evidence = record.verifier.command;
+            entry.at = now;
+            addOutcome(entry.stats, success, record.taint, record.session);
+            ledger.patterns[result.patternKey] = entry;
+        }
         if (success)
             ingested.verifiedSuccess++;
         else
@@ -252,14 +314,21 @@ export async function ingestVerifiedOutcomes(options = {}) {
     }
     if (options.dryRun)
         return done(null, !!sona);
+    if (session) {
+        reverify.ran = session.ran;
+        if (session.ran > 0)
+            ledger.reverify.cursor = (ledger.reverify.cursor + 1) % 1_000_000_000;
+        ledger.reverify.log = ledger.reverify.log.slice(-MAX_REVERIFY_LOG);
+    }
     ledger.ids = ledger.ids.slice(-MAX_LEDGER_IDS);
-    // Without SONA, verified records stayed un-ingested: keep the mtime stale so the next call retries them.
-    if (sona) {
+    for (const k of Object.keys(ingested))
+        ledger.totals[k] += ingested[k];
+    // Without SONA, or with successes deferred for re-verify, records stayed un-ingested: keep the mtime stale so the
+    // next call retries them.
+    if (sona && reverify.deferred === 0) {
         ledger.lastMtimeMs = st.mtimeMs;
         lastIngested.set(root, { mtimeMs: st.mtimeMs, totals: { ...ledger.totals } });
     }
-    for (const k of Object.keys(ingested))
-        ledger.totals[k] += ingested[k];
     // Keep the verified-pattern map bounded to what SONA still holds.
     const patterns = sona ? sona.exportPatterns() : {};
     if (sona)
@@ -294,7 +363,7 @@ export function learningLoopHealth(root = process.cwd()) {
     const records = lines.map(parseRecord).filter((r) => r !== null);
     const waiting = records.filter(r => !seen.has(r.id) && r.outcome !== 'unknown').length;
     const verified = records.filter(r => r.outcome !== 'unknown').length;
-    const summary = `${records.length} turn(s) recorded, ${verified} verified; trained so far ${ledger.totals.verifiedSuccess} success / ${ledger.totals.verifiedFailure} failure, ${ledger.totals.unknown} unknown (never trained)`;
+    const summary = `${records.length} turn(s) recorded, ${verified} verified; trained so far ${ledger.totals.verifiedSuccess} success / ${ledger.totals.verifiedFailure} failure, ${ledger.totals.unknown} unknown, ${ledger.totals.tainted} tainted (never trained)`;
     if (waiting > 0) {
         return { status: 'warn', message: `${summary}; ${waiting} verified outcome(s) not yet ingested`, fix: 'ruflo hooks verified-ingest (or any hooks_route / hooks_session-end call ingests them)' };
     }

package/dist/src/memory/verified-reverify.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Re-verify before training (ADR-503 §2.3). Opt-in: `.claude-flow/config.json`
+ * `learningLoop.reverify: true`. Off by default because it runs project code.
+ *
+ * - The command comes only from a fixed allowlist built from the project's own
+ *   manifest (`package.json` scripts named test/typecheck/build/lint, or
+ *   `cargo test`/`cargo check` when `Cargo.toml` exists). A record's text is
+ *   never executed: it only selects, by its verifier *kind*, which allowlisted
+ *   check NOT to run.
+ * - Checks rotate round-robin across ingests, preferring one the record did
+ *   not use, so no single check is the one that counts.
+ * - The real runner works in a temporary detached `git worktree` at HEAD,
+ *   with a hard timeout; timeout, error or a non-zero exit downgrades the
+ *   record to `unknown`.
+ */
+import type { VerifierKind } from './verified-outcomes.js';
+export interface ReverifyCheck {
+    /** `npm:test`, `cargo:check`, ...: a stable name for the ledger. */
+    readonly name: string;
+    readonly kind: VerifierKind;
+    readonly argv: readonly string[];
+}
+export interface ReverifyOutcome {
+    readonly status: 'pass' | 'fail' | 'timeout' | 'error';
+    /** The commit the check ran at, when known. */
+    readonly commit: string | null;
+}
+/** Runs one allowlisted check for `root` at HEAD. Injectable so tests never start a process. */
+export type ReverifyRunner = (root: string, check: ReverifyCheck, timeoutMs: number) => Promise<ReverifyOutcome>;
+/**
+ * The allowlist for a project. Only the script NAMES are read from the
+ * manifest; the argv is fixed here (`npm run <name>`, `cargo test`, ...).
+ */
+export declare function reverifyChecks(root: string): ReverifyCheck[];
+/**
+ * The check to run for a record decided by a `used` verifier: round-robin by
+ * `cursor` over the checks of another kind, or over all of them when every
+ * check is that kind. Null when the project has none.
+ */
+export declare function pickCheck(checks: readonly ReverifyCheck[], used: VerifierKind, cursor: number): ReverifyCheck | null;
+/**
+ * The real runner: a detached `git worktree` at HEAD in a temp directory, the
+ * root's `node_modules` linked in (a fresh worktree has none), the check run,
+ * the worktree removed. Any failure along the way is `error`.
+ */
+export declare const gitWorktreeRunner: ReverifyRunner;
+/** One ingest's re-verification: picks per record, runs each distinct check at most once, never throws. */
+export declare class ReverifySession {
+    private readonly root;
+    private readonly cursor;
+    private readonly timeoutMs;
+    private readonly runner;
+    private readonly results;
+    private readonly checks;
+    ran: number;
+    constructor(root: string, cursor: number, timeoutMs: number, runner: ReverifyRunner, checks?: ReverifyCheck[]);
+    /** Re-verifies a success decided by a `used` verifier. The record's own command and task are never passed. */
+    verify(used: VerifierKind): Promise<{
+        check: string | null;
+        outcome: ReverifyOutcome;
+    }>;
+}
+//# sourceMappingURL=verified-reverify.d.ts.map

package/dist/src/memory/verified-reverify.js

@@ -0,0 +1,174 @@
+/**
+ * Re-verify before training (ADR-503 §2.3). Opt-in: `.claude-flow/config.json`
+ * `learningLoop.reverify: true`. Off by default because it runs project code.
+ *
+ * - The command comes only from a fixed allowlist built from the project's own
+ *   manifest (`package.json` scripts named test/typecheck/build/lint, or
+ *   `cargo test`/`cargo check` when `Cargo.toml` exists). A record's text is
+ *   never executed: it only selects, by its verifier *kind*, which allowlisted
+ *   check NOT to run.
+ * - Checks rotate round-robin across ingests, preferring one the record did
+ *   not use, so no single check is the one that counts.
+ * - The real runner works in a temporary detached `git worktree` at HEAD,
+ *   with a hard timeout; timeout, error or a non-zero exit downgrades the
+ *   record to `unknown`.
+ */
+import { execFile, spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+/** package.json scripts that may be re-run, in rotation order, and the kind each verifies. */
+const NPM_SCRIPTS = [
+    ['test', 'test'],
+    ['typecheck', 'typecheck'],
+    ['build', 'build'],
+    ['lint', 'lint'],
+];
+/**
+ * The allowlist for a project. Only the script NAMES are read from the
+ * manifest; the argv is fixed here (`npm run <name>`, `cargo test`, ...).
+ */
+export function reverifyChecks(root) {
+    const checks = [];
+    try {
+        const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+        const scripts = pkg && typeof pkg.scripts === 'object' && pkg.scripts !== null ? pkg.scripts : {};
+        for (const [name, kind] of NPM_SCRIPTS) {
+            if (typeof scripts[name] === 'string' && scripts[name].trim())
+                checks.push({ name: `npm:${name}`, kind, argv: ['npm', 'run', name] });
+        }
+    }
+    catch {
+        // no or unreadable package.json: no npm checks
+    }
+    if (existsSync(join(root, 'Cargo.toml'))) {
+        checks.push({ name: 'cargo:test', kind: 'test', argv: ['cargo', 'test'] });
+        checks.push({ name: 'cargo:check', kind: 'typecheck', argv: ['cargo', 'check'] });
+    }
+    return checks;
+}
+/**
+ * The check to run for a record decided by a `used` verifier: round-robin by
+ * `cursor` over the checks of another kind, or over all of them when every
+ * check is that kind. Null when the project has none.
+ */
+export function pickCheck(checks, used, cursor) {
+    if (checks.length === 0)
+        return null;
+    const others = checks.filter(c => c.kind !== used);
+    const pool = others.length > 0 ? others : checks;
+    return pool[Math.abs(Math.floor(cursor)) % pool.length];
+}
+const COMMIT = /^[0-9a-f]{40,64}$/;
+function git(args, cwd, timeout = 60_000) {
+    return new Promise((resolve, reject) => {
+        execFile('git', args, { cwd, timeout, maxBuffer: 1024 * 1024 }, (error, stdout) => (error ? reject(error) : resolve(String(stdout))));
+    });
+}
+/** Runs argv (no shell) in `cwd`; the whole process group is killed at the timeout. */
+function runCheck(argv, cwd, timeoutMs) {
+    return new Promise(resolve => {
+        let settled = false;
+        const finish = (status) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(status);
+        };
+        let child;
+        try {
+            child = spawn(argv[0], argv.slice(1), { cwd, shell: false, stdio: 'ignore', detached: process.platform !== 'win32', env: { ...process.env, CI: '1' } });
+        }
+        catch {
+            resolve('error');
+            return;
+        }
+        const timer = setTimeout(() => {
+            try {
+                if (child.pid && process.platform !== 'win32')
+                    process.kill(-child.pid, 'SIGKILL');
+                else
+                    child.kill('SIGKILL');
+            }
+            catch {
+                // already gone
+            }
+            finish('timeout');
+        }, timeoutMs);
+        child.on('error', () => finish('error'));
+        child.on('exit', code => finish(code === 0 ? 'pass' : 'fail'));
+    });
+}
+/**
+ * The real runner: a detached `git worktree` at HEAD in a temp directory, the
+ * root's `node_modules` linked in (a fresh worktree has none), the check run,
+ * the worktree removed. Any failure along the way is `error`.
+ */
+export const gitWorktreeRunner = async (root, check, timeoutMs) => {
+    let commit = null;
+    const base = mkdtempSync(join(tmpdir(), 'ruflo-reverify-'));
+    const dir = join(base, 'wt');
+    let added = false;
+    try {
+        const head = (await git(['rev-parse', 'HEAD'], root, 10_000)).trim();
+        if (!COMMIT.test(head))
+            return { status: 'error', commit: null };
+        commit = head;
+        await git(['worktree', 'add', '--detach', dir, head], root);
+        added = true;
+        if (existsSync(join(root, 'node_modules')) && !existsSync(join(dir, 'node_modules')))
+            symlinkSync(join(root, 'node_modules'), join(dir, 'node_modules'), 'dir');
+        return { status: await runCheck(check.argv, dir, timeoutMs), commit };
+    }
+    catch {
+        return { status: 'error', commit };
+    }
+    finally {
+        if (added)
+            await git(['worktree', 'remove', '--force', dir], root).catch(() => undefined);
+        rmSync(base, { recursive: true, force: true });
+        if (added)
+            await git(['worktree', 'prune'], root).catch(() => undefined);
+    }
+};
+/** A runner that never settles still ends: past the deadline its outcome is `timeout`. */
+function withDeadline(run, ms) {
+    let timer;
+    const deadline = new Promise(resolve => {
+        timer = setTimeout(() => resolve({ status: 'timeout', commit: null }), ms);
+        timer.unref?.();
+    });
+    return Promise.race([run, deadline]).finally(() => clearTimeout(timer));
+}
+/** One ingest's re-verification: picks per record, runs each distinct check at most once, never throws. */
+export class ReverifySession {
+    root;
+    cursor;
+    timeoutMs;
+    runner;
+    results = new Map();
+    checks;
+    ran = 0;
+    constructor(root, cursor, timeoutMs, runner, checks) {
+        this.root = root;
+        this.cursor = cursor;
+        this.timeoutMs = timeoutMs;
+        this.runner = runner;
+        this.checks = checks ?? reverifyChecks(root);
+    }
+    /** Re-verifies a success decided by a `used` verifier. The record's own command and task are never passed. */
+    async verify(used) {
+        const check = pickCheck(this.checks, used, this.cursor);
+        if (!check)
+            return { check: null, outcome: { status: 'error', commit: null } };
+        let pending = this.results.get(check.name);
+        if (!pending) {
+            this.ran++;
+            pending = withDeadline(Promise.resolve().then(() => this.runner(this.root, check, this.timeoutMs)), this.timeoutMs + Math.min(this.timeoutMs, 30_000)).then(o => (o && ['pass', 'fail', 'timeout', 'error'].includes(o.status) ? { status: o.status, commit: typeof o.commit === 'string' && COMMIT.test(o.commit) ? o.commit : null } : { status: 'error', commit: null }), () => ({ status: 'error', commit: null }));
+            this.results.set(check.name, pending);
+        }
+        return { check: check.name, outcome: await pending };
+    }
+}
+//# sourceMappingURL=verified-reverify.js.map

package/dist/src/missions/schemas.d.ts

@@ -45,12 +45,12 @@ export declare const missionRecordSchema: z.ZodObject<{
         digest: z.ZodString;
         taskGraphRef: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        revision: number;
         digest: string;
+        revision: number;
         taskGraphRef: string;
     }, {
-        revision: number;
         digest: string;
+        revision: number;
         taskGraphRef: string;
     }>;
     policyRef: z.ZodString;
@@ -82,8 +82,8 @@ export declare const missionRecordSchema: z.ZodObject<{
         criteriaDigest: string;
     };
     plan: {
-        revision: number;
         digest: string;
+        revision: number;
         taskGraphRef: string;
     };
     objective: string;
@@ -108,8 +108,8 @@ export declare const missionRecordSchema: z.ZodObject<{
         criteriaDigest: string;
     };
     plan: {
-        revision: number;
         digest: string;
+        revision: number;
         taskGraphRef: string;
     };
     objective: string;

package/dist/src/mods/apply.d.ts

@@ -18,6 +18,8 @@ export interface ApplyOptions {
     skipInTestEnv?: boolean;
     /** The marketplace to declare when the settings have none (default github ruvnet/ruflo). */
     marketplace?: MarketplaceEntry;
+    /** ADR-509 §2.2: plugins (name or id) to install past a high scan finding; each override is recorded. */
+    acceptRisk?: readonly string[];
     /** Injectable for tests. */
     exec?: Exec;
 }

package/dist/src/mods/apply.js

@@ -7,9 +7,10 @@
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { output } from '../output.js';
-import { installMod, MARKETPLACE_NAME, MARKETPLACE_SOURCE, MOD_PLUGINS, readRecord, recordClaudeInstalled, scopeOfSettingsFile, uninstallMod, } from './install.js';
+import { disableBlockedPlugins, installMod, MARKETPLACE_NAME, MARKETPLACE_SOURCE, MOD_PLUGIN_IDS, MOD_PLUGINS, readRecord, readSettingsFile, settingsFileFor, recordClaudeInstalled, scopeOfSettingsFile, uninstallMod, } from './install.js';
 import { findClaudeBinary, installArgv, marketplaceArgv, repairPluginInstall, uninstallArgv, uninstallPlugins } from './plugin-repair.js';
 import { claudeConfigDir, describeSource, installedState, marketplaceState, repairCommands, resolveFindings, sameSource } from './plugin-resolve.js';
+import { scanBeforeInstall, verifyAndRecord } from './install-trust.js';
 /** One line per thing a run added; empty on a re-run. */
 export function describeAdded(added) {
     return [
@@ -68,14 +69,39 @@ function noteRewrite(file, before) {
         // Not ours to judge further.
     }
 }
+/** The marketplace the settings file already declares, else the requested one. */
+function declaredMarketplace(root, scope, requested) {
+    try {
+        const markets = readSettingsFile(settingsFileFor(root, scope)).extraKnownMarketplaces;
+        return markets?.[MARKETPLACE_NAME] ?? requested;
+    }
+    catch {
+        return requested;
+    }
+}
 export async function applyMods(root, opts) {
-    const install = installMod(root, opts.scope, opts.dryRun === true, undefined, opts.marketplace ?? MARKETPLACE_SOURCE);
     const configDir = claudeConfigDir(process.env, homedir());
+    const acceptRisk = new Set(opts.acceptRisk ?? []);
+    const seen = new Set();
+    const blocked = new Map();
+    const told = new Set();
+    // ADR-509 §2.2: Claude Code loads an enabled plugin straight from the
+    // marketplace clone, install or not. So where a clone already exists, scan it
+    // BEFORE enabling anything from it, and never enable what the scan blocks.
+    const preClone = opts.dryRun ? null : marketplaceState(configDir).location;
+    const scannable = declaredMarketplace(root, opts.scope, opts.marketplace ?? MARKETPLACE_SOURCE).source.source !== 'directory';
+    if (preClone && scannable) {
+        for (const [id, why] of scanBeforeInstall(root, preClone, MOD_PLUGINS, acceptRisk, undefined, seen).blocked)
+            blocked.set(id, why);
+    }
+    const install = installMod(root, opts.scope, opts.dryRun === true, MOD_PLUGIN_IDS.filter((id) => !blocked.has(id)), opts.marketplace ?? MARKETPLACE_SOURCE);
+    // A blocked plugin enabled by an earlier run (or by hand) is turned off too.
+    turnOff(root, install, blocked, told);
     const lines = describeAdded(install.added);
     // Only what is enabled in the file: `claude plugin install` would flip a
     // plugin someone set to false back to true.
     const enabled = (install.next.enabledPlugins ?? {});
-    const plugins = MOD_PLUGINS.filter((p) => enabled[p.id] === true);
+    const plugins = MOD_PLUGINS.filter((p) => enabled[p.id] === true && !blocked.has(p.id));
     // The marketplace the file declares wins: a person's own declaration is kept and used.
     const declared = install.next.extraKnownMarketplaces?.[MARKETPLACE_NAME] ?? MARKETPLACE_SOURCE;
     const market = marketplaceState(configDir);
@@ -111,16 +137,25 @@ export async function applyMods(root, opts) {
         for (const line of repairCommands(root, opts.scope, k, plugins, declared))
             output.writeln(`  ${line}`);
     };
-    if (opts.pluginInstall === false)
-        return { install, resolvable: true, skipped: '--no-plugin-install' };
+    // The `claude` step may not run below: say what is enabled without a scan.
+    const unscanned = () => {
+        if (!preClone && scannable && plugins.length)
+            output.printWarning(`No ruflo marketplace clone yet, so nothing was scanned (ADR-509): ${plugins.map((p) => p.id).join(', ')} enabled unscanned; Claude Code clones it on the first trusted start. Run ruflo mods install again after that to scan it.`);
+    };
+    if (opts.pluginInstall === false) {
+        unscanned();
+        return { install, resolvable: blocked.size === 0, skipped: '--no-plugin-install' };
+    }
     if (opts.skipInTestEnv && (process.env.VITEST || process.env.CI)) {
         output.writeln(output.dim(`claude plugin step skipped (${process.env.VITEST ? 'VITEST' : 'CI'} set).`));
+        unscanned();
         manual();
         return { install, resolvable: false, skipped: 'test or CI environment' };
     }
     const claude = findClaudeBinary(process.env, homedir());
     if (!claude) {
         output.printWarning('No runnable claude binary on PATH: the plugins are enabled in settings, not installed.');
+        unscanned();
         manual();
         return { install, resolvable: false, skipped: 'no claude on PATH' };
     }
@@ -130,8 +165,21 @@ export async function applyMods(root, opts) {
     // Never claim (and so never uninstall) a plugin that was installed before, or one ruflo did not enable.
     const before = new Set(plugins.filter((p) => installedState(root, configDir, p.id).installed).map((p) => p.id));
     const textBefore = readText(install.settingsFile);
-    const repair = await repairPluginInstall({ projectRoot: root, scope: opts.scope, configDir, claude, plugins, marketplace: declared, exec: opts.exec });
+    const repair = await repairPluginInstall({
+        projectRoot: root, scope: opts.scope, configDir, claude, plugins, marketplace: declared, exec: opts.exec,
+        // ADR-509 §2.2: scan the refreshed clone before any install (a directory marketplace has no install step to gate).
+        beforeInstall: (clone) => {
+            const gate = scanBeforeInstall(root, clone, plugins, acceptRisk, undefined, seen);
+            for (const [id, why] of gate.blocked)
+                blocked.set(id, why);
+            return gate;
+        },
+    });
     printSteps(repair.steps);
+    // The refresh may have brought a finding the first scan did not see: that plugin is turned off as well.
+    turnOff(root, install, blocked, told);
+    // ADR-509 §2.1: verify what Claude Code will load and leave the result for the mod's trust gate.
+    verifyAndRecord(configDir, marketplaceState(configDir).location, plugins.map((p) => p.id.split('@')[0]));
     if (declared.source.source === 'directory' && repair.ok)
         output.writeln(output.dim(`Directory marketplace: plugins load live from ${declared.source.path} (no clone, no install).`));
     const enabledByRuflo = new Set(readRecord(root)?.files[install.settingsFile]?.plugins ?? []);
@@ -141,8 +189,8 @@ export async function applyMods(root, opts) {
         .filter((id) => !before.has(id) && enabledByRuflo.has(id));
     recordClaudeInstalled(root, install.settingsFile, ours);
     noteRewrite(install.settingsFile, textBefore);
-    const failed = resolveFindings(root, opts.scope, configDir, undefined, plugins.map((p) => p.id), declared).filter((f) => f.status === 'fail');
-    if (repair.ok && failed.length === 0)
+    const failed = resolveFindings(root, opts.scope, configDir, undefined, plugins.filter((p) => !blocked.has(p.id)).map((p) => p.id), declared).filter((f) => f.status === 'fail');
+    if (repair.ok && failed.length === 0 && blocked.size === 0)
         return { install, resolvable: true };
     for (const f of failed)
         output.writeln(`${output.error('✗')} ${f.name}: ${f.message}`);
@@ -150,6 +198,18 @@ export async function applyMods(root, opts) {
     manual(now.known && sameSource(now.source, declared.source));
     return { install, resolvable: false };
 }
+/** ADR-509 §2.2: turn off (enabledPlugins + install record) each blocked plugin, and say so. */
+function turnOff(root, install, blocked, told) {
+    if (install.dryRun || blocked.size === 0)
+        return;
+    const off = disableBlockedPlugins(root, install.settingsFile, [...blocked.keys()]);
+    for (const [id, why] of blocked) {
+        if (told.has(id) && !off.includes(id))
+            continue; // already said, and nothing changed since
+        told.add(id);
+        output.writeln(`${output.error('✗')} ${id}: ${off.includes(id) ? `enabledPlugins["${id}"] removed from ${install.settingsFile}` : 'not enabled'}; ${why}`);
+    }
+}
 /**
  * `ruflo mods uninstall`: `claude plugin uninstall` exactly the plugins ruflo
  * installed, then remove exactly the settings keys it added.