@dougharness/cli 1.4.0 → 1.5.0

package/node_modules/@dougharness/gates/lib/verified-tree.mjs

@@ -17,6 +17,7 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rename
 import { join, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { pathToFileURL } from "node:url";
+import { readSummaries } from "./test-totals.mjs";
 
 export const RECORD_RELPATH = ".doug/.state/verified-tree.json";
 export const EXCLUDED = [".doug/.state", ".claude/worktrees", ".doug/anchor.md"];
@@ -108,6 +109,37 @@ export function validRecord(r) {
   }
 }
 
+// Test totals depend on the environment (a worktree without a built dist skips tests), not only the tree. A record
+// stamps `ranIn` (realpath of the directory its commands ran in); its totals count as evidence only for that directory.
+// Never throws: any failure, or a record with no ranIn (legacy), is false (the commands run).
+export function totalsUsable(record, dir) {
+  try {
+    return !!record && typeof record.ranIn === "string" && realpathSync(record.ranIn) === realpathSync(dir);
+  } catch {
+    return false;
+  }
+}
+
+// A record from another checkout (or a legacy one with no ranIn) credits exit codes only when none of its recorded
+// totals reports skipped tests: a dist-less worktree skips tests that could fail here. Absent or unreadable entries
+// do not count. Never throws: any failure is false.
+export function exitCreditUsable(record, dir) {
+  try {
+    if (!record || typeof record !== "object") return false;
+    if (totalsUsable(record, dir)) return true;
+    const totals = record.totals;
+    if (!totals || typeof totals !== "object") return true;
+    for (const entry of Object.values(totals)) {
+      const sums = readSummaries(entry);
+      if (!sums) continue;
+      if (sums.reduce((n, s) => n + (s.skipped || 0), 0) > 0) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function readRecord(dir) {
   try {
     const r = JSON.parse(readFileSync(join(dir, RECORD_RELPATH), "utf8"));
@@ -214,6 +246,7 @@ if (isMain()) {
           node: process.version,
           at: new Date().toISOString(),
           by: "pre-commit",
+          ranIn: realpathSync(dir),
           commands: commands.map((cm) => ({ name: cm.name, command: cm.command, exit: cm.exit, durationMs: cm.durationMs })),
           totals,
         });

package/node_modules/@dougharness/gates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/gates",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "private": true,
   "description": "Deterministic Claude Code hooks: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, stop gate, re-anchor after compaction.",
   "type": "module",

package/node_modules/@dougharness/gates/scripts/stop-gate.mjs

@@ -94,7 +94,7 @@ import { parseTotals, readSummaries, sumTotals, compareTotals, deltaTotals, waiv
 import { failingTestFilesFrom, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine, outputTail, redactText } from "../lib/block-ledger.mjs";
 import { docsGateDecision } from "../lib/docs-gate.mjs";
 import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
-import { resolveCommands, computeTree, readRecord, writeRecord as writeTreeRecord, removeRecord as removeTreeRecord, creditable } from "../lib/verified-tree.mjs";
+import { resolveCommands, computeTree, readRecord, writeRecord as writeTreeRecord, removeRecord as removeTreeRecord, creditable, totalsUsable, exitCreditUsable } from "../lib/verified-tree.mjs";
 
 // Only the last this many characters of last_assistant_message are ever scanned for a partial claim
 // (review, scan cost): a structured result lives at the end of a worker's message, and the balanced-span
@@ -311,14 +311,14 @@ function stripLeadingDotSlash(f) {
 // failed command's output names at least one test file, every named file is in the claim, and every
 // claimed file is changed or untracked in the working tree (`changed`, from changedFiles(dir) above);
 // otherwise `{ covered: false, reasonLine }` — one line, no newline, saying why.
-function redByDesignCoverage(claimFiles, commandFailures, changed, dir) {
+function redByDesignCoverage(claimFiles, commandFailures, changed, dir, secrets) {
   const changedSet = new Set(Array.isArray(changed) ? changed : []);
   for (const cf of commandFailures) {
     const bad = nonTestTscPathsFrom(cf.output, dir);
     if (bad.length > 0) {
       return {
         covered: false,
-        reasonLine: `The tests_red_by_design claim does not cover this: \`${cf.command}\` reported a type error in ${bad.join(", ")}, which is not a test file.`,
+        reasonLine: `The tests_red_by_design claim does not cover this: \`${redactText(cf.command, secrets)}\` reported a type error in ${bad.join(", ")}, which is not a test file.`,
       };
     }
   }
@@ -327,7 +327,7 @@ function redByDesignCoverage(claimFiles, commandFailures, changed, dir) {
   if (noFile.length > 0) {
     return {
       covered: false,
-      reasonLine: `The tests_red_by_design claim does not cover this: ${noFile.map((c) => `\`${c.command}\``).join(", ")} named no test file in its output.`,
+      reasonLine: `The tests_red_by_design claim does not cover this: ${noFile.map((c) => `\`${redactText(c.command, secrets)}\``).join(", ")} named no test file in its output.`,
     };
   }
   const allNamed = [...new Set(namedByCommand.flatMap((c) => c.files))];
@@ -510,7 +510,7 @@ function agentMadeNoChanges(dir, cfg, sessionId, subagent) {
 // card stop-gate-worktree-agent-fingerprint: the start record is a fingerprint of the main checkout (the trace
 // hook runs there), so for a worktree verification dir it is compared like with like instead: unchanged only if
 // the record exists, every verification dir has no changed files, and every one's HEAD carries no commit of its
-// own: it equals or is an ancestor of the record's HEAD, or of the main checkout's refs/remotes/origin/HEAD (Claude
+// own: it equals or is an ancestor of the record's HEAD, or of the origin/HEAD sha the record holds, taken at start, never the live ref (Claude
 // Code branches a fresh isolation worktree from the remote default branch, which local main may be ahead of or
 // behind). Any git failure reads as changed. A verification set that mixes a worktree with `dir` reads as
 // changed. A main-checkout agent keeps the fingerprint comparison.
@@ -539,12 +539,7 @@ function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFi
       if (!start || typeof start !== "object" || !start.head) return false;
       const dirs = forced ? [vdir] : verifyDirs(dir, cfg, sessionId, input, subagent);
       if (!dirs.includes(vdir) || dirs.includes(dir)) return false;
-      let remoteHead;
-      try {
-        remoteHead = execFileSync("git", ["rev-parse", "--verify", "-q", "refs/remotes/origin/HEAD^{commit}"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).trim() || null;
-      } catch {
-        remoteHead = null;
-      }
+      const remoteHead = typeof start.originHead === "string" && start.originHead ? start.originHead : null;
       return dirs.every((d) => {
         const h = headAt(d);
         if (!h) return false;
@@ -827,22 +822,36 @@ function readLastGreen(dir) {
   }
 }
 
+// card ratchet-credit-reads-record: one baseline for the count check and both credit paths. In a worktree
+// (vdir !== dir) it is the worktree's own last-green record. On the main checkout (card
+// ratchet-stale-session-baseline) it is the main last-green record when that has a readable entry for the
+// command, else the session-start copy state.testTotals. Returns (command) => baseline object or null. Never throws.
+function countBaselineFor(dir, state, vdir) {
+  try {
+    const inWorktree = typeof vdir === "string" && vdir !== dir;
+    const worktreeBaseline = inWorktree ? readLastGreen(vdir) : null;
+    const mainRecord = inWorktree ? null : readLastGreen(dir);
+    const fallback = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+    return (command) => {
+      try {
+        if (inWorktree) return worktreeBaseline;
+        return mainRecord && readSummaries(mainRecord[command]) ? mainRecord : fallback;
+      } catch {
+        return null;
+      }
+    };
+  } catch {
+    return () => null;
+  }
+}
+
 // The count check for the commands that ran green by exit code. Returns { problems, parsed }: `problems` are
 // block reasons, `parsed` the per-command summary lists of every run that was counted (for the last-green
 // record). A missing or unparseable summary, or no baseline, is a trace line and no check.
 function countCheck(dir, cfg, state, input, ran, vdir) {
   // card worktree-count-baseline: a worktree run compares against its own earlier green runs, never main's record
   // (a worktree can lack the dist build main has, so its skipped count differs). No record yet means no check.
-  const inWorktree = typeof vdir === "string" && vdir !== dir;
-  // card ratchet-stale-session-baseline: a main-checkout run compares against the main tree's live last-green
-  // record too (per command), not the session-start copy; the copy is the fallback when the record has no
-  // readable entry for the command, so a deleted record does not remove the check.
-  const worktreeBaseline = inWorktree ? readLastGreen(vdir) : null;
-  const mainRecord = inWorktree ? null : readLastGreen(dir);
-  const baselineFor = (command) => {
-    if (inWorktree) return worktreeBaseline;
-    return mainRecord && readSummaries(mainRecord[command]) ? mainRecord : state.testTotals;
-  };
+  const baselineFor = countBaselineFor(dir, state, vdir);
   const problems = [];
   const parsed = {};
   // The note carries its own event name, never the stop event's: a decision-less SubagentStop line would read to
@@ -943,7 +952,7 @@ function readableRecordedTotals(t) {
 // one `{ name, command, ok: true, credited: "verified-tree", recorded? }` per resolveCommands entry in config
 // order. A command with a baseline in state.testTotals and no readable recorded totals returns null (the commands
 // run), the same rule as preCommitCredit. Never throws: any failure is null, and null runs the commands.
-function treeCredit(dir, cfg, state, tree) {
+function treeCredit(dir, cfg, state, tree, mainDir) {
   try {
     if (!tree) return null;
     const record = readRecord(dir);
@@ -951,11 +960,14 @@ function treeCredit(dir, cfg, state, tree) {
     const configured = resolveCommands(cfg);
     if (configured.length === 0) return null;
     if (!creditable(dir, cfg, record, tree, configured.map((c) => c.command)).ok) return null;
-    const all = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+    if (!exitCreditUsable(record, dir)) return null;
+    // dir is the verify dir (a worktree for a worktree agent); mainDir the main checkout, as countCheck's dir.
+    const baselineFor = countBaselineFor(mainDir ?? dir, state, dir);
     const out = [];
     for (const { name, command } of configured) {
-      const recorded = readableRecordedTotals(record.totals[command]);
-      const hasBaseline = all ? readSummaries(all[command]) !== null : false;
+      const recorded = totalsUsable(record, dir) ? readableRecordedTotals(record.totals[command]) : null;
+      const base = baselineFor(command);
+      const hasBaseline = base ? readSummaries(base[command]) !== null : false;
       if (hasBaseline && (!recorded || recorded.status === "none")) return null;
       out.push({ name, command, ok: true, credited: "verified-tree", ...(recorded ? { recorded } : {}) });
     }
@@ -975,7 +987,7 @@ function treeCredit(dir, cfg, state, tree) {
 // wrong-shape, failing, stale-tree, or mismatched-commands record, or a dirty tree — fail closed to running,
 // never to passing. A reader must never throw: every path here is wrapped, so a corrupt record never crashes
 // the hook (`runHook` fails open on a throw, which here would mean passing without running — forbidden).
-function preCommitCredit(dir, cfg, changed, state) {
+function preCommitCredit(dir, cfg, changed, state, mainDir) {
   try {
     if (!Array.isArray(changed)) return null;
     const ignore = cfg.stopGate.ignoreChangedPaths || [];
@@ -1001,12 +1013,14 @@ function preCommitCredit(dir, cfg, changed, state) {
     // card ratchet-pre-commit-credit: a command with a baseline in state.testTotals is credited only when the
     // record carries readable totals for it (a list of valid summaries, or an old ok or conflict shape);
     // otherwise null and the commands really run. `recorded` is the parseTotals-shaped result for the count check.
-    const all = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+    // dir is the verify dir (a worktree for a worktree agent); mainDir the main checkout, as countCheck's dir.
+    const baselineFor = countBaselineFor(mainDir ?? dir, state, dir);
     const out = [];
     for (let i = 0; i < configured.length; i++) {
       const { name, command } = configured[i];
       const recorded = readableRecordedTotals(record.commands[i].totals);
-      const hasBaseline = all ? readSummaries(all[command]) !== null : false;
+      const base = baselineFor(command);
+      const hasBaseline = base ? readSummaries(base[command]) !== null : false;
       if (hasBaseline && (!recorded || recorded.status === "none")) return null;
       out.push({ name, command, ok: true, credited: "pre-commit", ...(recorded ? { recorded } : {}) });
     }
@@ -1721,8 +1735,8 @@ runHook("stop-gate", async (input) => {
         currentFingerprint &&
         (sameTree(rec.fingerprint, currentFingerprint) || (rec.scope === scopeNow && (redViaNoTestPaths = onlyNoTestPathsChanged(vdir, cfg, rec.fingerprint, vchanged)))) &&
         !(subagent && (redByDesignClaim(input.last_assistant_message) ?? redByDesignClaim(lastHandbackMessage(input.agent_transcript_path)))) &&
-        !preCommitCredit(vdir, cfg, vchanged, state) &&
-        !treeCredit(vdir, cfg, state, computeTree(vdir))
+        !preCommitCredit(vdir, cfg, vchanged, state, dir) &&
+        !treeCredit(vdir, cfg, state, computeTree(vdir), dir)
       ) {
         lastRed = rec;
       }
@@ -1970,7 +1984,7 @@ runHook("stop-gate", async (input) => {
   // card verified-tree-record: treeBefore is the working tree immediately before the first command; a record of
   // it (any writer: Stop, verify.mjs, land, pre-commit) is tried before preCommitCredit's last-run.json.
   const treeBefore = skipVerification ? null : computeTree(vdir);
-  const credited = skipVerification ? null : (treeCredit(vdir, cfg, state, treeBefore) ?? preCommitCredit(vdir, cfg, vchanged, state));
+  const credited = skipVerification ? null : (treeCredit(vdir, cfg, state, treeBefore, dir) ?? preCommitCredit(vdir, cfg, vchanged, state, dir));
   // card gate-docs-skip-unless-named: a targeted run is never a full run (no record, no ratchet, no state.verified).
   const targeted = !credited && targetedFiles ? targetedFiles : null;
   if (!skipVerification && credited) {
@@ -2008,7 +2022,7 @@ runHook("stop-gate", async (input) => {
         const output = r.stderr + "\n" + r.stdout;
         // card gate-output-names-failures: the block reason leads with the failing test names (R1/R2);
         // commandFailures below keeps the untruncated output for the tests_red_by_design coverage check.
-        problems.push(`\`${command}\` failed (${why}):\n${failureSummary(output, 40)}`);
+        problems.push(`\`${redactText(command, cfg.secrets)}\` failed (${why}):\n${redactText(failureSummary(output, 40), cfg.secrets)}`);
         commandFailures.push({ command, output });
         failedRuns.push({ status: r.status, timedOut: r.timedOut });
       }
@@ -2035,6 +2049,7 @@ runHook("stop-gate", async (input) => {
             node: process.version,
             at: new Date().toISOString(),
             by: subagent ? "subagent-stop" : "stop",
+            ranIn: realpathSync(vdir),
             commands: results.map((r) => ({ name: r.name, command: r.command, exit: 0, durationMs: typeof r.durationMs === "number" ? r.durationMs : 0 })),
             totals,
           });
@@ -2150,7 +2165,7 @@ runHook("stop-gate", async (input) => {
           // (none of them a dropped command) closes that gap.
           postCommandProblems - preVerificationProblems === commandFailures.length
         ) {
-          const coverage = redByDesignCoverage(claimFiles, commandFailures, changed, dir);
+          const coverage = redByDesignCoverage(claimFiles, commandFailures, changed, dir, cfg.secrets);
           if (coverage.covered) {
             // Same as a subagent's green gate: counter resets, no checkpoint, no turn.
             state.agentBlocks = { ...(state.agentBlocks || {}), [subagent.id]: 0 };

package/node_modules/@dougharness/gates/scripts/verify.mjs

@@ -7,13 +7,13 @@
 // No count ratchet and no scans here (no session baseline); the Stop gate does those. Takes the Stop gate's gate.lock (under the git common dir, shared by every worktree) around the commands (card verify-takes-gate-lock).
 
 import { spawnSync } from "node:child_process";
-import { unlinkSync } from "node:fs";
+import { unlinkSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { loadConfig } from "../lib/config.mjs";
 import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
 import { runCommand, tail } from "../lib/run.mjs";
 import { parseTotals, readSummaries, sumTotals } from "../lib/test-totals.mjs";
-import { computeTree, readRecord, writeRecord, removeRecord, creditable, resolveCommands } from "../lib/verified-tree.mjs";
+import { computeTree, readRecord, writeRecord, removeRecord, creditable, exitCreditUsable, resolveCommands } from "../lib/verified-tree.mjs";
 
 function parseArgs(argv) {
   const o = { noCredit: false, json: false, commands: [], creditDirs: [] };
@@ -51,6 +51,20 @@ function toplevel() {
   return process.cwd();
 }
 
+// True when dir is a main checkout (git dir equals the common dir), or when that cannot be told (fail closed). Never throws.
+function isMainCheckout(dir) {
+  try {
+    const env = {};
+    for (const [k, v] of Object.entries(process.env)) if (!k.startsWith("GIT_")) env[k] = v;
+    const r = spawnSync("git", ["rev-parse", "--git-dir", "--git-common-dir"], { cwd: dir, encoding: "utf8", env, timeout: 10000 });
+    const [a, b] = r.status === 0 ? r.stdout.trim().split("\n") : [];
+    if (!a || !b) return true;
+    return realpathSync(resolve(dir, a)) === realpathSync(resolve(dir, b));
+  } catch {
+    return true;
+  }
+}
+
 function passed(totals) {
   const s = totals && totals.status === "ok" ? readSummaries(totals) : null;
   if (!s) return null;
@@ -86,9 +100,11 @@ function main() {
     const wanted = commands.map((c) => c.command);
     let record = null;
     let fromOther = false;
+    // Card verify-credit-foreign-skipped: in a main checkout a record from another checkout that skipped tests is not evidence.
+    const mainCwd = isMainCheckout(cwd);
     for (const [i, d] of [recordDir, ...o.creditDirs.map((c) => resolve(c))].entries()) {
       const rec = readRecord(d);
-      if (rec && creditable(cwd, cfg, rec, treeBefore, wanted).ok) {
+      if (rec && creditable(cwd, cfg, rec, treeBefore, wanted).ok && (!mainCwd || exitCreditUsable(rec, cwd))) {
         record = rec;
         fromOther = i > 0;
         break;
@@ -185,7 +201,7 @@ function main() {
   if (ok) {
     const treeAfter = computeTree(cwd);
     if (treeBefore && treeAfter && treeBefore === treeAfter) {
-      writeRecord(recordDir, { version: 1, tree: treeAfter, node: process.version, at: new Date().toISOString(), by: o.by || "verify", commands: recCommands, totals });
+      writeRecord(recordDir, { version: 1, tree: treeAfter, node: process.version, at: new Date().toISOString(), by: o.by || "verify", ranIn: realpathSync(cwd), commands: recCommands, totals });
     }
   } else {
     removeRecord(recordDir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/cli",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "doug: tailored, approval-gated harness install for Claude Code.",
   "type": "module",
   "license": "MIT",
@@ -23,8 +23,8 @@
     "node": ">=22.16"
   },
   "dependencies": {
-    "@dougharness/flow": "1.4.0",
-    "@dougharness/gates": "1.4.0"
+    "@dougharness/flow": "1.5.0",
+    "@dougharness/gates": "1.5.0"
   },
   "bundleDependencies": [
     "@dougharness/flow",