@groundnuty/macf 0.2.35 → 0.2.37

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (105) hide show
  1. package/dist/.build-info.json +2 -2
  2. package/dist/cli/claude-sh.d.ts +12 -10
  3. package/dist/cli/claude-sh.d.ts.map +1 -1
  4. package/dist/cli/claude-sh.js +26 -13
  5. package/dist/cli/claude-sh.js.map +1 -1
  6. package/dist/cli/commands/certs.js +3 -3
  7. package/dist/cli/commands/certs.js.map +1 -1
  8. package/dist/cli/commands/init.d.ts.map +1 -1
  9. package/dist/cli/commands/init.js +10 -0
  10. package/dist/cli/commands/init.js.map +1 -1
  11. package/dist/cli/commands/monitor.d.ts +16 -0
  12. package/dist/cli/commands/monitor.d.ts.map +1 -0
  13. package/dist/cli/commands/monitor.js +96 -0
  14. package/dist/cli/commands/monitor.js.map +1 -0
  15. package/dist/cli/commands/propose.d.ts +21 -0
  16. package/dist/cli/commands/propose.d.ts.map +1 -0
  17. package/dist/cli/commands/propose.js +128 -0
  18. package/dist/cli/commands/propose.js.map +1 -0
  19. package/dist/cli/commands/rules-refresh.d.ts +1 -0
  20. package/dist/cli/commands/rules-refresh.d.ts.map +1 -1
  21. package/dist/cli/commands/rules-refresh.js +22 -1
  22. package/dist/cli/commands/rules-refresh.js.map +1 -1
  23. package/dist/cli/commands/update.d.ts.map +1 -1
  24. package/dist/cli/commands/update.js +23 -2
  25. package/dist/cli/commands/update.js.map +1 -1
  26. package/dist/cli/env-files-update.d.ts.map +1 -1
  27. package/dist/cli/env-files-update.js +5 -1
  28. package/dist/cli/env-files-update.js.map +1 -1
  29. package/dist/cli/env-files.d.ts +38 -13
  30. package/dist/cli/env-files.d.ts.map +1 -1
  31. package/dist/cli/env-files.js +73 -14
  32. package/dist/cli/env-files.js.map +1 -1
  33. package/dist/cli/index.js +109 -0
  34. package/dist/cli/index.js.map +1 -1
  35. package/dist/cli/monitor/digest.d.ts +89 -0
  36. package/dist/cli/monitor/digest.d.ts.map +1 -0
  37. package/dist/cli/monitor/digest.js +232 -0
  38. package/dist/cli/monitor/digest.js.map +1 -0
  39. package/dist/cli/monitor/github-reader.d.ts +38 -0
  40. package/dist/cli/monitor/github-reader.d.ts.map +1 -0
  41. package/dist/cli/monitor/github-reader.js +65 -0
  42. package/dist/cli/monitor/github-reader.js.map +1 -0
  43. package/dist/cli/monitor/reflections.d.ts +18 -0
  44. package/dist/cli/monitor/reflections.d.ts.map +1 -0
  45. package/dist/cli/monitor/reflections.js +72 -0
  46. package/dist/cli/monitor/reflections.js.map +1 -0
  47. package/dist/cli/monitor/run.d.ts +30 -0
  48. package/dist/cli/monitor/run.d.ts.map +1 -0
  49. package/dist/cli/monitor/run.js +67 -0
  50. package/dist/cli/monitor/run.js.map +1 -0
  51. package/dist/cli/project-rules.d.ts +105 -0
  52. package/dist/cli/project-rules.d.ts.map +1 -0
  53. package/dist/cli/project-rules.js +305 -0
  54. package/dist/cli/project-rules.js.map +1 -0
  55. package/dist/cli/propose/candidates.d.ts +95 -0
  56. package/dist/cli/propose/candidates.d.ts.map +1 -0
  57. package/dist/cli/propose/candidates.js +117 -0
  58. package/dist/cli/propose/candidates.js.map +1 -0
  59. package/dist/cli/propose/invariants.d.ts +49 -0
  60. package/dist/cli/propose/invariants.d.ts.map +1 -0
  61. package/dist/cli/propose/invariants.js +154 -0
  62. package/dist/cli/propose/invariants.js.map +1 -0
  63. package/dist/cli/propose/proposal-writer.d.ts +33 -0
  64. package/dist/cli/propose/proposal-writer.d.ts.map +1 -0
  65. package/dist/cli/propose/proposal-writer.js +53 -0
  66. package/dist/cli/propose/proposal-writer.js.map +1 -0
  67. package/dist/cli/propose/report.d.ts +49 -0
  68. package/dist/cli/propose/report.d.ts.map +1 -0
  69. package/dist/cli/propose/report.js +227 -0
  70. package/dist/cli/propose/report.js.map +1 -0
  71. package/dist/cli/propose/run.d.ts +41 -0
  72. package/dist/cli/propose/run.d.ts.map +1 -0
  73. package/dist/cli/propose/run.js +62 -0
  74. package/dist/cli/propose/run.js.map +1 -0
  75. package/dist/cli/settings-writer.d.ts +87 -6
  76. package/dist/cli/settings-writer.d.ts.map +1 -1
  77. package/dist/cli/settings-writer.js +141 -6
  78. package/dist/cli/settings-writer.js.map +1 -1
  79. package/dist/reconciler/parse-delivered.d.ts +32 -0
  80. package/dist/reconciler/parse-delivered.d.ts.map +1 -0
  81. package/dist/reconciler/parse-delivered.js +18 -0
  82. package/dist/reconciler/parse-delivered.js.map +1 -0
  83. package/dist/reconciler/parse-processed.d.ts +57 -0
  84. package/dist/reconciler/parse-processed.d.ts.map +1 -0
  85. package/dist/reconciler/parse-processed.js +41 -0
  86. package/dist/reconciler/parse-processed.js.map +1 -0
  87. package/dist/reconciler/reconcile.d.ts +130 -0
  88. package/dist/reconciler/reconcile.d.ts.map +1 -0
  89. package/dist/reconciler/reconcile.js +119 -0
  90. package/dist/reconciler/reconcile.js.map +1 -0
  91. package/dist/reconciler/run.d.ts +23 -0
  92. package/dist/reconciler/run.d.ts.map +1 -0
  93. package/dist/reconciler/run.js +273 -0
  94. package/dist/reconciler/run.js.map +1 -0
  95. package/package.json +2 -2
  96. package/plugin/rules/coordination.md +22 -13
  97. package/plugin/rules/gh-token-attribution-traps.md +4 -0
  98. package/plugin/rules/mention-routing-hygiene.md +2 -0
  99. package/plugin/rules/observability-wiring.md +3 -3
  100. package/plugin/rules/reflection-staging.md +65 -0
  101. package/plugin/rules/silent-fallback-hazards.md +64 -8
  102. package/scripts/check-auditor-never-acts.sh +167 -0
  103. package/scripts/check-gh-attribution.sh +230 -0
  104. package/scripts/emit-turn-receipt.sh +81 -0
  105. package/scripts/harvest-reflection.sh +125 -0
@@ -0,0 +1,125 @@
1
+ #!/usr/bin/env bash
2
+ #
3
+ # harvest-reflection.sh — Claude Code PreCompact hook that harvests a *staged*
4
+ # reflection the agent maintains (`.claude/.macf/reflections/pending.json`),
5
+ # wraps it in the versioned reflection-schema envelope (groundnuty/macf#500,
6
+ # DR-026 F2 — see @groundnuty/macf-core `reflection.ts`), appends it as one
7
+ # line to a local JSONL ledger, and clears the stage. Local + cheap; F4's
8
+ # Monitor reads the ledger back.
9
+ #
10
+ # Hook contract (PreCompact): JSON on stdin carrying `session_id`,
11
+ # `transcript_path?`, `cwd`, `hook_event_name="PreCompact"`, `trigger`
12
+ # ("auto"|"manual"), `permission_mode`, `effort`. Registration is matcher-less.
13
+ # `$CLAUDE_PROJECT_DIR` is available.
14
+ #
15
+ # MACF doctrine (DR-023 §UC-3): observational + NON-BLOCKING. This hook ALWAYS
16
+ # `exit 0` — a non-zero exit would delay/block compaction and harm the operator.
17
+ # Every risky step is guarded (`|| true`) so an internal failure still emits a
18
+ # (possibly mechanical-only) record OR, worst case, exits 0 cleanly. There is
19
+ # NO `exit 2` anywhere. Fast + local (<100ms target; 30s hard timeout); no
20
+ # network.
21
+ #
22
+ # Override: MACF_SKIP_REFLECTION_HARVEST=1 bypasses (consistent with the
23
+ # MACF_SKIP_* hook family).
24
+ set -uo pipefail
25
+
26
+ # Final safety net: any genuinely unexpected fault past this point must NOT
27
+ # brick compaction. Fail open (exit 0), same posture as check-gh-attribution.sh.
28
+ trap 'exit 0' ERR
29
+
30
+ # Cheap operator override — no stdin read, no parsing.
31
+ if [[ "${MACF_SKIP_REFLECTION_HARVEST:-}" == "1" ]]; then
32
+ exit 0
33
+ fi
34
+
35
+ # ── Read the PreCompact payload (all defensive: never fail on bad input) ──────
36
+ INPUT_JSON="$(cat 2>/dev/null || echo '')"
37
+ SESSION_ID="$(jq -r '.session_id // ""' <<<"$INPUT_JSON" 2>/dev/null || echo "")"
38
+ TRIGGER="$(jq -r '.trigger // ""' <<<"$INPUT_JSON" 2>/dev/null || echo "")"
39
+ PAYLOAD_CWD="$(jq -r '.cwd // ""' <<<"$INPUT_JSON" 2>/dev/null || echo "")"
40
+
41
+ # `compaction_type` is the payload trigger when it's a known value, else null.
42
+ # Emitted as a JSON literal for `--argjson`: a quoted string ("auto"/"manual")
43
+ # or the bare null literal.
44
+ case "$TRIGGER" in
45
+ auto|manual) COMPACTION_TYPE="\"$TRIGGER\"" ;;
46
+ *) COMPACTION_TYPE="null" ;;
47
+ esac
48
+
49
+ # ── Resolve the reflections dir + the staged pending file ─────────────────────
50
+ BASE_DIR="${CLAUDE_PROJECT_DIR:-$PAYLOAD_CWD}"
51
+ [[ -z "$BASE_DIR" ]] && BASE_DIR="."
52
+ DIR="$BASE_DIR/.claude/.macf/reflections"
53
+ PENDING="$DIR/pending.json"
54
+ mkdir -p "$DIR" 2>/dev/null || true
55
+
56
+ # ── Agent identity from the claude.sh-exported env (graceful when unset) ──────
57
+ AGENT_NAME="${MACF_AGENT_NAME:-}"
58
+ AGENT_ROLE="${MACF_AGENT_ROLE:-}"
59
+ PROJECT="${MACF_PROJECT:-}"
60
+ # Derive the bot login from the agent name: `<name>[bot]`, or empty if unknown.
61
+ if [[ -n "$AGENT_NAME" ]]; then
62
+ AGENT_LOGIN="${AGENT_NAME}[bot]"
63
+ else
64
+ AGENT_LOGIN=""
65
+ fi
66
+
67
+ TIMESTAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "")"
68
+
69
+ # ── Read the staged reflection fields (each defaulted if absent/invalid) ──────
70
+ # Default to an empty stage object; only overwrite if pending.json is valid
71
+ # JSON. This yields a mechanical-only record when there's no (or a broken)
72
+ # stage — still emitted so the Monitor sees the compaction.
73
+ STAGE_JSON='{}'
74
+ if [[ -f "$PENDING" ]]; then
75
+ if _stage="$(jq -c '.' "$PENDING" 2>/dev/null)" && [[ -n "$_stage" ]]; then
76
+ STAGE_JSON="$_stage"
77
+ fi
78
+ fi
79
+
80
+ # ── Build the envelope record with jq, merging the staged fields ──────────────
81
+ # Each staged array/string is defaulted inside jq so a partial stage is valid.
82
+ # `--argjson compaction_type` carries either a quoted string ("auto"/"manual")
83
+ # or the bare literal null.
84
+ RECORD="$(
85
+ jq -cn \
86
+ --arg schema_version "1.0" \
87
+ --arg kind "macf.reflection" \
88
+ --arg name "$AGENT_NAME" \
89
+ --arg role "$AGENT_ROLE" \
90
+ --arg login "$AGENT_LOGIN" \
91
+ --arg project "$PROJECT" \
92
+ --arg session_id "$SESSION_ID" \
93
+ --arg timestamp "$TIMESTAMP" \
94
+ --argjson compaction_type "$COMPACTION_TYPE" \
95
+ --argjson stage "$STAGE_JSON" \
96
+ '{
97
+ schema_version: $schema_version,
98
+ kind: $kind,
99
+ agent: { name: $name, role: $role, login: $login },
100
+ project: $project,
101
+ session_id: $session_id,
102
+ timestamp: $timestamp,
103
+ trigger: "pre-compact",
104
+ compaction_type: $compaction_type,
105
+ observed_patterns: ($stage.observed_patterns // []),
106
+ breaches: ($stage.breaches // []),
107
+ rule_evolution_signals: ($stage.rule_evolution_signals // []),
108
+ unresolved: ($stage.unresolved // []),
109
+ synthesis: ($stage.synthesis // "")
110
+ }' 2>/dev/null || echo ""
111
+ )"
112
+
113
+ # If even the jq build failed, bail cleanly — never block compaction.
114
+ [[ -z "$RECORD" ]] && exit 0
115
+
116
+ # ── Append the single-line record to the per-session JSONL ledger ─────────────
117
+ SAFE_SESSION="$SESSION_ID"
118
+ [[ -z "$SAFE_SESSION" ]] && SAFE_SESSION="unknown-session"
119
+ LEDGER="$DIR/${SAFE_SESSION}.jsonl"
120
+ printf '%s\n' "$RECORD" >>"$LEDGER" 2>/dev/null || true
121
+
122
+ # ── Clear the stage so the next session starts fresh ──────────────────────────
123
+ printf '%s\n' '{}' >"$PENDING" 2>/dev/null || true
124
+
125
+ exit 0