@hiveai/cli 0.24.0 → 0.25.0

package/dist/index.js

@@ -2253,6 +2253,7 @@ import path11 from "path";
 import {
   buildFrontmatter,
   loadMemoriesFromDir as loadMemoriesFromDir5,
+  meetsSeedQualityFloor,
   memoryFilePath,
   serializeMemory as serializeMemory2,
   STACK_PACK_TAG
@@ -2293,7 +2294,12 @@ app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: t
       body: `Controllers must never import Prisma/TypeORM directly \u2014 that belongs in Services.
 
 Controller \u2192 Service \u2192 Repository (or direct ORM) is the required layering.
-Direct ORM usage in controllers makes testing impossible and couples transport to persistence.`
+Direct ORM usage in controllers makes testing impossible and couples transport to persistence.`,
+      sensor: {
+        pattern: "@prisma/client|PrismaClient|getRepository\\(|createQueryBuilder\\(",
+        paths: ["**/*.controller.ts"],
+        message: "ORM/Prisma used directly in a controller \u2014 move persistence into a Service (Controller \u2192 Service \u2192 Repository)."
+      }
     },
     {
       slug: "nestjs-exception-filter-for-prisma",
@@ -2478,7 +2484,11 @@ Routes without schema accept any body and bypass Fastify's fast-json-stringify s
 
 Calling $disconnect() after each request wastes the warm connection pool.
 Create one PrismaClient per process (module-level singleton), not per request.
-Disconnecting is only needed when the process is shutting down.`
+Disconnecting is only needed when the process is shutting down.`,
+      sensor: {
+        pattern: "\\$disconnect\\(\\)",
+        message: "prisma.$disconnect() per request drains the warm connection pool in serverless \u2014 use a module-level PrismaClient singleton and only disconnect on shutdown."
+      }
     },
     {
       slug: "prisma-migrations-never-modify",
@@ -2534,7 +2544,11 @@ const store = useStore();
 const count = useStore((s) => s.count);
 \`\`\`
 
-Subscribing to the whole store is the single most common Zustand performance mistake.`
+Subscribing to the whole store is the single most common Zustand performance mistake.`,
+      sensor: {
+        pattern: "use[A-Z]\\w*Store\\(\\s*\\)",
+        message: "A Zustand store hook called with no selector subscribes to the WHOLE store (re-renders on any change) \u2014 pass a slice selector: useStore(s => s.field)."
+      }
     },
     {
       slug: "zustand-devtools-wrap-dev-only",
@@ -2755,7 +2769,8 @@ const users = await User.find({});
 const users = await User.find({}).lean();
 \`\`\`
 
-Never use .lean() when you need to call .save() or Mongoose instance methods.`
+\`.lean()\` skips hydration into a Mongoose \`Document\`, so getters, virtuals, \`toObject()\` and
+instance methods are gone. Never use \`.lean()\` when you then call \`.save()\` or instance methods.`
     },
     {
       slug: "mongoose-index-frequently-queried-fields",
@@ -2974,7 +2989,11 @@ A committed key lets anyone forge sessions and CSRF tokens.`
 db.execute(f"SELECT * FROM users WHERE id = {uid}")
 # \u2705
 db.execute("SELECT * FROM users WHERE id = %s", (uid,))
-\`\`\``
+\`\`\``,
+      sensor: {
+        pattern: `execute\\(\\s*f["']`,
+        message: 'SQL built with an f-string inside execute() \u2014 SQL injection risk; use a parameterized query: execute("\u2026 %s \u2026", (params,)).'
+      }
     }
   ],
   vue: [
@@ -3342,6 +3361,7 @@ async function seedStackPack(haivePaths, stack) {
   let memCount = 0;
   let sensorCount = 0;
   for (const mem of memories) {
+    if (!meetsSeedQualityFloor(mem.body, Boolean(mem.sensor))) continue;
     const sensor = mem.sensor ? {
       kind: "regex",
       pattern: mem.sensor.pattern,
@@ -3390,7 +3410,7 @@ ${SEED_FOOTER(stack)}` });
 
 // src/commands/init.ts
 var execFileAsync = promisify2(execFile2);
-var HAIVE_GITHUB_ACTION_REF = `v${"0.24.0"}`;
+var HAIVE_GITHUB_ACTION_REF = `v${"0.25.0"}`;
 var PROJECT_CONTEXT_TEMPLATE = `# Project context
 
 > Generated by \`haive init\`. Run \`haive init --bootstrap\` to auto-fill from your codebase,
@@ -8676,7 +8696,7 @@ When done, respond with: "Imported N memories: [list of IDs]" or "Nothing action
   };
 }
 var SERVER_NAME = "haive";
-var SERVER_VERSION = "0.24.0";
+var SERVER_VERSION = "0.25.0";
 function jsonResult(data) {
   return {
     content: [
@@ -14453,7 +14473,7 @@ function registerDoctor(program2) {
         fix: "Edit .ai/haive.config.json: set autoSessionEnd: true (or re-run `haive init` without --manual)."
       });
     }
-    findings.push(...await collectInstallFindings(root, "0.24.0"));
+    findings.push(...await collectInstallFindings(root, "0.25.0"));
     findings.push(...await collectToolchainFindings(root));
     try {
       const legacyRaw = execSync3("haive-mcp --version", {
@@ -14461,7 +14481,7 @@ function registerDoctor(program2) {
         timeout: 3e3,
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
-      const cliVersion = "0.24.0";
+      const cliVersion = "0.25.0";
       if (legacyRaw && legacyRaw !== cliVersion) {
         findings.push({
           severity: "warn",
@@ -16165,7 +16185,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
       findings: [{ severity: "info", code: "enforcement-off", message: "hAIve enforcement is disabled." }]
     });
   }
-  findings.push(...await inspectIntegrationVersions(root, "0.24.0"));
+  findings.push(...await inspectIntegrationVersions(root, "0.25.0"));
   if (config.enforcement?.requireBriefingFirst !== false && stage !== "ci") {
     const hasBriefing = await hasRecentBriefingMarker2(paths, sessionId);
     findings.push(hasBriefing ? { severity: "ok", code: "briefing-loaded", message: "A recent hAIve briefing marker exists." } : {
@@ -18324,7 +18344,7 @@ function registerBridges(program2) {
 
 // src/index.ts
 var program = new Command64();
-program.name("haive").description("hAIve - repo-native memory and context policy for coding-agent harnesses").version("0.24.0").option("--advanced", "show maintenance and experimental commands in help");
+program.name("haive").description("hAIve - repo-native memory and context policy for coding-agent harnesses").version("0.25.0").option("--advanced", "show maintenance and experimental commands in help");
 registerInit(program);
 registerWelcome(program);
 registerResolveProject(program);