@hivelore/cli 0.35.1 → 0.37.0

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   preCommitCheck,
   readPresumedCorrectTargets,
   runHaiveMcpStdio
-} from "./chunk-QQANGHJK.js";
+} from "./chunk-VLRQ4MRO.js";
 import {
   registerMemoryPending
 } from "./chunk-OYJKHD22.js";
@@ -3755,7 +3755,7 @@ ${SEED_FOOTER(stack)}` });
 
 // src/commands/init.ts
 var execFileAsync = promisify2(execFile2);
-var HAIVE_GITHUB_ACTION_REF = `v${"0.35.1"}`;
+var HAIVE_GITHUB_ACTION_REF = `v${"0.37.0"}`;
 var PROJECT_CONTEXT_TEMPLATE = `# Project context
 
 > Generated by \`hivelore init\`. Run \`hivelore init --bootstrap\` to auto-fill from your codebase,
@@ -6090,6 +6090,7 @@ function registerMemoryTried(memory2) {
     } else if (result.hint) {
       ui.warn(result.hint);
     }
+    ui.info(`  Prefer a real test? \`hivelore sensors scaffold ${result.id}\` generates a pending test + the wiring command.`);
   });
 }
 
@@ -7325,13 +7326,15 @@ import {
   loadPreventionEvents as loadPreventionEvents2,
   parseSince,
   readUsageEvents,
+  renderPreventionReceiptShare,
   resolveHaivePaths as resolveHaivePaths27,
   usageLogSize
 } from "@hivelore/core";
 function registerStats(program2) {
   const stats = program2.command("stats").description("Show MCP tool-usage stats and prevention receipts.");
-  stats.command("receipt").description("Show documented mistakes refused by the gate over a time window").addHelpText("after", "\nParent options also apply: --since <window> (default 7d here), --json, --dir <dir>.").action(async () => {
+  const receiptCmd = stats.command("receipt").description("Show documented mistakes refused by the gate over a time window").option("--share", "emit a Markdown block ready to paste into Slack or a PR (with attribution)", false).addHelpText("after", "\nParent options also apply: --since <window> (default 7d here), --json, --dir <dir>.").action(async () => {
     const opts = stats.opts();
+    const sub = receiptCmd.opts();
     const root = findProjectRoot28(opts.dir);
     const paths = resolveHaivePaths27(root);
     const sinceRaw = stats.getOptionValueSource("since") === "default" ? "7d" : opts.since ?? "7d";
@@ -7342,7 +7345,8 @@ function registerStats(program2) {
       existsSync33(paths.memoriesDir) ? loadMemoriesFromDir11(paths.memoriesDir) : Promise.resolve([])
     ]);
     const receipt = buildPreventionReceipt(events, memories, usage, { since });
-    console.log(opts.json ? JSON.stringify(receipt, null, 2) : renderPreventionReceipt(receipt));
+    const output = sub.share ? renderPreventionReceiptShare(receipt) : opts.json ? JSON.stringify(receipt, null, 2) : renderPreventionReceipt(receipt);
+    console.log(output);
   });
   stats.option("--since <window>", "ISO date or relative (e.g. '7d', '24h', '30m')", "30d").option("--json", "emit JSON instead of human-readable output", false).option("--memory-hits", "show top-read memories (which mems are actually being used)", false).option(
     "--export-report <path>",
@@ -8956,7 +8960,7 @@ function registerDoctor(program2) {
         fix: "Edit .ai/haive.config.json: set autoSessionEnd: true (or re-run `hivelore init` without --manual)."
       });
     }
-    findings.push(...await collectInstallFindings(root, "0.35.1"));
+    findings.push(...await collectInstallFindings(root, "0.37.0"));
     findings.push(...await collectToolchainFindings(root));
     try {
       const legacyRaw = execSync("haive-mcp --version", {
@@ -8964,7 +8968,7 @@ function registerDoctor(program2) {
         timeout: 3e3,
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
-      const cliVersion = "0.35.1";
+      const cliVersion = "0.37.0";
       if (legacyRaw && legacyRaw !== cliVersion) {
         findings.push({
           severity: "warn",
@@ -9723,6 +9727,7 @@ import {
   readRecentBriefingMarker,
   recordPreventionHits,
   resolveBriefingBudget as resolveBriefingBudget2,
+  incidentSuffix,
   resolveHaivePaths as resolveHaivePaths35,
   runSensors,
   saveConfig as saveConfig3,
@@ -9872,7 +9877,8 @@ async function executeCommandSensor(spec, root) {
     command: spec.command,
     kind: spec.kind,
     severity: spec.severity,
-    message: spec.message
+    message: spec.message,
+    ...spec.incident ? { incident: spec.incident } : {}
   };
   try {
     const { stdout, stderr } = await exec2("bash", ["-c", spec.command], {
@@ -10665,7 +10671,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
       findings: [{ severity: "info", code: "enforcement-off", message: "Hivelore enforcement is disabled." }]
     });
   }
-  findings.push(...await inspectIntegrationVersions(root, "0.35.1"));
+  findings.push(...await inspectIntegrationVersions(root, "0.37.0"));
   if (config.enforcement?.requireBriefingFirst !== false && stage !== "ci") {
     const hasBriefing = await hasRecentBriefingMarker(paths, sessionId);
     findings.push(hasBriefing ? { severity: "ok", code: "briefing-loaded", message: "A recent Hivelore briefing marker exists." } : {
@@ -11020,7 +11026,7 @@ async function runSensorGate(paths, diff, stage) {
         findings.push({
           severity: "error",
           code: "sensor-block",
-          message: `Block sensor fired \u2014 ${hit.memory_id}: ${hit.message}${where}`,
+          message: `Block sensor fired \u2014 ${hit.memory_id}: ${hit.message}${where}${incidentSuffix(hit.sensor.incident)}`,
           fix: "Remove the flagged pattern, or run `hivelore sensors check` to inspect the match.",
           impact: 45,
           memory_ids: [hit.memory_id]
@@ -11029,7 +11035,7 @@ async function runSensorGate(paths, diff, stage) {
         findings.push({
           severity: "warn",
           code: "sensor-warn",
-          message: `Sensor flagged ${hit.memory_id}: ${hit.message}${where}`,
+          message: `Sensor flagged ${hit.memory_id}: ${hit.message}${where}${incidentSuffix(hit.sensor.incident)}`,
           fix: "Review the flagged line; `hivelore sensors check` shows the matched code.",
           impact: 5,
           memory_ids: [hit.memory_id]
@@ -11091,7 +11097,7 @@ ${run.output_tail}` : "";
           findings.push({
             severity: "error",
             code: "sensor-block",
-            message: `Block ${run.kind} sensor fired \u2014 ${run.memory_id}: ${run.message}
+            message: `Block ${run.kind} sensor fired \u2014 ${run.memory_id}: ${run.message}${incidentSuffix(run.incident)}
 command: ${run.command} (exit ${run.exit_code}, ${run.duration_ms}ms)${outputBlock}`,
             fix: "Fix the behaviour the command checks, or run `hivelore sensors check --commands` to inspect it.",
             impact: 45,
@@ -11101,7 +11107,7 @@ command: ${run.command} (exit ${run.exit_code}, ${run.duration_ms}ms)${outputBlo
           findings.push({
             severity: "warn",
             code: "sensor-warn",
-            message: `${run.kind} sensor flagged ${run.memory_id}: ${run.message} (exit ${run.exit_code})${outputBlock}`,
+            message: `${run.kind} sensor flagged ${run.memory_id}: ${run.message}${incidentSuffix(run.incident)} (exit ${run.exit_code})${outputBlock}`,
             fix: "Review the failing command; `hivelore sensors check --commands` re-runs it.",
             impact: 5,
             memory_ids: [run.memory_id]
@@ -11795,7 +11801,10 @@ jobs:
             "
 
 Weekly total: **" + ($receipt.total|tostring) + "** refused; previous window: **" +
-            ($receipt.previous_total|tostring) + "**."
+            ($receipt.previous_total|tostring) + "**." +
+            "
+
+<sub>\u{1F6E1}\uFE0F Generated by [Hivelore](https://github.com/Doucs91/hivelore) \u2014 the deterministic policy gate for agent-written code.</sub>"
           ')" || exit 0
           comments="$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --paginate 2>/dev/null)" || exit 0
           comment_id="$(printf '%s' "$comments" | jq -r '.[] | select(.body | contains("<!-- haive:prevention-receipt -->")) | .id' | head -1)"
@@ -11810,6 +11819,30 @@ Weekly total: **" + ($receipt.total|tostring) + "** refused; previous window: **
 # haive:enforcement-workflow:end
 `;
 }
+var CONTENT_CATCH_CODES = /* @__PURE__ */ new Set(["sensor-block", "precommit-policy-block"]);
+var SETUP_GATE_CODES = /* @__PURE__ */ new Set([
+  "briefing-missing",
+  "session-recap-missing",
+  "decision-coverage-missing",
+  "bootstrap-incomplete",
+  "enforcement-score-below-threshold"
+]);
+function printBlockHeadline(report) {
+  const blocking = report.categories?.blocking ?? report.findings.filter((f) => f.severity === "error");
+  if (blocking.length === 0) return;
+  const catches = blocking.filter((f) => CONTENT_CATCH_CODES.has(f.code));
+  console.log();
+  if (catches.length > 0) {
+    console.log(ui.red(ui.bold("\u{1F6E1}\uFE0F  A documented lesson refused this commit \u2014 about the change you just made:")));
+    for (const c of catches) {
+      const id = c.memory_ids?.[0] ?? c.code;
+      console.log(`    ${ui.red("\u2022")} ${ui.bold(id)}  ${c.message.split("\n")[0]}`);
+    }
+  } else if (blocking.every((f) => SETUP_GATE_CODES.has(f.code))) {
+    console.log(ui.yellow(ui.bold("\u2699  Setup gate \u2014 about your repo's baseline, not the change you just made.")));
+    console.log(ui.dim("    Fill the knowledge layer once (bootstrap / load a briefing); later commits pass silently."));
+  }
+}
 function printReport(report, json, explain = false) {
   if (json) {
     console.log(JSON.stringify(report, null, 2));
@@ -11818,6 +11851,7 @@ function printReport(report, json, explain = false) {
   console.log(ui.bold(`Hivelore enforcement \u2014 ${report.mode}${report.actor ? ` \xB7 ${report.actor}` : ""}`));
   console.log(ui.dim(`  root: ${report.root}`));
   console.log(ui.dim(`  score: ${report.score.score}% / threshold ${report.score.threshold}%`));
+  if (report.should_block) printBlockHeadline(report);
   if (explain) {
     printFindingGroup("Blocking", report.categories.blocking, "error");
     printFindingGroup("Review", report.categories.review, "warn");
@@ -12126,10 +12160,13 @@ import {
   loadConfig as loadConfig13,
   loadSensorLedger as loadSensorLedger4,
   loadMemoriesFromDir as loadMemoriesFromDir15,
+  parseLessonFields,
   recordPreventionHits as recordPreventionHits2,
   resolveHaivePaths as resolveHaivePaths36,
   runSensors as runSensors2,
+  scaffoldPostIncidentTest,
   selectCommandSensors as selectCommandSensors2,
+  TEST_FRAMEWORKS,
   sensorPatternBrittleness as sensorPatternBrittleness2,
   sensorSelfCheck as sensorSelfCheck2,
   sensorAppliesToPath as sensorAppliesToPath3,
@@ -12364,7 +12401,7 @@ function registerSensors(program2) {
   });
   sensors.command("propose").description(
     "Propose a discriminating sensor for a memory \u2014 you write the pattern, Hivelore validates it before\n  trusting it to block. Mirrors the MCP `propose_sensor` tool (the agent-authored path).\n\n  A `block` proposal is accepted ONLY if it is not brittle, stays SILENT on the current code,\n  and FIRES on the bad example. Rejected proposals are not written \u2014 fix and re-run.\n\n  Example:\n    hivelore sensors propose <memory-id> \\\n      --pattern 'stripe\\.paymentIntents\\.create' --absent 'idempotencyKey' \\\n      --bad-example 'stripe.paymentIntents.create({ amount })'"
-  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | shell | test \u2014 command kinds route the team's own oracle to this lesson", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
+  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | shell | test \u2014 command kinds route the team's own oracle to this lesson", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
     if (opts.kind === "shell" || opts.kind === "test") {
       if (!opts.command?.trim()) {
         ui.error("--kind shell|test requires --command.");
@@ -12372,7 +12409,7 @@ function registerSensors(program2) {
         return;
       }
       const root2 = findProjectRoot39(opts.dir);
-      const { proposeSensor } = await import("./server-W5Q35K7Q.js");
+      const { proposeSensor } = await import("./server-J6TDFG2C.js");
       const out = await proposeSensor(
         {
           memory_id: id,
@@ -12384,6 +12421,7 @@ function registerSensors(program2) {
           bad_example: void 0,
           severity: opts.severity === "warn" ? "warn" : "block",
           message: opts.message,
+          incident: opts.incident,
           flags: void 0,
           paths: opts.paths ? opts.paths.split(",").map((p) => p.trim()).filter(Boolean) : []
         },
@@ -12435,6 +12473,7 @@ function registerSensors(program2) {
       ...opts.flags ? { flags: opts.flags } : {},
       paths: anchorPaths,
       message: opts.message?.trim() || deriveProposedMessage(found.memory.body, opts.pattern, opts.absent),
+      ...opts.incident?.trim() ? { incident: opts.incident.trim() } : {},
       severity,
       autogen: false,
       last_fired: null
@@ -12459,6 +12498,56 @@ function registerSensors(program2) {
       `self-check: silent on current=${verdict.self_check.silent_on_current}` + (verdict.self_check.fires_on_bad === null ? "; no bad example tested" : `; fires on bad=${verdict.self_check.fires_on_bad}`)
     );
   });
+  sensors.command("scaffold").description(
+    "Generate a PENDING post-incident test from a lesson (mem_tried/attempt/gotcha) \u2014 the on-ramp to\n  a command sensor. Writes a test stub carrying the incident's provenance, then prints the exact\n  `sensors propose --kind test` line to arm it once you've written the assertion. It never arms a\n  sensor itself \u2014 propose_sensor stays the sole validated writer.\n\n  Example:\n    hivelore sensors scaffold 2026-07-03-attempt-refund-exceeds-capture --framework vitest"
+  ).argument("<memory-id>", "lesson id to scaffold a test from").option("--framework <fw>", `test framework: ${TEST_FRAMEWORKS.join(" | ")} (auto-detected when omitted)`).option("--out <path>", "override the generated test file path (project-relative)").option("--stdout", "print the test to stdout instead of writing a file", false).option("--force", "overwrite an existing file at the target path", false).option("-d, --dir <dir>", "project root").action(async (id, opts) => {
+    const root = findProjectRoot39(opts.dir);
+    const paths = resolveHaivePaths36(root);
+    const loaded = existsSync43(paths.memoriesDir) ? await loadMemoriesFromDir15(paths.memoriesDir) : [];
+    const found = loaded.find(({ memory: memory2 }) => memory2.frontmatter.id === id);
+    if (!found) {
+      ui.error(`No memory found with id ${id}`);
+      process.exitCode = 1;
+      return;
+    }
+    const framework = opts.framework ? normalizeFramework(opts.framework) : await detectTestFramework(root);
+    if (!framework) {
+      ui.error(`Unknown --framework "${opts.framework}". Use one of: ${TEST_FRAMEWORKS.join(", ")}.`);
+      process.exitCode = 1;
+      return;
+    }
+    const fields = parseLessonFields(found.memory.body);
+    const fm = found.memory.frontmatter;
+    const scaffold = scaffoldPostIncidentTest(
+      {
+        memoryId: id,
+        title: fields.title || id,
+        whyFailed: fields.whyFailed,
+        instead: fields.instead,
+        incident: fm.sensor?.incident,
+        paths: fm.anchor.paths
+      },
+      { framework, outPath: opts.out }
+    );
+    if (opts.stdout) {
+      console.log(scaffold.content);
+      ui.info(`Arm it once written: ${scaffold.proposeCommand}`);
+      return;
+    }
+    const abs = path41.isAbsolute(scaffold.relPath) ? scaffold.relPath : path41.resolve(root, scaffold.relPath);
+    if (existsSync43(abs) && !opts.force) {
+      ui.error(`${scaffold.relPath} already exists \u2014 pass --force to overwrite, or --out <path> for a different file.`);
+      process.exitCode = 1;
+      return;
+    }
+    await mkdir17(path41.dirname(abs), { recursive: true });
+    await writeFile27(abs, scaffold.content, "utf8");
+    ui.success(`Wrote ${framework} post-incident test \u2192 ${scaffold.relPath}`);
+    ui.info("  1. Fill in the assertion (RED on the incident, GREEN once fixed).");
+    ui.info(`  2. Run it: ${scaffold.runCommand}`);
+    ui.info("  3. Arm it as a deterministic gate:");
+    console.log(`     ${scaffold.proposeCommand}`);
+  });
   sensors.command("export").description("Export regex sensors into .ai/generated for external toolchains").option("--format <format>", "grep | eslint", "grep").option("--out-dir <dir>", "output directory", ".ai/generated").option("-d, --dir <dir>", "project root").action(async (opts) => {
     const format = opts.format ?? "grep";
     if (format !== "grep" && format !== "eslint") {
@@ -12548,6 +12637,31 @@ function renderGrepScript(rows) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function normalizeFramework(input) {
+  const v = input.trim().toLowerCase();
+  if (v === "vitest") return "vitest";
+  if (v === "jest") return "jest";
+  if (v === "pytest" || v === "py" || v === "python") return "pytest";
+  if (v === "go" || v === "gotest" || v === "go-test") return "gotest";
+  return null;
+}
+async function detectTestFramework(root) {
+  try {
+    const pkgPath = path41.join(root, "package.json");
+    if (existsSync43(pkgPath)) {
+      const pkg = JSON.parse(await readFile20(pkgPath, "utf8"));
+      const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+      if (deps.vitest) return "vitest";
+      if (deps.jest || deps["ts-jest"]) return "jest";
+    }
+  } catch {
+  }
+  if (existsSync43(path41.join(root, "go.mod"))) return "gotest";
+  for (const signal of ["pyproject.toml", "setup.py", "pytest.ini", "requirements.txt", "tox.ini"]) {
+    if (existsSync43(path41.join(root, signal))) return "pytest";
+  }
+  return "vitest";
+}
 
 // src/commands/ingest.ts
 import { existsSync as existsSync44 } from "fs";
@@ -13209,7 +13323,7 @@ function registerBridges(program2) {
 
 // src/index.ts
 var program = new Command48();
-program.name("hivelore").description("Hivelore - repo-native memory and context policy for coding-agent harnesses").version("0.35.1").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
+program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.37.0").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
 registerInit(program);
 registerResolveProject(program);
 registerEnforce(program);