@hivelore/cli 0.39.1 → 0.42.1

package/dist/{chunk-YMIQAOFL.js → chunk-EJ7A4IKD.js}

@@ -125,7 +125,7 @@ import {
 import { z as z14 } from "zod";
 import { mkdir as mkdir3, writeFile as writeFile9 } from "fs/promises";
 import { existsSync as existsSync16 } from "fs";
-import path6 from "path";
+import path7 from "path";
 import {
   buildFrontmatter as buildFrontmatter2,
   memoryFilePath as memoryFilePath2,
@@ -135,20 +135,24 @@ import {
 import { z as z16 } from "zod";
 import { execSync } from "child_process";
 import { readFile as readFile3, writeFile as writeFile8 } from "fs/promises";
-import { existsSync as existsSync15 } from "fs";
-import path5 from "path";
+import { existsSync as existsSync15, rmSync, symlinkSync } from "fs";
+import os from "os";
+import path6 from "path";
 import {
   extractSensorExamples,
   extractTestFilePathsFromCommand,
   hasPendingTestMarker,
   judgeProposedSensor,
   loadMemoriesFromDir as loadMemoriesFromDir13,
+  scrubbedCommandEnv,
+  sensorPatternBrittleness,
   serializeMemory as serializeMemory7
 } from "@hivelore/core";
 import { z as z15 } from "zod";
+import path5 from "path";
 import { existsSync as existsSync17, statSync } from "fs";
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile10 } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 import { z as z17 } from "zod";
 import {
   buildProposeCommand,
@@ -160,7 +164,7 @@ import {
 } from "@hivelore/core";
 import { existsSync as existsSync18 } from "fs";
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile11 } from "fs/promises";
-import path8 from "path";
+import path9 from "path";
 import {
   draftsFromFindings,
   filterNewDrafts,
@@ -172,7 +176,7 @@ import {
 import { z as z18 } from "zod";
 import { writeFile as writeFile13, mkdir as mkdir7 } from "fs/promises";
 import { existsSync as existsSync20 } from "fs";
-import path10 from "path";
+import path11 from "path";
 import {
   buildFrontmatter as buildFrontmatter3,
   loadMemoriesFromDir as loadMemoriesFromDir16,
@@ -188,11 +192,11 @@ import {
 } from "@hivelore/core";
 import { mkdir as mkdir6, writeFile as writeFile12, rm } from "fs/promises";
 import { existsSync as existsSync19 } from "fs";
-import path9 from "path";
+import path10 from "path";
 import { execSync as execSync2 } from "child_process";
 import { readFile as readFile7, writeFile as writeFile14, readdir as readdir4 } from "fs/promises";
 import { existsSync as existsSync22 } from "fs";
-import path12 from "path";
+import path13 from "path";
 import {
   allocateBudget,
   assessBootstrapState,
@@ -237,7 +241,7 @@ import {
 import { z as z20 } from "zod";
 import { readdir as readdir3, readFile as readFile6 } from "fs/promises";
 import { existsSync as existsSync21 } from "fs";
-import path11 from "path";
+import path12 from "path";
 import {
   classifyMemoryPriority as coreClassifyPriority,
   isGlobPath,
@@ -1278,10 +1282,86 @@ async function memApprove(input, ctx) {
     file_path: found.filePath
   };
 }
+var cachedEngine;
+async function loadAstEngine() {
+  if (cachedEngine !== void 0) return cachedEngine;
+  try {
+    cachedEngine = await import("@ast-grep/napi");
+  } catch {
+    cachedEngine = null;
+  }
+  return cachedEngine;
+}
+async function astEngineAvailable() {
+  return await loadAstEngine() !== null;
+}
+function astLangForPath(filePath) {
+  const ext = path5.extname(filePath).toLowerCase();
+  if (ext === ".ts" || ext === ".mts" || ext === ".cts") return "TypeScript";
+  if (ext === ".tsx") return "Tsx";
+  if (ext === ".js" || ext === ".jsx" || ext === ".mjs" || ext === ".cjs") return "JavaScript";
+  return null;
+}
+function absentPresentInNode(node, absent) {
+  try {
+    if (node.find(absent)) return true;
+  } catch {
+  }
+  const text = node.text();
+  try {
+    return new RegExp(absent).test(text);
+  } catch {
+    return text.includes(absent);
+  }
+}
+async function runAstPattern(content, filePath, pattern, absent) {
+  const engine = await loadAstEngine();
+  if (!engine) return { status: "engine-missing", matches: [] };
+  const langName = astLangForPath(filePath);
+  if (!langName) return { status: "unsupported-language", matches: [] };
+  const lang = engine.Lang[langName];
+  let root;
+  try {
+    root = engine.parse(lang, content).root();
+  } catch (err) {
+    return { status: "parse-error", matches: [], detail: String(err).slice(0, 200) };
+  }
+  let nodes;
+  try {
+    nodes = root.findAll(pattern);
+  } catch (err) {
+    return { status: "invalid-pattern", matches: [], detail: String(err).slice(0, 200) };
+  }
+  const matches = [];
+  for (const node of nodes) {
+    if (absent && absentPresentInNode(node, absent)) continue;
+    const range = node.range();
+    matches.push({
+      startLine: range.start.line + 1,
+      endLine: range.end.line + 1,
+      text: node.text().trim().slice(0, 200)
+    });
+  }
+  return { status: "ok", matches };
+}
+async function runAstSensorOnContent(input) {
+  const scan = await runAstPattern(input.content, input.filePath, input.pattern, input.absent);
+  if (scan.status !== "ok" || !input.addedLines || input.addedLines.size === 0) return scan;
+  const added = input.addedLines;
+  return {
+    status: "ok",
+    matches: scan.matches.filter((m) => {
+      for (let line = m.startLine; line <= m.endLine; line++) {
+        if (added.has(line)) return true;
+      }
+      return false;
+    })
+  };
+}
 var ProposeSensorInputSchema = {
   memory_id: z15.string().min(1).describe("Id of the gotcha/attempt memory this sensor protects."),
-  kind: z15.enum(["regex", "shell", "test"]).default("regex").describe(
-    "regex = pattern matched on added diff lines (default). shell|test = a COMMAND the gate runs when the diff touches the sensor's paths \u2014 routes the team's own oracle (an existing test, an invariant script) to this lesson. Command sensors only execute where enforcement.runCommandSensors=true."
+  kind: z15.enum(["regex", "ast", "shell", "test"]).default("regex").describe(
+    "regex = pattern matched on added diff lines (default). ast = an ast-grep STRUCTURAL pattern (e.g. 'stripe.paymentIntents.create($$$)') matched on the AST of changed files \u2014 comments and strings can never false-positive; `absent` is a sub-pattern that must be missing INSIDE the match (requires the optional @ast-grep/napi engine). shell|test = a COMMAND the gate runs when the diff touches the sensor's paths \u2014 routes the team's own oracle (an existing test, an invariant script) to this lesson. Command sensors only execute where enforcement.runCommandSensors=true."
   ),
   pattern: z15.string().optional().describe("kind=regex: regex matching the FAULTY usage (the risky call/token), e.g. 'stripe\\.paymentIntents\\.create'."),
   command: z15.string().optional().describe("kind=shell|test: command to execute (e.g. 'npx vitest run tests/payments/refund.spec.ts'). Non-zero exit = the lesson fires."),
@@ -1295,6 +1375,9 @@ var ProposeSensorInputSchema = {
   incident: z15.string().optional().describe(
     "Provenance: the real incident this sensor guards \u2014 a ticket/prod ref ('prod #442', 'INC-1029', '2026-06 refund overcharge'). Turns 'a test failed' into 'this reproduces the incident the test exists to prevent'. Surfaced in the block message and the prevention receipt. Strongly recommended for command/test sensors routed from a post-incident test."
   ),
+  red_ref: z15.string().optional().describe(
+    "kind=shell|test: prove the oracle actually catches the incident. A git ref (commit/branch) of the PRE-FIX state; validation replays it in a scratch worktree and requires the command to FAIL there (RED) in addition to passing on the current tree (GREEN). On success the sensor records red_proven: true \u2014 'the test demonstrably catches the incident', shown in the prevention receipt."
+  ),
   flags: z15.string().optional().describe("Optional regex flags (e.g. 'i' for case-insensitive)."),
   paths: z15.array(z15.string()).default([]).describe("Override scope paths. Defaults to the memory's anchor paths.")
 };
@@ -1321,7 +1404,7 @@ async function readPresumedCorrectTargets(root, relPaths) {
       continue;
     } catch {
     }
-    const abs = path5.resolve(root, rel);
+    const abs = path6.resolve(root, rel);
     if (!existsSync15(abs)) continue;
     try {
       targets.push({ path: rel, content: await readFile3(abs, "utf8") });
@@ -1336,7 +1419,9 @@ function runCommandForValidation(command, root, timeoutMs = 12e4) {
       cwd: root,
       timeout: timeoutMs,
       maxBuffer: 8 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      // Same containment as the gate executor: an oracle gets a test-runner env, not credentials.
+      env: { ...scrubbedCommandEnv(process.env), HIVELORE_SENSOR: "validation" }
     });
     return { status: "passed", detail: "exit 0" };
   } catch (err) {
@@ -1350,6 +1435,48 @@ ${e.stderr?.toString() ?? ""}`.split("\n").filter(Boolean).slice(-8).join("\n");
     return { status: "failed", detail: out || `exit ${e.status ?? "?"}` };
   }
 }
+function proveRedOnIncident(command, root, redRef, timeoutMs) {
+  const worktree = path6.join(os.tmpdir(), `hivelore-red-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
+  let added = false;
+  try {
+    try {
+      execSync(`git worktree add --detach ${JSON.stringify(worktree)} ${JSON.stringify(redRef)}`, {
+        cwd: root,
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 6e4
+      });
+      added = true;
+    } catch (err) {
+      const e = err;
+      return { proven: false, reason: "red-ref-invalid", detail: (e.stderr?.toString() ?? String(err)).slice(0, 300) };
+    }
+    const mainModules = path6.join(root, "node_modules");
+    const wtModules = path6.join(worktree, "node_modules");
+    if (existsSync15(mainModules) && !existsSync15(wtModules)) {
+      try {
+        symlinkSync(mainModules, wtModules, "dir");
+      } catch {
+      }
+    }
+    const run = runCommandForValidation(command, worktree, timeoutMs);
+    if (run.status === "failed") return { proven: true, detail: run.detail };
+    if (run.status === "passed") {
+      return { proven: false, reason: "red-not-proven", detail: "oracle PASSED on the incident state \u2014 it does not catch the incident" };
+    }
+    return { proven: false, reason: "red-unrunnable", detail: run.detail };
+  } finally {
+    if (added) {
+      try {
+        execSync(`git worktree remove --force ${JSON.stringify(worktree)}`, { cwd: root, stdio: "ignore", timeout: 6e4 });
+      } catch {
+        try {
+          rmSync(worktree, { recursive: true, force: true });
+        } catch {
+        }
+      }
+    }
+  }
+}
 async function proposeSensor(input, ctx) {
   if (!existsSync15(ctx.paths.memoriesDir)) {
     throw new Error(`No .ai/memories at ${ctx.paths.root}. Run 'hivelore init' first.`);
@@ -1379,6 +1506,17 @@ async function proposeSensor(input, ctx) {
         self_check: { silent_on_current: false, fires_on_bad: null, fired_on: [] }
       };
     }
+  } else if (kind === "ast") {
+    if (!input.pattern?.trim()) {
+      return {
+        accepted: false,
+        memory_id: input.memory_id,
+        severity: input.severity,
+        reason: "invalid-pattern",
+        guidance: "kind=ast requires a `pattern` (an ast-grep structural pattern).",
+        self_check: { silent_on_current: false, fires_on_bad: null, fired_on: [] }
+      };
+    }
   } else if (!input.command?.trim()) {
     return {
       accepted: false,
@@ -1395,12 +1533,109 @@ async function proposeSensor(input, ctx) {
     throw new Error(`No memory found with id ${input.memory_id}`);
   }
   const personalScopeNudge = found.memory.frontmatter.scope === "personal" ? ` Note: this lesson is personal-scoped, so the sensor guards only YOUR machine (personal memories are gitignored). Promote it so the gate travels with the repo: hivelore memory promote ${input.memory_id}.` : "";
-  if (kind !== "regex") {
-    const referencedTests = extractTestFilePathsFromCommand(input.command.trim()).filter((rel) => existsSync15(path5.resolve(ctx.paths.root, rel)));
+  if (kind === "ast") {
+    const pattern = input.pattern.trim();
+    if (!await astEngineAvailable() && input.severity === "block") {
+      return {
+        accepted: false,
+        memory_id: input.memory_id,
+        severity: input.severity,
+        reason: "ast-engine-missing",
+        guidance: "The optional AST engine is not installed, so this proposal cannot be validated \u2014 a block sensor is only trusted after proof. Install it (`npm i -g @ast-grep/napi`, or add it to the repo) and re-propose.",
+        self_check: { silent_on_current: false, fires_on_bad: null, fired_on: [] }
+      };
+    }
+    const brittleAst = sensorPatternBrittleness(pattern);
+    if (brittleAst && input.severity === "block") {
+      return {
+        accepted: false,
+        memory_id: input.memory_id,
+        severity: input.severity,
+        reason: "brittle",
+        guidance: `The pattern is brittle (${brittleAst}). Use a durable structural pattern, then re-propose.`,
+        self_check: { silent_on_current: false, fires_on_bad: null, fired_on: [] }
+      };
+    }
+    const anchorPathsAst = input.paths.length > 0 ? input.paths : found.memory.frontmatter.anchor.paths;
+    const currentTargetsAst = await readPresumedCorrectTargets(ctx.paths.root, anchorPathsAst);
+    const firedOnAst = [];
+    for (const target of currentTargetsAst) {
+      const scan = await runAstSensorOnContent({ pattern, absent: input.absent, content: target.content, filePath: target.path });
+      if (scan.status === "invalid-pattern") {
+        return {
+          accepted: false,
+          memory_id: input.memory_id,
+          severity: input.severity,
+          reason: "invalid-pattern",
+          guidance: `The ast-grep pattern is invalid: ${scan.detail ?? "unparseable"}. Fix it and re-propose.`,
+          self_check: { silent_on_current: false, fires_on_bad: null, fired_on: [] }
+        };
+      }
+      if (scan.status === "ok" && scan.matches.length > 0) firedOnAst.push(target.path);
+    }
+    if (firedOnAst.length > 0 && input.severity === "block") {
+      return {
+        accepted: false,
+        memory_id: input.memory_id,
+        severity: input.severity,
+        reason: "fires-on-current",
+        guidance: `The pattern matches the CURRENT (correct) code in ${firedOnAst.join(", ")}. Add/tighten the 'absent' companion sub-pattern so correct usage is excluded, then re-propose.`,
+        self_check: { silent_on_current: false, fires_on_bad: null, fired_on: firedOnAst }
+      };
+    }
+    const badExamplesAst = [
+      ...input.bad_example ? [input.bad_example] : [],
+      ...extractSensorExamples(found.memory.body)
+    ];
+    let firesOnBadAst = null;
+    if (badExamplesAst.length > 0 && await astEngineAvailable()) {
+      const exampleLang = anchorPathsAst.find((p) => astLangForPath(p) !== null) ?? "example.tsx";
+      firesOnBadAst = false;
+      for (const example of badExamplesAst) {
+        const scan = await runAstSensorOnContent({ pattern, absent: input.absent, content: example, filePath: exampleLang });
+        if (scan.status === "ok" && scan.matches.length > 0) {
+          firesOnBadAst = true;
+          break;
+        }
+      }
+    }
+    if (firesOnBadAst === false && input.severity === "block") {
+      return {
+        accepted: false,
+        memory_id: input.memory_id,
+        severity: input.severity,
+        reason: "missed-bad-example",
+        guidance: "The pattern did not match the bad example structurally, so it won't catch the mistake. Adjust it, then re-propose.",
+        self_check: { silent_on_current: firedOnAst.length === 0, fires_on_bad: false, fired_on: [] }
+      };
+    }
+    const sensorAst = {
+      kind: "ast",
+      pattern,
+      ...input.absent ? { absent: input.absent } : {},
+      paths: anchorPathsAst,
+      message: input.message?.trim() || deriveMessage(found.memory.body, pattern, input.absent),
+      ...input.incident?.trim() ? { incident: input.incident.trim() } : {},
+      severity: input.severity,
+      autogen: false,
+      last_fired: null
+    };
+    await writeFile8(found.filePath, serializeMemory7({ frontmatter: { ...found.memory.frontmatter, sensor: sensorAst }, body: found.memory.body }), "utf8");
+    return {
+      accepted: true,
+      memory_id: input.memory_id,
+      severity: input.severity,
+      guidance: "Structural sensor accepted \u2014 it matches the AST, so comments/strings can never false-positive." + (await astEngineAvailable() ? "" : " Note: the AST engine is not installed here; the sensor is UNRUNNABLE (warn-only) until @ast-grep/napi is available.") + personalScopeNudge,
+      self_check: { silent_on_current: firedOnAst.length === 0, fires_on_bad: firesOnBadAst, fired_on: firedOnAst },
+      file_path: found.filePath
+    };
+  }
+  if (kind === "shell" || kind === "test") {
+    const referencedTests = extractTestFilePathsFromCommand(input.command.trim()).filter((rel) => existsSync15(path6.resolve(ctx.paths.root, rel)));
     const pendingTests = [];
     for (const rel of referencedTests) {
       try {
-        if (hasPendingTestMarker(await readFile3(path5.resolve(ctx.paths.root, rel), "utf8"))) pendingTests.push(rel);
+        if (hasPendingTestMarker(await readFile3(path6.resolve(ctx.paths.root, rel), "utf8"))) pendingTests.push(rel);
       } catch {
       }
     }
@@ -1416,6 +1651,21 @@ async function proposeSensor(input, ctx) {
     }
     const verdictCmd = runCommandForValidation(input.command.trim(), ctx.paths.root, input.timeout_ms);
     const anchorPathsCmd = input.paths.length > 0 ? input.paths : found.memory.frontmatter.anchor.paths;
+    let redProven = false;
+    if (input.red_ref?.trim()) {
+      const red = proveRedOnIncident(input.command.trim(), ctx.paths.root, input.red_ref.trim(), input.timeout_ms);
+      if (!red.proven && input.severity === "block") {
+        return {
+          accepted: false,
+          memory_id: input.memory_id,
+          severity: input.severity,
+          reason: red.reason ?? "red-not-proven",
+          guidance: red.reason === "red-ref-invalid" ? `red_ref could not be checked out (${red.detail}). Pass a valid commit/ref of the pre-fix state.` : red.reason === "red-unrunnable" ? `The oracle could not RUN on the incident state (${red.detail}) \u2014 it proves nothing there. Fix the command or drop red_ref.` : "The oracle PASSED on the incident state, so it does not catch the incident it claims to guard. Strengthen the assertion until it goes RED on red_ref, then re-propose. Output: " + red.detail.slice(0, 300),
+          self_check: { silent_on_current: verdictCmd.status === "passed", fires_on_bad: false, fired_on: [] }
+        };
+      }
+      redProven = red.proven;
+    }
     if (verdictCmd.status !== "passed" && input.severity === "block") {
       return {
         accepted: false,
@@ -1434,6 +1684,7 @@ ${verdictCmd.detail}`,
       paths: anchorPathsCmd,
       message: input.message?.trim() || deriveMessage(found.memory.body, input.command.trim(), void 0),
       ...input.incident?.trim() ? { incident: input.incident.trim() } : {},
+      ...redProven ? { red_proven: true } : {},
       severity: input.severity,
       autogen: false,
       last_fired: null
@@ -1447,8 +1698,9 @@ ${verdictCmd.detail}`,
       accepted: true,
       memory_id: input.memory_id,
       severity: input.severity,
-      guidance: (verdictCmd.status === "passed" ? "Command oracle passes on the current tree; the gate now runs it when the diff touches the sensor's paths (requires enforcement.runCommandSensors=true)." : `Accepted at warn severity, but note: ${verdictCmd.status} on the current tree (${verdictCmd.detail}).`) + (pendingTests.length > 0 ? ` Note: the routed test is still a PENDING stub (${pendingTests.join(", ")}) \u2014 it passes on anything; write the assertion to make this oracle real.` : "") + personalScopeNudge,
-      self_check: { silent_on_current: verdictCmd.status === "passed", fires_on_bad: null, fired_on: [] }
+      guidance: (verdictCmd.status === "passed" ? "Command oracle passes on the current tree; the gate now runs it when the diff touches the sensor's paths (requires enforcement.runCommandSensors=true)." : `Accepted at warn severity, but note: ${verdictCmd.status} on the current tree (${verdictCmd.detail}).`) + (redProven ? " RED proven: the oracle demonstrably FAILS on the incident state (red_ref) \u2014 recorded as red_proven." : " Tip: pass red_ref (the pre-fix commit) to PROVE the oracle catches the incident, not merely that it passes today.") + (pendingTests.length > 0 ? ` Note: the routed test is still a PENDING stub (${pendingTests.join(", ")}) \u2014 it passes on anything; write the assertion to make this oracle real.` : "") + personalScopeNudge,
+      self_check: { silent_on_current: verdictCmd.status === "passed", fires_on_bad: redProven ? true : null, fired_on: [] },
+      file_path: found.filePath
     };
   }
   const anchorPaths = input.paths.length > 0 ? input.paths : found.memory.frontmatter.anchor.paths;
@@ -1521,6 +1773,7 @@ var MemTriedInputSchema = {
     severity: z16.enum(["warn", "block"]).default("block").describe("block = deterministic gate refusal"),
     message: z16.string().optional().describe("Self-correction message shown when the sensor fires"),
     incident: z16.string().optional().describe("Provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 surfaced when it fires and in the receipt"),
+    red_ref: z16.string().optional().describe("kind=shell|test: pre-fix commit/ref \u2014 the oracle must FAIL on it (proves the test catches the incident; records red_proven)"),
     bad_example: z16.string().optional().describe("kind=regex: code snippet the sensor MUST fire on (validation)")
   }).optional().describe(
     "ONE-SHOT loop close: validate and attach a sensor in the same call (equivalent to a follow-up propose_sensor). Validated against HEAD \u2014 silent on current code, fires on the bad example. If rejected, the attempt is still saved and the verdict tells you how to revise."
@@ -1552,7 +1805,7 @@ async function memTried(input, ctx) {
   }
   const body = lines.join("\n") + "\n";
   const file = memoryFilePath2(ctx.paths, frontmatter.scope, frontmatter.id, frontmatter.module);
-  await mkdir3(path6.dirname(file), { recursive: true });
+  await mkdir3(path7.dirname(file), { recursive: true });
   if (existsSync16(file)) {
     throw new Error(`Memory already exists at ${file}`);
   }
@@ -1569,6 +1822,7 @@ async function memTried(input, ctx) {
         severity: input.sensor.severity ?? "block",
         message: input.sensor.message,
         incident: input.sensor.incident,
+        red_ref: input.sensor.red_ref,
         bad_example: input.sensor.bad_example,
         flags: void 0,
         paths: []
@@ -1608,17 +1862,17 @@ async function memTried(input, ctx) {
 }
 var PY_SIGNALS = ["pyproject.toml", "setup.py", "pytest.ini", "requirements.txt", "tox.ini"];
 async function detectForAnchor(root, rel) {
-  let dir = path7.resolve(root, rel);
+  let dir = path8.resolve(root, rel);
   try {
-    if (!statSync(dir).isDirectory()) dir = path7.dirname(dir);
+    if (!statSync(dir).isDirectory()) dir = path8.dirname(dir);
   } catch {
-    if (path7.extname(dir)) dir = path7.dirname(dir);
+    if (path8.extname(dir)) dir = path8.dirname(dir);
   }
   while (dir.startsWith(root)) {
-    const pkgJson = path7.join(dir, "package.json");
+    const pkgJson = path8.join(dir, "package.json");
     const hasPkg = existsSync17(pkgJson);
-    const goMod = existsSync17(path7.join(dir, "go.mod"));
-    const pySignal = PY_SIGNALS.some((s) => existsSync17(path7.join(dir, s)));
+    const goMod = existsSync17(path8.join(dir, "go.mod"));
+    const pySignal = PY_SIGNALS.some((s) => existsSync17(path8.join(dir, s)));
     if (hasPkg || goMod || pySignal) {
       let pkg = null;
       if (hasPkg) {
@@ -1628,10 +1882,10 @@ async function detectForAnchor(root, rel) {
           pkg = null;
         }
       }
-      const baseDir = path7.relative(root, dir).split(path7.sep).join("/");
+      const baseDir = path8.relative(root, dir).split(path8.sep).join("/");
       return { framework: pickTestFramework(pkg, { goMod, pySignal }), baseDir };
     }
-    const parent = path7.dirname(dir);
+    const parent = path8.dirname(dir);
     if (parent === dir || dir === root) break;
     dir = parent;
   }
@@ -1697,14 +1951,14 @@ async function scaffoldTest(input, ctx) {
   }
   const results = [];
   for (const scaffold of scaffolds) {
-    const abs = path7.isAbsolute(scaffold.relPath) ? scaffold.relPath : path7.resolve(ctx.paths.root, scaffold.relPath);
+    const abs = path8.isAbsolute(scaffold.relPath) ? scaffold.relPath : path8.resolve(ctx.paths.root, scaffold.relPath);
     let written = false;
     let alreadyExists = false;
     if (input.write) {
       if (existsSync17(abs)) {
         alreadyExists = true;
       } else {
-        await mkdir4(path7.dirname(abs), { recursive: true });
+        await mkdir4(path8.dirname(abs), { recursive: true });
         await writeFile10(abs, scaffold.content, "utf8");
         written = true;
       }
@@ -1755,7 +2009,7 @@ async function ingestFindings(input, ctx) {
   if (input.report && input.report.trim()) {
     raw = input.report;
   } else if (input.report_path) {
-    const file = path8.resolve(ctx.paths.root, input.report_path);
+    const file = path9.resolve(ctx.paths.root, input.report_path);
     if (!existsSync18(file)) throw new Error(`Report file not found: ${file}`);
     raw = await readFile5(file, "utf8");
   } else {
@@ -1809,12 +2063,12 @@ async function writeDraft(ctx, draft) {
     draft.frontmatter.id,
     draft.frontmatter.module
   );
-  await mkdir5(path8.dirname(file), { recursive: true });
+  await mkdir5(path9.dirname(file), { recursive: true });
   await writeFile11(file, serializeMemory9({ frontmatter: draft.frontmatter, body: draft.body }), "utf8");
   return file;
 }
 function pendingDistillPath(ctx) {
-  return path9.join(ctx.paths.haiveDir, ".cache", "pending-distill.json");
+  return path10.join(ctx.paths.haiveDir, ".cache", "pending-distill.json");
 }
 var SessionTracker = class {
   events = [];
@@ -1931,7 +2185,7 @@ var SessionTracker = class {
             ...gitDiff ? { git_diff: gitDiff } : {},
             ...recapId ? { recap_id: recapId } : {}
           };
-          const cacheDir = path9.join(this.ctx.paths.haiveDir, ".cache");
+          const cacheDir = path10.join(this.ctx.paths.haiveDir, ".cache");
           await mkdir6(cacheDir, { recursive: true });
           await writeFile12(
             pendingDistillPath(this.ctx),
@@ -2011,12 +2265,12 @@ async function memSessionEnd(input, ctx) {
   const body = buildBody(input);
   const topic = recapTopic(input.scope, input.module);
   const normalizedFiles = input.files_touched.map((p) => {
-    if (!p || !path10.isAbsolute(p)) return p;
-    const rel = path10.relative(ctx.paths.root, p);
+    if (!p || !path11.isAbsolute(p)) return p;
+    const rel = path11.relative(ctx.paths.root, p);
     return rel.startsWith("..") ? p : rel;
   });
   const invalidPaths = normalizedFiles.filter(
-    (p) => !existsSync20(path10.resolve(ctx.paths.root, p))
+    (p) => !existsSync20(path11.resolve(ctx.paths.root, p))
   );
   if (invalidPaths.length > 0) {
     console.warn(`[haive] session end: anchor path(s) not found: ${invalidPaths.join(", ")}`);
@@ -2067,7 +2321,7 @@ async function memSessionEnd(input, ctx) {
     frontmatter.id,
     frontmatter.module
   );
-  await mkdir7(path10.dirname(file), { recursive: true });
+  await mkdir7(path11.dirname(file), { recursive: true });
   await writeFile13(file, serializeMemory10({ frontmatter, body }), "utf8");
   await clearPendingDistill(ctx);
   return {
@@ -2211,7 +2465,7 @@ async function loadModuleContexts2(ctx, modules) {
   const out = [];
   for (const m of modules) {
     if (!available.has(m)) continue;
-    const file = path11.join(ctx.paths.modulesContextDir, m, "context.md");
+    const file = path12.join(ctx.paths.modulesContextDir, m, "context.md");
     if (existsSync21(file)) {
       out.push({ name: m, content: await readFile6(file, "utf8") });
     }
@@ -2830,7 +3084,7 @@ Invoke the \`bootstrap_repo\` MCP prompt, or close these gaps directly:
   };
 }
 async function detectRunCommands(root) {
-  const pkgPath = path12.join(root, "package.json");
+  const pkgPath = path13.join(root, "package.json");
   if (!existsSync22(pkgPath)) return null;
   try {
     const pkg = JSON.parse(await readFile7(pkgPath, "utf8"));
@@ -2898,7 +3152,7 @@ function oneLine(value) {
   return value.replace(/\s+/g, " ").replace(/"/g, '\\"').trim().slice(0, 120);
 }
 function serverVersion() {
-  return true ? "0.39.1" : "dev";
+  return true ? "0.42.1" : "dev";
 }
 var CodeMapInputSchema = {
   file: z21.string().optional().describe("Filter to files whose path contains this substring"),
@@ -4225,7 +4479,7 @@ When done, respond with: "Imported N memories: [list of IDs]" or "Nothing action
   };
 }
 var SERVER_NAME = "hivelore";
-var SERVER_VERSION = "0.39.1";
+var SERVER_VERSION = "0.42.1";
 function jsonResult(data) {
   return {
     content: [
@@ -5171,6 +5425,10 @@ async function runHaiveMcpStdio(options) {
 }
 
 export {
+  astEngineAvailable,
+  astLangForPath,
+  runAstPattern,
+  runAstSensorOnContent,
   readPresumedCorrectTargets,
   proposeSensor,
   memTried,
@@ -5201,4 +5459,4 @@ export {
   printHaiveMcpVersion,
   runHaiveMcpStdio
 };
-//# sourceMappingURL=chunk-YMIQAOFL.js.map
+//# sourceMappingURL=chunk-EJ7A4IKD.js.map