@hivelore/cli 0.39.2 → 0.42.1

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   antiPatternsCheck,
+  astEngineAvailable,
   codeMapTool,
   codeSearch,
   detectTestFrameworksForAnchors,
@@ -10,8 +11,9 @@ import {
   memTried,
   preCommitCheck,
   readPresumedCorrectTargets,
+  runAstSensorOnContent,
   runHaiveMcpStdio
-} from "./chunk-XA5FXG6E.js";
+} from "./chunk-EJ7A4IKD.js";
 import {
   registerMemoryPending
 } from "./chunk-OYJKHD22.js";
@@ -3756,7 +3758,7 @@ ${SEED_FOOTER(stack)}` });
 
 // src/commands/init.ts
 var execFileAsync = promisify2(execFile2);
-var HAIVE_GITHUB_ACTION_REF = `v${"0.39.2"}`;
+var HAIVE_GITHUB_ACTION_REF = `v${"0.42.1"}`;
 var PROJECT_CONTEXT_TEMPLATE = `# Project context
 
 > Generated by \`hivelore init\`. Run \`hivelore init --bootstrap\` to auto-fill from your codebase,
@@ -4714,6 +4716,7 @@ import { existsSync as existsSync14 } from "fs";
 import path15 from "path";
 import "commander";
 import {
+  appendProposedRetrievalCases,
   DEFAULT_AUTO_PROMOTE_RULE,
   assessSensorHealth,
   sensorPromotedAtMap,
@@ -4882,7 +4885,7 @@ function registerSync(program2) {
           promoted++;
           continue;
         }
-        if (autoApproveDelayHours !== null && fm.status === "proposed" && fm.scope === "team") {
+        if (autoApproveDelayHours !== null && fm.status === "proposed" && fm.scope === "team" && !fm.tags.includes("auto-captured")) {
           const ageHours = (nowMs - new Date(fm.created_at).getTime()) / (1e3 * 60 * 60);
           if (ageHours >= autoApproveDelayHours) {
             if (!dryRun) {
@@ -4917,6 +4920,25 @@ function registerSync(program2) {
     const gateMissIds = await processGateMissWatch(root, paths, dryRun);
     if (gateMissIds.length > 0) {
       log(ui.yellow(`gate-miss: proposed ${gateMissIds.length} lesson(s): ${gateMissIds.join(", ")}`));
+      if (!dryRun) {
+        try {
+          const freshlyLoaded = await loadMemoriesFromDir7(paths.memoriesDir);
+          const cases = gateMissIds.flatMap((id) => {
+            const loaded = freshlyLoaded.find((m) => m.memory.frontmatter.id === id);
+            const heading = loaded?.memory.body.match(/^#\s+(.+)$/m)?.[1]?.trim();
+            if (!heading) return [];
+            return [{ name: `gate-miss:${id}`, task: heading, expect_ids: [id] }];
+          });
+          if (cases.length > 0) {
+            const specFile = path15.join(root, ".ai", "eval", "spec.json");
+            const raw = existsSync14(specFile) ? await readFile7(specFile, "utf8") : null;
+            await mkdir8(path15.dirname(specFile), { recursive: true });
+            await writeFile8(specFile, appendProposedRetrievalCases(raw, cases), "utf8");
+            log(ui.dim(`gate-miss: ${cases.length} proposed golden eval case(s) \u2192 .ai/eval/spec.json (approve with \`hivelore eval --approve-cases\`)`));
+          }
+        } catch {
+        }
+      }
     }
     const draftMemories = (await loadMemoriesFromDir7(paths.memoriesDir)).filter(
       (m) => m.memory.frontmatter.status === "draft"
@@ -6946,6 +6968,7 @@ import { spawn as spawn2 } from "child_process";
 import path29 from "path";
 import { Option as Option2 } from "commander";
 import {
+  distillFailureObservations,
   buildFrontmatter as buildFrontmatter5,
   findProjectRoot as findProjectRoot27,
   loadConfig as loadConfig6,
@@ -7128,6 +7151,65 @@ function runGit(cwd, args) {
     });
   });
 }
+async function readObservationList(paths) {
+  const obsFile = path29.join(paths.haiveDir, ".cache", "observations.jsonl");
+  if (!existsSync32(obsFile)) return [];
+  const raw = await readFile13(obsFile, "utf8").catch(() => "");
+  const out = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      out.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return out;
+}
+async function autoCaptureFailureLessons(paths, root, observations) {
+  const failures = observations.filter((o) => o.failure_hint).map((o) => ({
+    ts: o.ts,
+    tool: o.tool,
+    summary: o.summary,
+    files: (o.files ?? []).map((f) => normalizeAnchorPath(root, f)).filter((f) => existsSync32(path29.resolve(root, f)))
+  }));
+  if (failures.length === 0) return { written: 0, ids: [] };
+  const lessons = distillFailureObservations(failures, { max: 3 });
+  if (lessons.length === 0) return { written: 0, ids: [] };
+  const existing = existsSync32(paths.memoriesDir) ? await loadMemoriesFromDir10(paths.memoriesDir) : [];
+  const normalizeTitle = (t) => t.toLowerCase().replace(/\s+/g, " ").trim().slice(0, 120);
+  const existingTitles = new Set(
+    existing.filter(({ memory: memory2 }) => memory2.frontmatter.type === "attempt").map(({ memory: memory2 }) => normalizeTitle(memory2.body.match(/^#\s+(.+)$/m)?.[1] ?? ""))
+  );
+  let written = 0;
+  const ids = [];
+  for (const lesson of lessons) {
+    if (existingTitles.has(normalizeTitle(lesson.what))) continue;
+    const slug = lesson.what.toLowerCase().replace(/[^a-z0-9\s]/g, "").trim().split(/\s+/).slice(0, 6).join("-") || "auto-captured-failure";
+    const baseFm = buildFrontmatter5({
+      type: "attempt",
+      slug,
+      scope: "personal",
+      tags: ["auto-captured"],
+      paths: lesson.paths
+    });
+    const frontmatter = { ...baseFm, status: "proposed" };
+    const file = memoryFilePath5(paths, frontmatter.scope, frontmatter.id, frontmatter.module);
+    if (existsSync32(file)) continue;
+    const body = `# ${lesson.what}
+
+**Why it failed / do NOT use:** ${lesson.why_failed}
+
+_Auto-captured from session observations (${lesson.occurrences} occurrence${lesson.occurrences === 1 ? "" : "s"}). Review: refine and approve (\`hivelore memory approve ${frontmatter.id}\`), or reject it._
+`;
+    await mkdir11(path29.dirname(file), { recursive: true });
+    await writeFile17(file, serializeMemory12({ frontmatter, body }), "utf8").catch(() => {
+    });
+    existingTitles.add(normalizeTitle(lesson.what));
+    written++;
+    ids.push(frontmatter.id);
+  }
+  return { written, ids };
+}
 async function observationStart(paths) {
   const obsFile = path29.join(paths.haiveDir, ".cache", "observations.jsonl");
   if (!existsSync32(obsFile)) return null;
@@ -7195,11 +7277,18 @@ function registerSessionEnd(session2) {
     let accomplished = opts.accomplished ?? opts.summary;
     const caughtSince = opts.auto ? await observationStart(paths) : null;
     if (opts.auto) {
+      const autoCaptured = await autoCaptureFailureLessons(paths, root, await readObservationList(paths)).catch(() => ({ written: 0, ids: [] }));
       const synth = await buildAutoRecap(paths);
       if (!synth) return;
       goal = goal ?? synth.goal;
       accomplished = accomplished ?? synth.accomplished;
       opts.discoveries = opts.discoveries ?? synth.discoveries;
+      if (autoCaptured.written > 0) {
+        const note = `${autoCaptured.written} failure(s) auto-captured as proposed lesson(s): ${autoCaptured.ids.join(", ")} \u2014 review with \`hivelore memory list --status proposed\` (approve, refine, or reject).`;
+        opts.discoveries = opts.discoveries ? `${opts.discoveries}
+${note}` : note;
+        if (!opts.quiet) ui.info(note);
+      }
       if (!resolvedFiles && synth.files.length) resolvedFiles = synth.files.join(",");
     }
     if (!goal || !accomplished) {
@@ -7798,7 +7887,9 @@ import {
   loadEvalHistory,
   loadPreventionEvents as loadPreventionEvents3,
   loadUsageIndex as loadUsageIndex13,
+  approveProposedCases,
   overallScore,
+  runTierContract,
   resolveHaivePaths as resolveHaivePaths29,
   scoreRetrievalCase,
   scoreSensorCase,
@@ -7807,7 +7898,7 @@ import {
 function registerEval(program2) {
   program2.command("eval").description(
     "Rigorous, repeatable quality eval: do the right memories surface (retrieval) and do the right sensors fire (catch-rate)? Emits a numeric 0\u2013100 score. Uses .ai/eval cases via --spec, or auto-synthesizes cases from anchored memories."
-  ).option("--spec <file>", "JSON eval spec ({ retrieval: [...], sensors: [...] })").option("--semantic-only", "self-eval probes by title alone (no anchor files) \u2014 harder retrieval", false).option("-k, --top <n>", "briefing top-k considered a hit", "8").option("--json", "emit JSON", false).option("--out <file>", "write a Markdown report").option("--fail-under <score>", "exit non-zero if the overall score is below this (0\u2013100) \u2014 for CI gates").option("--fail-under-catch-rate <pct>", "exit non-zero if sensor catch-rate is below this percentage").option("--fail-under-gate-precision <pct>", "exit non-zero if gate precision is below this percentage").option("--baseline", "save this run as the baseline (.ai/eval/baseline.json) for future --compare", false).option("--compare", "diff this run against the saved baseline and print the delta", false).option("--baseline-file <path>", "baseline file to read/write (default: .ai/eval/baseline.json)").option("--fail-on-regression", "with --compare, exit non-zero if the score dropped vs the baseline", false).option("--regression-gate", "CI-safe gate: compare against the baseline IF one exists (fail on regression), else no-op", false).option("--record", "append this run's score to .ai/.cache/eval-history.jsonl (trend the harness over time)", false).option("--trend", "print the recorded score trend (sparkline + latest/best/delta) and exit", false).option("--ref <ref>", "version/commit label stored with a --record run").option("-d, --dir <dir>", "project root").action(async (opts) => {
+  ).option("--spec <file>", "JSON eval spec ({ retrieval: [...], sensors: [...] })").option("--semantic-only", "self-eval probes by title alone (no anchor files) \u2014 harder retrieval", false).option("-k, --top <n>", "briefing top-k considered a hit", "8").option("--json", "emit JSON", false).option("--out <file>", "write a Markdown report").option("--fail-under <score>", "exit non-zero if the overall score is below this (0\u2013100) \u2014 for CI gates").option("--fail-under-catch-rate <pct>", "exit non-zero if sensor catch-rate is below this percentage").option("--fail-under-gate-precision <pct>", "exit non-zero if gate precision is below this percentage").option("--baseline", "save this run as the baseline (.ai/eval/baseline.json) for future --compare", false).option("--compare", "diff this run against the saved baseline and print the delta", false).option("--baseline-file <path>", "baseline file to read/write (default: .ai/eval/baseline.json)").option("--fail-on-regression", "with --compare, exit non-zero if the score dropped vs the baseline", false).option("--regression-gate", "CI-safe gate: compare against the baseline IF one exists (fail on regression), else no-op", false).option("--approve-cases", "approve every proposed golden case (gate-miss labeled) into the scored retrieval set, then exit", false).option("--record", "append this run's score to .ai/.cache/eval-history.jsonl (trend the harness over time)", false).option("--trend", "print the recorded score trend (sparkline + latest/best/delta) and exit", false).option("--ref <ref>", "version/commit label stored with a --record run").option("-d, --dir <dir>", "project root").action(async (opts) => {
     const root = findProjectRoot31(opts.dir);
     const paths = resolveHaivePaths29(root);
     if (!existsSync35(paths.memoriesDir)) {
@@ -7815,6 +7906,21 @@ function registerEval(program2) {
       process.exitCode = 1;
       return;
     }
+    if (opts.approveCases) {
+      const specFile = path32.join(root, ".ai", "eval", "spec.json");
+      if (!existsSync35(specFile)) {
+        ui.info("No .ai/eval/spec.json \u2014 nothing to approve.");
+        return;
+      }
+      const { raw, approved } = approveProposedCases(await readFile15(specFile, "utf8"));
+      if (approved === 0) {
+        ui.info("No proposed cases waiting for approval.");
+        return;
+      }
+      await writeFile20(specFile, raw, "utf8");
+      ui.success(`Approved ${approved} proposed golden case(s) into the scored retrieval set.`);
+      return;
+    }
     if (opts.trend) {
       const trend = computeEvalTrend(await loadEvalHistory(paths));
       if (opts.json) {
@@ -7835,6 +7941,17 @@ function registerEval(program2) {
     const ctx = { paths };
     const resolvedSpec = await resolveSpec(opts, root, paths.memoriesDir);
     const spec = resolvedSpec.spec;
+    const tierChecks = runTierContract();
+    const tierFailures = tierChecks.filter((c) => !c.pass);
+    let proposedGoldenCount = 0;
+    try {
+      const specFile = path32.join(root, ".ai", "eval", "spec.json");
+      if (!opts.spec && existsSync35(specFile)) {
+        const parsed = JSON.parse(await readFile15(specFile, "utf8"));
+        proposedGoldenCount = parsed.proposed_retrieval?.length ?? 0;
+      }
+    } catch {
+    }
     if ((spec.retrieval?.length ?? 0) === 0 && (spec.sensors?.length ?? 0) === 0) {
       ui.warn("No eval cases (no anchored memories and no --spec). Nothing to score.");
       return;
@@ -7925,10 +8042,13 @@ function registerEval(program2) {
           ...authoredScore !== null ? { authored_score: authoredScore } : {}
         },
         report,
+        tier_contract: { checks: tierChecks, failures: tierFailures.length },
+        proposed_golden_cases: proposedGoldenCount,
         gate_precision: gatePrecision,
         ...delta ? { delta } : {},
         ...gateDelta ? { gate_delta: gateDelta } : {}
       }, null, 2));
+      if (tierFailures.length > 0) process.exitCode = 1;
       applyExitGates(opts, report, delta, gatePrecision, gateDelta);
       return;
     }
@@ -7943,6 +8063,17 @@ function registerEval(program2) {
     if (gateDelta) {
       console.log(renderGateDelta(gateDelta));
     }
+    if (tierFailures.length > 0) {
+      ui.error(`Ranking tier contract BROKEN \u2014 ${tierFailures.length} check(s) violate the designed tiers:`);
+      for (const c of tierFailures) ui.error(`  \u2717 ${c.name} (expected ${c.expected}, got ${c.actual})`);
+    } else {
+      ui.info(`Ranking tier contract: ${tierChecks.length}/${tierChecks.length} checks hold.`);
+    }
+    if (proposedGoldenCount > 0) {
+      ui.warn(
+        `${proposedGoldenCount} proposed golden case(s) (gate-miss labeled) await approval \u2014 review .ai/eval/spec.json, then \`hivelore eval --approve-cases\` to score them.`
+      );
+    }
     const md = renderMarkdown2(root, k, resolvedSpec, report, gatePrecision, authoredScore);
     if (opts.out) {
       const outFile = path32.isAbsolute(opts.out) ? opts.out : path32.join(root, opts.out);
@@ -7951,6 +8082,7 @@ function registerEval(program2) {
     } else {
       console.log(md);
     }
+    if (tierFailures.length > 0) process.exitCode = 1;
     applyExitGates(opts, report, delta, gatePrecision, gateDelta);
   });
 }
@@ -8894,6 +9026,19 @@ function registerDoctor(program2) {
         fix: "hivelore sensors list   # then `hivelore sensors promote <id>` for a trusted, non-brittle sensor \u2014 or retire the noise"
       });
     }
+    const astSensorCount = sensorMemories.filter((m) => m.memory.frontmatter.sensor?.kind === "ast").length;
+    if (astSensorCount > 0) {
+      const { astEngineAvailable: astEngineAvailable2 } = await import("./server-PZWIQUU7.js");
+      if (!await astEngineAvailable2()) {
+        findings.push({
+          severity: "warn",
+          code: "ast-engine-missing",
+          section: "Protection",
+          message: `${astSensorCount} AST sensor(s) exist but the optional @ast-grep/napi engine is not installed \u2014 they are unrunnable on this machine (warn-only at the gate, protection OFF).`,
+          fix: "npm i -g @ast-grep/napi   # or add it to the repo devDependencies"
+        });
+      }
+    }
     const firesOnCurrent = [];
     for (const m of sensorMemories) {
       const s = m.memory.frontmatter.sensor;
@@ -9053,7 +9198,7 @@ function registerDoctor(program2) {
         fix: "Edit .ai/haive.config.json: set autoSessionEnd: true (or re-run `hivelore init` without --manual)."
       });
     }
-    findings.push(...await collectInstallFindings(root, "0.39.2"));
+    findings.push(...await collectInstallFindings(root, "0.42.1"));
     findings.push(...await collectToolchainFindings(root));
     try {
       const legacyRaw = execSync("haive-mcp --version", {
@@ -9061,7 +9206,7 @@ function registerDoctor(program2) {
         timeout: 3e3,
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
-      const cliVersion = "0.39.2";
+      const cliVersion = "0.42.1";
       if (legacyRaw && legacyRaw !== cliVersion) {
         findings.push({
           severity: "warn",
@@ -9806,6 +9951,7 @@ import {
   assessSensorHealth as assessSensorHealth3,
   sensorPromotedAtMap as sensorPromotedAtMap3,
   assessBootstrapState,
+  addedLineNumbersFromDiff,
   detectSensorWeakening,
   isSensorScannablePath,
   findProjectRoot as findProjectRoot37,
@@ -9959,6 +10105,7 @@ function defaultClaudeSettingsPath(scope, projectRoot) {
 // src/utils/command-sensors.ts
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
+import { scrubbedCommandEnv } from "@hivelore/core";
 var exec2 = promisify3(execFile3);
 var COMMAND_SENSOR_DEFAULT_TIMEOUT_MS = 12e4;
 var OUTPUT_TAIL_LINES = 15;
@@ -9982,7 +10129,9 @@ async function executeCommandSensor(spec, root) {
       cwd: root,
       timeout: timeoutMs,
       maxBuffer: 8 * 1024 * 1024,
-      env: { ...process.env, HIVELORE_SENSOR: spec.memory_id }
+      // Scrubbed on purpose: a repo-authored oracle gets a test-runner environment, not the
+      // caller's credentials (cloud keys, tokens). See scrubbedCommandEnv in core.
+      env: { ...scrubbedCommandEnv(process.env), HIVELORE_SENSOR: spec.memory_id }
     });
     return {
       ...base,
@@ -10583,11 +10732,14 @@ async function checkFailureCapture(paths, config) {
       message: "No uncaptured hard failures from this session."
     }];
   }
+  const autoDrafts = memories.filter(
+    ({ memory: memory2 }) => memory2.frontmatter.status === "proposed" && memory2.frontmatter.tags.includes("auto-captured")
+  );
   return [{
     severity: gate === "block" ? "error" : "info",
     code: "uncaptured-failures",
-    message: `${uncaptured.length} hard failure(s) this session were never captured as a lesson (mem_tried).`,
-    fix: "Call `mem_tried` (or `hivelore memory tried`) for each real failure so the next session doesn't repeat it. False positives (e.g. a grep that found nothing) can be ignored.",
+    message: `${uncaptured.length} hard failure(s) this session were never captured as a lesson (mem_tried).` + (autoDrafts.length > 0 ? ` ${autoDrafts.length} auto-captured draft(s) are waiting for review: ${autoDrafts.slice(0, 3).map(({ memory: memory2 }) => memory2.frontmatter.id).join(", ")}${autoDrafts.length > 3 ? ", \u2026" : ""}.` : ""),
+    fix: autoDrafts.length > 0 ? "Review the auto-captured drafts (`hivelore memory list --status proposed`) \u2014 approve, refine, or reject; call `mem_tried` only for failures the drafts missed." : "Call `mem_tried` (or `hivelore memory tried`) for each real failure so the next session doesn't repeat it. False positives (e.g. a grep that found nothing) can be ignored.",
     reason: "Harness ratchet: a mistake that isn't written down gets re-introduced. Set enforcement.failureCaptureGate to 'off' to disable, or 'block' to hard-fail.",
     affected_files: uncaptured.slice(0, 8).map((f) => `${f.tool}: ${f.summary}`.slice(0, 100)),
     ...gate === "block" ? { impact: 30 } : {}
@@ -10647,6 +10799,22 @@ async function runWithEnforcement(command, args, opts) {
     child.on("close", (code, signal) => {
       if (signal) process.exit(128);
       process.exitCode = code ?? 0;
+      if ((code ?? 0) !== 0) {
+        const obsFile = path40.join(paths.haiveDir, ".cache", "observations.jsonl");
+        void mkdir16(path40.dirname(obsFile), { recursive: true }).then(() => writeFile25(obsFile, "", { flag: "a" })).then(() => writeFile25(
+          obsFile,
+          JSON.stringify({
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            session_id: sessionId,
+            tool: "AgentRun",
+            summary: `wrapped agent exited ${code}: ${[command, ...args].join(" ").slice(0, 180)}`,
+            failure_hint: true
+          }) + "\n",
+          { flag: "a" }
+        )).catch(() => {
+        }).finally(() => resolve());
+        return;
+      }
       resolve();
     });
   });
@@ -10785,7 +10953,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
       findings: [{ severity: "info", code: "enforcement-off", message: "Hivelore enforcement is disabled." }]
     });
   }
-  findings.push(...await inspectIntegrationVersions(root, "0.39.2"));
+  findings.push(...await inspectIntegrationVersions(root, "0.42.1"));
   if (config.enforcement?.requireBriefingFirst !== false && stage !== "ci") {
     const hasBriefing = await hasRecentBriefingMarker(paths, sessionId);
     findings.push(hasBriefing ? { severity: "ok", code: "briefing-loaded", message: "A recent Hivelore briefing marker exists." } : {
@@ -11122,6 +11290,17 @@ async function runPrecommitPolicy(paths, gate, stage) {
     ...weakeningFindings
   ];
 }
+async function stagedFileContent(root, rel) {
+  try {
+    return await runCommand2("git", ["show", `:${rel}`], root);
+  } catch {
+    try {
+      return await readFile18(path40.resolve(root, rel), "utf8");
+    } catch {
+      return null;
+    }
+  }
+}
 async function runSensorGate(paths, diff, stage) {
   if (!diff || !existsSync42(paths.memoriesDir)) return [];
   try {
@@ -11174,6 +11353,75 @@ async function runSensorGate(paths, diff, stage) {
         });
       }
     }
+    const astSensorMemories = scannable.filter((m) => m.frontmatter.sensor.kind === "ast");
+    if (astSensorMemories.length > 0) {
+      const addedByPath = addedLineNumbersFromDiff(diff);
+      if (!await astEngineAvailable()) {
+        findings.push({
+          severity: "warn",
+          code: "ast-sensor-unrunnable",
+          message: `${astSensorMemories.length} AST sensor(s) could not run \u2014 the optional @ast-grep/napi engine is not installed. Their protection is OFF on this machine.`,
+          fix: "Install the engine: `npm i -g @ast-grep/napi` (or add it to the repo devDependencies).",
+          impact: 5
+        });
+      } else {
+        for (const memory2 of astSensorMemories) {
+          const sensor = memory2.frontmatter.sensor;
+          if (!sensor.pattern) continue;
+          const applicable = targets.filter((t) => sensorAppliesToPath2(sensor, memory2.frontmatter.anchor.paths, t.path));
+          if (applicable.length === 0) continue;
+          let fired = false;
+          for (const target of applicable) {
+            const added = addedByPath.get(target.path);
+            if (!added || added.size === 0) continue;
+            const content = await stagedFileContent(paths.root, target.path);
+            if (content === null) continue;
+            const scan = await runAstSensorOnContent({
+              pattern: sensor.pattern,
+              absent: sensor.absent,
+              content,
+              filePath: target.path,
+              addedLines: added
+            });
+            if (scan.status !== "ok" || scan.matches.length === 0) continue;
+            fired = true;
+            if (seen.has(memory2.frontmatter.id)) break;
+            seen.add(memory2.frontmatter.id);
+            firedIds.add(memory2.frontmatter.id);
+            const where = ` (${target.path}:${scan.matches[0].startLine})`;
+            if (sensor.severity === "block") {
+              findings.push({
+                severity: "error",
+                code: "sensor-block",
+                message: `Block AST sensor fired \u2014 ${memory2.frontmatter.id}: ${sensor.message}${where}${incidentSuffix(sensor.incident)}
+  matched: ${scan.matches[0].text}`,
+                fix: "Remove the flagged construct, or run `hivelore sensors check` to inspect the match.",
+                impact: 45,
+                memory_ids: [memory2.frontmatter.id]
+              });
+            } else {
+              findings.push({
+                severity: "warn",
+                code: "sensor-warn",
+                message: `AST sensor flagged ${memory2.frontmatter.id}: ${sensor.message}${where}${incidentSuffix(sensor.incident)}`,
+                fix: "Review the flagged construct; `hivelore sensors check` shows the matched code.",
+                impact: 5,
+                memory_ids: [memory2.frontmatter.id]
+              });
+            }
+            break;
+          }
+          ledgerRows.push(evaluation({
+            memory_id: memory2.frontmatter.id,
+            kind: "ast",
+            stage,
+            head_sha: headSha,
+            scope_hash: "",
+            outcome: fired ? "fired" : "silent"
+          }));
+        }
+      }
+    }
     const config = await loadConfig12(paths).catch(() => null);
     if (config?.enforcement?.runCommandSensors === true) {
       const changedPaths = targets.map((t) => t.path).filter(Boolean);
@@ -12303,6 +12551,7 @@ import {
   recordPreventionHits as recordPreventionHits2,
   resolveHaivePaths as resolveHaivePaths36,
   runSensors as runSensors2,
+  addedLineNumbersFromDiff as addedLineNumbersFromDiff2,
   buildProposeCommand,
   scaffoldPostIncidentTest,
   selectCommandSensors as selectCommandSensors2,
@@ -12353,6 +12602,55 @@ function registerSensors(program2) {
     const diff = opts.diffFile ? await readFile20(path42.resolve(root, opts.diffFile), "utf8") : await stagedDiff(root);
     const targets = scannableSensorTargets(diff);
     const hits = runSensors2(memories, targets);
+    const astMemories = (await runnableSensorMemories(paths, false)).filter(
+      (m) => m.frontmatter.sensor?.kind === "ast" && m.frontmatter.sensor.pattern
+    );
+    const astHits = [];
+    let astUnrunnable = 0;
+    if (astMemories.length > 0) {
+      if (!await astEngineAvailable()) {
+        astUnrunnable = astMemories.length;
+      } else {
+        const addedByPath = addedLineNumbersFromDiff2(diff);
+        for (const memory2 of astMemories) {
+          const sensor = memory2.frontmatter.sensor;
+          for (const target of targets) {
+            if (!sensorAppliesToPath3(sensor, memory2.frontmatter.anchor.paths, target.path)) continue;
+            const added = addedByPath.get(target.path);
+            if (!added || added.size === 0) continue;
+            let content = null;
+            try {
+              content = (await exec5("git", ["show", `:${target.path}`], { cwd: root })).stdout;
+            } catch {
+              try {
+                content = await readFile20(path42.resolve(root, target.path), "utf8");
+              } catch {
+                content = null;
+              }
+            }
+            if (content === null) continue;
+            const scan = await runAstSensorOnContent({
+              pattern: sensor.pattern,
+              absent: sensor.absent,
+              content,
+              filePath: target.path,
+              addedLines: added
+            });
+            if (scan.status === "ok" && scan.matches.length > 0) {
+              astHits.push({
+                memory_id: memory2.frontmatter.id,
+                sensor,
+                file: target.path,
+                matched_line: `${target.path}:${scan.matches[0].startLine}  ${scan.matches[0].text}`,
+                message: sensor.message,
+                severity: sensor.severity
+              });
+              break;
+            }
+          }
+        }
+      }
+    }
     const config = await loadConfig13(paths);
     const runCommands = opts.commands || config.enforcement?.runCommandSensors === true;
     const changedPaths = targets.map((t) => t.path).filter(Boolean);
@@ -12414,9 +12712,10 @@ function registerSensors(program2) {
       for (const spec of commandSpecs) commandSkipped.push(spec.memory_id);
     }
     await appendSensorEvaluations2(paths, ledgerRows);
-    const firedIds = [...new Set([...hits, ...commandHits].map((hit) => hit.memory_id))];
+    const firedIds = [...new Set([...hits, ...astHits, ...commandHits].map((hit) => hit.memory_id))];
     const preventionDetails = Object.fromEntries([
       ...hits.map((hit) => [hit.memory_id, { kind: "regex", stage: "manual" }]),
+      ...astHits.map((hit) => [hit.memory_id, { kind: "ast", stage: "manual" }]),
       ...commandHits.map((hit) => [hit.memory_id, {
         kind: commandSpecs.find((spec) => spec.memory_id === hit.memory_id)?.kind ?? "shell",
         stage: "manual",
@@ -12425,8 +12724,9 @@ function registerSensors(program2) {
     ]);
     await recordPreventionHits2(paths, firedIds, "sensor", /* @__PURE__ */ new Date(), preventionDetails);
     const output = {
-      scanned: memories.length,
-      hits: hits.map((hit) => ({
+      scanned: memories.length + astMemories.length,
+      ast_unrunnable: astUnrunnable,
+      hits: [...hits, ...astHits].map((hit) => ({
         memory_id: hit.memory_id,
         file: hit.file,
         severity: hit.severity,
@@ -12440,9 +12740,12 @@ function registerSensors(program2) {
     if (opts.json) {
       console.log(JSON.stringify(output, null, 2));
     } else {
-      const total = hits.length + commandHits.length;
-      console.log(ui.bold(`Hivelore sensors check \u2014 ${total} hit(s), ${memories.length} regex + ${commandSpecs.length} command sensor(s)`));
-      for (const hit of hits) {
+      const total = hits.length + astHits.length + commandHits.length;
+      console.log(ui.bold(`Hivelore sensors check \u2014 ${total} hit(s), ${memories.length} regex + ${astMemories.length} ast + ${commandSpecs.length} command sensor(s)`));
+      if (astUnrunnable > 0) {
+        console.log(ui.yellow(`  \u26A0 ${astUnrunnable} AST sensor(s) unrunnable \u2014 install @ast-grep/napi to activate them (never blocks).`));
+      }
+      for (const hit of [...hits, ...astHits]) {
         const marker = hit.severity === "block" ? ui.red("\u2717") : ui.yellow("\u26A0");
         console.log(`  ${marker} ${hit.memory_id} ${ui.dim(`(${hit.severity})`)}`);
         if (hit.file) console.log(`     ${ui.dim("file:")} ${hit.file}`);
@@ -12466,7 +12769,7 @@ function registerSensors(program2) {
         console.log(ui.dim(`  ${commandSkipped.length} command sensor(s) not run \u2014 pass --commands or set enforcement.runCommandSensors.`));
       }
     }
-    if ([...hits, ...commandHits].some((hit) => hit.severity === "block")) process.exitCode = 1;
+    if ([...hits, ...astHits, ...commandHits].some((hit) => hit.severity === "block")) process.exitCode = 1;
   });
   sensors.command("promote").description("Promote or demote an existing memory sensor severity").argument("<memory-id>", "memory id carrying the sensor").option("--severity <severity>", "block | warn", "block").option("--yes", "confirm promotion to block severity", false).option("--force", "promote even a brittle sensor (line-number/literal patterns) to block", false).option("-d, --dir <dir>", "project root").action(async (id, opts) => {
     const severity = opts.severity ?? "block";
@@ -12541,34 +12844,40 @@ function registerSensors(program2) {
   });
   sensors.command("propose").description(
     "Propose a discriminating sensor for a memory \u2014 you write the pattern, Hivelore validates it before\n  trusting it to block. Mirrors the MCP `propose_sensor` tool (the agent-authored path).\n\n  A `block` proposal is accepted ONLY if it is not brittle, stays SILENT on the current code,\n  and FIRES on the bad example. Rejected proposals are not written \u2014 fix and re-run.\n\n  Example:\n    hivelore sensors propose <memory-id> \\\n      --pattern 'stripe\\.paymentIntents\\.create' --absent 'idempotencyKey' \\\n      --bad-example 'stripe.paymentIntents.create({ amount })'"
-  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | shell | test \u2014 command kinds route the team's own oracle to this lesson", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
-    if (opts.kind === "shell" || opts.kind === "test") {
-      if (!opts.command?.trim()) {
+  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | ast (structural \u2014 comments/strings can't false-positive) | shell | test (route the team's own oracle)", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--red-ref <ref>", "kind=shell|test: pre-fix commit/ref \u2014 validation replays it in a scratch worktree and requires the oracle to FAIL there (records red_proven)").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
+    if (opts.kind === "shell" || opts.kind === "test" || opts.kind === "ast") {
+      if ((opts.kind === "shell" || opts.kind === "test") && !opts.command?.trim()) {
         ui.error("--kind shell|test requires --command.");
         process.exitCode = 1;
         return;
       }
+      if (opts.kind === "ast" && !opts.pattern?.trim()) {
+        ui.error("--kind ast requires --pattern (an ast-grep structural pattern).");
+        process.exitCode = 1;
+        return;
+      }
       const root2 = findProjectRoot39(opts.dir);
-      const { proposeSensor } = await import("./server-G6N6NJ64.js");
+      const { proposeSensor } = await import("./server-PZWIQUU7.js");
       const out = await proposeSensor(
         {
           memory_id: id,
           kind: opts.kind,
-          pattern: void 0,
-          command: opts.command.trim(),
+          pattern: opts.kind === "ast" ? opts.pattern.trim() : void 0,
+          command: opts.command?.trim(),
           timeout_ms: opts.timeout ? Math.max(1, Number(opts.timeout)) : void 0,
-          absent: void 0,
-          bad_example: void 0,
+          absent: opts.kind === "ast" ? opts.absent : void 0,
+          bad_example: opts.kind === "ast" ? opts.badExample : void 0,
           severity: opts.severity === "warn" ? "warn" : "block",
           message: opts.message,
           incident: opts.incident,
+          red_ref: opts.redRef,
           flags: void 0,
           paths: opts.paths ? opts.paths.split(",").map((p) => p.trim()).filter(Boolean) : []
         },
         { paths: resolveHaivePaths36(root2) }
       );
       if (out.accepted) {
-        ui.success(`Command sensor accepted (${out.severity}) on ${id}`);
+        ui.success(`${opts.kind === "ast" ? "AST" : "Command"} sensor accepted (${out.severity}) on ${id}`);
         ui.info(`  ${out.guidance}`);
       } else {
         ui.error(`Rejected (${out.reason}).`);
@@ -12811,17 +13120,19 @@ import {
   findProjectRoot as findProjectRoot40,
   loadMemoriesFromDir as loadMemoriesFromDir17,
   memoryFilePath as memoryFilePath7,
+  extractReviewLearnings,
   parseFindings,
   resolveHaivePaths as resolveHaivePaths37,
+  reviewLearningsToDrafts,
   serializeMemory as serializeMemory16
 } from "@hivelore/core";
 var SEVERITIES = ["info", "minor", "major", "critical", "blocker"];
 function registerIngest(program2) {
   program2.command("ingest").description(
-    "Ingest scanner findings (SonarQube / SARIF) as proposed, anchored memories with sensors.\n\n  Closes the review\u2194memory loop: a real defect a scanner found becomes a `gotcha`/`convention`\n  memory anchored to the file, pre-filled with a conservative `warn` sensor, so the next agent\n  is steered away from it. Drafts are status=proposed; a human validates/promotes them.\n\n  `sonar-api` fetches issues live over plain HTTPS from any SonarQube/SonarCloud instance \u2014\n  no MCP or special setup required, just a URL + token you provide (or SONAR_HOST_URL /\n  SONAR_TOKEN env). If you don't use it, file-based ingest works exactly the same.\n\n  Example:\n    hivelore ingest --from eslint eslint-report.json --min-severity major\n    hivelore ingest --from npm-audit audit.json --scope team\n    hivelore ingest --from sarif report.sarif --dry-run\n    hivelore ingest --from sonar sonar-issues.json --scope team --min-severity major\n    hivelore ingest --from sonar-api --sonar-component my_project --min-severity major\n\n  Generate the input reports:\n    eslint -f json -o eslint-report.json .      # --from eslint\n    npm audit --json > audit.json               # --from npm-audit\n"
-  ).argument("[file]", "path to the findings report JSON (required for --from sarif|sonar|eslint|npm-audit)").requiredOption("--from <format>", "report format: sarif | sonar | sonar-api | eslint | npm-audit").option("--dry-run", "show what would be created without writing", false).option("--scope <scope>", "memory scope: personal | team | module", "team").option("--module <name>", "module name (required when scope=module)").option("--type <type>", "memory type: gotcha | convention", "gotcha").option("--min-severity <severity>", "ignore findings below this severity (info|minor|major|critical|blocker)").option("--include-stylistic", "also ingest auto-fixable stylistic rules (semi/quotes/prefer-const\u2026); off by default as low-value noise", false).option("--limit <n>", "cap the number of memories created").option("--author <author>", "author email or handle").option("--json", "emit JSON", false).option("--sonar-url <url>", "SonarQube base URL for --from sonar-api (or env SONAR_HOST_URL)").option("--sonar-token <token>", "SonarQube token for --from sonar-api (or env SONAR_TOKEN)").option("--sonar-component <key>", "SonarQube project/component key for --from sonar-api").option("--sonar-branch <branch>", "optional SonarQube branch for --from sonar-api").option("-d, --dir <dir>", "project root").action(async (file, opts) => {
+    "Ingest scanner findings (SonarQube / SARIF) as proposed, anchored memories with sensors.\n\n  Closes the review\u2194memory loop: a real defect a scanner found becomes a `gotcha`/`convention`\n  memory anchored to the file, pre-filled with a conservative `warn` sensor, so the next agent\n  is steered away from it. Drafts are status=proposed; a human validates/promotes them.\n\n  `sonar-api` fetches issues live over plain HTTPS from any SonarQube/SonarCloud instance \u2014\n  no MCP or special setup required, just a URL + token you provide (or SONAR_HOST_URL /\n  SONAR_TOKEN env). If you don't use it, file-based ingest works exactly the same.\n\n  Example:\n    hivelore ingest --from eslint eslint-report.json --min-severity major\n    hivelore ingest --from npm-audit audit.json --scope team\n    hivelore ingest --from sarif report.sarif --dry-run\n    hivelore ingest --from sonar sonar-issues.json --scope team --min-severity major\n    hivelore ingest --from sonar-api --sonar-component my_project --min-severity major\n\n  Generate the input reports:\n    eslint -f json -o eslint-report.json .      # --from eslint\n    npm audit --json > audit.json               # --from npm-audit\n\n  Review learnings (the PR loop \u2014 a reviewer reply becomes a proposed memory):\n    hivelore ingest --from github-pr 123          # fetches review threads via gh\n    hivelore ingest --from github-pr comments.json --dry-run\n    Kept: human replies that read as instructions (never/always/must/prefer\u2026) or carry\n    the explicit marker (reply `/hivelore remember <rule>` on the thread).\n"
+  ).argument("[file]", "findings report JSON \u2014 or, for --from github-pr, a PR number/URL (fetched via gh) or a recorded comments JSON").requiredOption("--from <format>", "report format: sarif | sonar | sonar-api | eslint | npm-audit | github-pr").option("--dry-run", "show what would be created without writing", false).option("--scope <scope>", "memory scope: personal | team | module", "team").option("--module <name>", "module name (required when scope=module)").option("--type <type>", "memory type: gotcha | convention", "gotcha").option("--min-severity <severity>", "ignore findings below this severity (info|minor|major|critical|blocker)").option("--include-stylistic", "also ingest auto-fixable stylistic rules (semi/quotes/prefer-const\u2026); off by default as low-value noise", false).option("--limit <n>", "cap the number of memories created").option("--author <author>", "author email or handle").option("--json", "emit JSON", false).option("--sonar-url <url>", "SonarQube base URL for --from sonar-api (or env SONAR_HOST_URL)").option("--sonar-token <token>", "SonarQube token for --from sonar-api (or env SONAR_TOKEN)").option("--sonar-component <key>", "SonarQube project/component key for --from sonar-api").option("--sonar-branch <branch>", "optional SonarQube branch for --from sonar-api").option("-d, --dir <dir>", "project root").action(async (file, opts) => {
     const format = opts.from;
-    const VALID_FORMATS = ["sarif", "sonar", "sonar-api", "eslint", "npm-audit"];
+    const VALID_FORMATS = ["sarif", "sonar", "sonar-api", "eslint", "npm-audit", "github-pr"];
     if (!format || !VALID_FORMATS.includes(format)) {
       ui.error(`--from must be one of: ${VALID_FORMATS.join(", ")}`);
       process.exitCode = 1;
@@ -12846,7 +13157,25 @@ function registerIngest(program2) {
     }
     const parseFormat = format === "sonar-api" ? "sonar" : format;
     let raw;
-    if (format === "sonar-api") {
+    if (format === "github-pr") {
+      if (!file) {
+        ui.error("--from github-pr needs a PR number/URL or a recorded comments JSON file.");
+        process.exitCode = 1;
+        return;
+      }
+      const asPath = path43.resolve(root, file);
+      if (existsSync45(asPath)) {
+        raw = await readFile21(asPath, "utf8");
+      } else {
+        const fetched = await fetchPrReviewComments(root, file);
+        if (!fetched.ok) {
+          ui.error(fetched.error);
+          process.exitCode = 1;
+          return;
+        }
+        raw = fetched.json;
+      }
+    } else if (format === "sonar-api") {
       const fetched = await fetchSonarIssues(opts);
       if (!fetched.ok) {
         ui.error(fetched.error);
@@ -12876,7 +13205,23 @@ function registerIngest(program2) {
     }
     let drafts;
     let findingsCount = 0;
-    try {
+    if (format === "github-pr") {
+      try {
+        const payload = JSON.parse(raw);
+        findingsCount = Array.isArray(payload) ? payload.length : 0;
+        const learnings = extractReviewLearnings(payload);
+        drafts = reviewLearningsToDrafts(learnings, {
+          scope: opts.scope ?? "team",
+          module: opts.module,
+          author: opts.author,
+          ...opts.limit ? { limit: Math.max(0, Number.parseInt(opts.limit, 10) || 0) } : {}
+        });
+      } catch (err) {
+        ui.error(`Failed to parse the PR comments payload: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+        return;
+      }
+    } else try {
       const findings = parseFindings(parseFormat, raw, { cwd: root });
       findingsCount = findings.length;
       drafts = draftsFromFindings(findings, {
@@ -13001,6 +13346,30 @@ async function fetchSonarIssues(opts) {
     };
   }
 }
+async function fetchPrReviewComments(root, ref) {
+  const numberMatch = ref.match(/^(\d+)$/) ?? ref.match(/\/pull\/(\d+)/);
+  if (!numberMatch) {
+    return { ok: false, error: `"${ref}" is neither a comments JSON file, a PR number, nor a PR URL.` };
+  }
+  const prNumber = numberMatch[1];
+  const { execFile: execFile9 } = await import("child_process");
+  const { promisify: promisify9 } = await import("util");
+  const run = promisify9(execFile9);
+  try {
+    const { stdout } = await run(
+      "gh",
+      ["api", `repos/{owner}/{repo}/pulls/${prNumber}/comments`, "--paginate"],
+      { cwd: root, maxBuffer: 16 * 1024 * 1024 }
+    );
+    return { ok: true, json: stdout };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      error: `Could not fetch PR #${prNumber} review comments via gh: ${(e.stderr || e.message || String(err)).slice(0, 200)}. Install/authenticate the gh CLI, or pass a recorded comments JSON file instead.`
+    };
+  }
+}
 
 // src/commands/dashboard.ts
 import { existsSync as existsSync46 } from "fs";
@@ -13460,7 +13829,7 @@ function registerBridges(program2) {
 
 // src/index.ts
 var program = new Command48();
-program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.39.2").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
+program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.42.1").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
 registerInit(program);
 registerResolveProject(program);
 registerEnforce(program);