@hivelore/cli 0.43.2 → 0.46.0

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   readPresumedCorrectTargets,
   runAstSensorOnContent,
   runHaiveMcpStdio
-} from "./chunk-FXDGOBPT.js";
+} from "./chunk-W7EPRKOZ.js";
 import {
   registerMemoryPending
 } from "./chunk-OYJKHD22.js";
@@ -1299,7 +1299,7 @@ function attachSemanticCommands(embeddings, naming) {
       minScore: Number(opts.minScore ?? 0)
     });
     if (!result) {
-      ui.error("No embeddings index found. Run `hivelore embeddings index` first.");
+      ui.error("No embeddings index found. Run `hivelore index memories` first.");
       process.exitCode = 1;
       return;
     }
@@ -1319,7 +1319,7 @@ function attachSemanticCommands(embeddings, naming) {
     const { indexStat } = await loadEmbeddings();
     const stat2 = await indexStat(paths);
     if (!stat2.exists) {
-      ui.warn("No embeddings index. Run `hivelore embeddings index` to create one.");
+      ui.warn("No embeddings index. Run `hivelore index memories` to create one.");
       return;
     }
     console.log(`${ui.bold("entries:")}    ${stat2.count}`);
@@ -1393,7 +1393,7 @@ function registerIndexCode(program2) {
       mod = await import("@hivelore/embeddings");
     } catch {
       ui.error(
-        "@hivelore/embeddings is not installed. Install it (`pnpm add @hivelore/embeddings`) or run `hivelore embeddings install`."
+        "@hivelore/embeddings is not installed. Install it (`pnpm add @hivelore/embeddings`) then run `hivelore index code-search`."
       );
       process.exit(1);
     }
@@ -3758,7 +3758,7 @@ ${SEED_FOOTER(stack)}` });
 
 // src/commands/init.ts
 var execFileAsync = promisify2(execFile2);
-var HAIVE_GITHUB_ACTION_REF = `v${"0.43.2"}`;
+var HAIVE_GITHUB_ACTION_REF = `v${"0.46.0"}`;
 var PROJECT_CONTEXT_TEMPLATE = `# Project context
 
 > Generated by \`hivelore init\`. Run \`hivelore init --bootstrap\` to auto-fill from your codebase,
@@ -5259,7 +5259,7 @@ Wait for **explicit confirmation** before acting.
           )
         );
       } catch {
-        ui.warn("--embed: @hivelore/embeddings not available or index build failed. Run `hivelore embeddings index` manually.");
+        ui.warn("--embed: @hivelore/embeddings not available or index build failed. Install it, then run `hivelore index memories`.");
       }
     }
   });
@@ -6974,6 +6974,7 @@ import {
   loadConfig as loadConfig6,
   loadMemoriesFromDir as loadMemoriesFromDir10,
   loadPreventionEvents,
+  readUsageEvents,
   loadUsageIndex as loadUsageIndex11,
   memoryFilePath as memoryFilePath5,
   renderCaughtForYou,
@@ -7226,6 +7227,14 @@ async function observationStart(paths) {
   }
   return first;
 }
+async function manualSessionStart(paths) {
+  const events = await readUsageEvents(paths);
+  for (let index = events.length - 1; index >= 0; index--) {
+    const event = events[index];
+    if (["get_briefing", "briefing", "session_start", "enforce_session_start"].includes(event.tool)) return event.at;
+  }
+  return null;
+}
 async function printCaughtForYou(paths, since, quiet) {
   if (quiet) return;
   const memories = existsSync32(paths.memoriesDir) ? await loadMemoriesFromDir10(paths.memoriesDir) : [];
@@ -7275,7 +7284,7 @@ function registerSessionEnd(session2) {
     let resolvedFiles = opts.files;
     let goal = opts.goal;
     let accomplished = opts.accomplished ?? opts.summary;
-    const caughtSince = opts.auto ? await observationStart(paths) : null;
+    const caughtSince = opts.auto ? await observationStart(paths) : await manualSessionStart(paths);
     if (opts.auto) {
       const autoCaptured = await autoCaptureFailureLessons(paths, root, await readObservationList(paths)).catch(() => ({ written: 0, ids: [] }));
       const synth = await buildAutoRecap(paths);
@@ -7409,14 +7418,17 @@ import { mkdir as mkdir12, writeFile as writeFile18 } from "fs/promises";
 import path30 from "path";
 import {
   aggregateUsage,
+  assessBehaviourCoverage,
   buildPreventionReceipt,
+  loadCodeMap as loadCodeMap6,
+  renderBehaviourCoverageLine,
   renderPreventionReceipt,
   findProjectRoot as findProjectRoot28,
   loadMemoriesFromDir as loadMemoriesFromDir11,
   loadUsageIndex as loadUsageIndex12,
   loadPreventionEvents as loadPreventionEvents2,
   parseSince,
-  readUsageEvents,
+  readUsageEvents as readUsageEvents2,
   renderPreventionReceiptShare,
   resolveHaivePaths as resolveHaivePaths27,
   usageLogSize
@@ -7438,6 +7450,19 @@ function registerStats(program2) {
     const receipt = buildPreventionReceipt(events, memories, usage, { since });
     const output = sub.share ? renderPreventionReceiptShare(receipt) : opts.json ? JSON.stringify(receipt, null, 2) : renderPreventionReceipt(receipt);
     console.log(output);
+    if (!opts.json && !sub.share) {
+      try {
+        const codeMap = await loadCodeMap6(paths);
+        if (codeMap) {
+          const cov = assessBehaviourCoverage({ memories, codeFiles: Object.keys(codeMap.files) });
+          if (cov.mainAreas.length > 0) {
+            console.log(`
+Behaviour harness: ${renderBehaviourCoverageLine(cov)}.`);
+          }
+        }
+      } catch {
+      }
+    }
   });
   stats.option("--since <window>", "ISO date or relative (e.g. '7d', '24h', '30m')", "30d").option("--json", "emit JSON instead of human-readable output", false).option("--memory-hits", "show top-read memories (which mems are actually being used)", false).option(
     "--export-report <path>",
@@ -7465,7 +7490,7 @@ function registerStats(program2) {
       );
       return;
     }
-    const events = await readUsageEvents(paths);
+    const events = await readUsageEvents2(paths);
     const since = parseSince(opts.since);
     const aggregate = aggregateUsage(events, since ?? void 0);
     if (opts.json) {
@@ -7501,7 +7526,7 @@ function registerStats(program2) {
 async function writeRoiReport(paths, root, sinceRaw, outRelative) {
   const outAbs = path30.isAbsolute(outRelative) ? path30.resolve(outRelative) : path30.resolve(root, outRelative);
   const size = await usageLogSize(paths);
-  let events = await readUsageEvents(paths);
+  let events = await readUsageEvents2(paths);
   let memoryCount = { team: 0, personal: 0, total_skipped_session: 0 };
   if (existsSync33(paths.memoriesDir)) {
     const mems = await loadMemoriesFromDir11(paths.memoriesDir);
@@ -7666,7 +7691,7 @@ function registerBench(program2) {
       },
       async () => {
         const t0 = performance.now();
-        const out = await antiPatternsCheck({ diff: task, paths: [], limit: 5, semantic: true }, ctx);
+        const out = await antiPatternsCheck({ diff: task, paths: [], limit: 5, semantic: true, track: false }, ctx);
         return summarize("anti_patterns_check", t0, out, [
           `${out.warnings.length}/${out.scanned} warn`
         ]);
@@ -7757,7 +7782,7 @@ function registerBenchmark(program2) {
       "   - Hivelore agents must run `hivelore briefing --files ... --task ...` first.",
       "   - Plain agents must not read `.ai` or call Hivelore.",
       "5. Require every agent to write `BENCHMARK_AGENT_REPORT.md`.",
-      "   Its `## Outcome` section must include: Task completed, Tests passed, Policy violations, Duration seconds, Total tokens.",
+      "   Its `## Outcome` section must include: Task completed, Tests passed, Policy violations, Duration seconds, Total tokens, Runner ID, Evaluator ID, Independent evaluation.",
       "6. Run `hivelore benchmark report --dir <benchmark-root> --out RESULTS.md`.",
       "7. Do not make comparative claims until evidence_grade=decision-ready (>=10 paired tasks with complete outcomes).",
       "",
@@ -7802,7 +7827,10 @@ function parseAgentReport(fixture, report) {
     tests_passed: reportBoolean(report, "Tests passed"),
     policy_violations: reportNumber(report, "Policy violations"),
     duration_seconds: reportNumber(report, "Duration seconds"),
-    total_tokens: reportNumber(report, "Total tokens")
+    total_tokens: reportNumber(report, "Total tokens"),
+    runner_id: reportValue(report, "Runner ID"),
+    evaluator_id: reportValue(report, "Evaluator ID"),
+    independent_evaluation: reportBoolean(report, "Independent evaluation")
   };
 }
 function summarizeRows(rows) {
@@ -7813,14 +7841,14 @@ function summarizeRows(rows) {
   const plainTasks = new Set(plainRows.map((row) => taskName(row.fixture)));
   const pairedTasks = new Set(haiveRows.map((row) => taskName(row.fixture)).filter((name) => plainTasks.has(name))).size;
   const outcomeComplete = rows.length > 0 && rows.every(
-    (row) => row.task_completed !== null && row.tests_passed !== null && row.policy_violations !== null && row.duration_seconds !== null && row.total_tokens !== null
+    (row) => row.task_completed !== null && row.tests_passed !== null && row.policy_violations !== null && row.duration_seconds !== null && row.total_tokens !== null && row.runner_id !== null && row.evaluator_id !== null && row.evaluator_id !== row.runner_id && row.independent_evaluation === true
   );
   const decisionReady = pairedTasks >= 10 && outcomeComplete;
   return {
     fixtures: rows.length,
     paired_tasks: pairedTasks,
     evidence_grade: decisionReady ? "decision-ready" : "insufficient",
-    evidence_reason: decisionReady ? "At least 10 paired tasks with complete correctness, policy, duration, and token outcomes." : `Need >=10 paired tasks and complete Outcome fields; found ${pairedTasks} pair(s), outcome_complete=${outcomeComplete}.`,
+    evidence_reason: decisionReady ? "At least 10 paired tasks with complete outcomes reviewed by an evaluator distinct from the runner." : `Need >=10 paired tasks, complete Outcome fields, and independent evaluator attestations; found ${pairedTasks} pair(s), outcome_complete=${outcomeComplete}.`,
     haive: summarizeGroup(haiveRows),
     plain: summarizeGroup(plainRows)
   };
@@ -7941,7 +7969,7 @@ import {
 function registerEval(program2) {
   program2.command("eval").description(
     "Rigorous, repeatable quality eval: do the right memories surface (retrieval) and do the right sensors fire (catch-rate)? Emits a numeric 0\u2013100 score. Uses .ai/eval cases via --spec, or auto-synthesizes cases from anchored memories."
-  ).option("--spec <file>", "JSON eval spec ({ retrieval: [...], sensors: [...] })").option("--semantic-only", "self-eval probes by title alone (no anchor files) \u2014 harder retrieval", false).option("-k, --top <n>", "briefing top-k considered a hit", "8").option("--json", "emit JSON", false).option("--out <file>", "write a Markdown report").option("--fail-under <score>", "exit non-zero if the overall score is below this (0\u2013100) \u2014 for CI gates").option("--fail-under-catch-rate <pct>", "exit non-zero if sensor catch-rate is below this percentage").option("--fail-under-gate-precision <pct>", "exit non-zero if gate precision is below this percentage").option("--baseline", "save this run as the baseline (.ai/eval/baseline.json) for future --compare", false).option("--compare", "diff this run against the saved baseline and print the delta", false).option("--baseline-file <path>", "baseline file to read/write (default: .ai/eval/baseline.json)").option("--fail-on-regression", "with --compare, exit non-zero if the score dropped vs the baseline", false).option("--regression-gate", "CI-safe gate: compare against the baseline IF one exists (fail on regression), else no-op", false).option("--approve-cases", "approve every proposed golden case (gate-miss labeled) into the scored retrieval set, then exit", false).option("--record", "append this run's score to .ai/.cache/eval-history.jsonl (trend the harness over time)", false).option("--trend", "print the recorded score trend (sparkline + latest/best/delta) and exit", false).option("--ref <ref>", "version/commit label stored with a --record run").option("-d, --dir <dir>", "project root").action(async (opts) => {
+  ).option("--spec <file>", "JSON eval spec ({ retrieval: [...], sensors: [...] })").option("--semantic-only", "self-eval probes by title alone (no anchor files) \u2014 harder retrieval", false).option("--semantic-ranking", "run the real embeddings-backed ranking lane; fails if embeddings/index are unavailable", false).option("-k, --top <n>", "briefing top-k considered a hit", "8").option("--json", "emit JSON", false).option("--out <file>", "write a Markdown report").option("--fail-under <score>", "exit non-zero if the overall score is below this (0\u2013100) \u2014 for CI gates").option("--fail-under-catch-rate <pct>", "exit non-zero if sensor catch-rate is below this percentage").option("--fail-under-gate-precision <pct>", "exit non-zero if gate precision is below this percentage").option("--baseline", "save this run as the baseline (.ai/eval/baseline.json) for future --compare", false).option("--compare", "diff this run against the saved baseline and print the delta", false).option("--baseline-file <path>", "baseline file to read/write (default: .ai/eval/baseline.json)").option("--fail-on-regression", "with --compare, exit non-zero if the score dropped vs the baseline", false).option("--regression-gate", "CI-safe gate: compare against the baseline IF one exists (fail on regression), else no-op", false).option("--approve-cases", "approve every proposed golden case (gate-miss labeled) into the scored retrieval set, then exit", false).option("--record", "append this run's score to .ai/.cache/eval-history.jsonl (trend the harness over time)", false).option("--trend", "print the recorded score trend (sparkline + latest/best/delta) and exit", false).option("--ref <ref>", "version/commit label stored with a --record run").option("-d, --dir <dir>", "project root").action(async (opts) => {
     const root = findProjectRoot31(opts.dir);
     const paths = resolveHaivePaths29(root);
     if (!existsSync35(paths.memoriesDir)) {
@@ -8003,8 +8031,15 @@ function registerEval(program2) {
     if (spec.retrieval && spec.retrieval.length > 0) {
       const results = [];
       for (const c of spec.retrieval) {
-        const surfaced = await runRetrieval(c, k, ctx);
-        results.push(scoreRetrievalCase(c.name, c.expect_ids, surfaced));
+        const retrieval = await runRetrieval(c, k, ctx, opts.semanticRanking === true);
+        if (opts.semanticRanking && retrieval.searchMode !== "semantic") {
+          ui.error(
+            "Semantic eval requested, but the embeddings package/index is unavailable. Install @hivelore/embeddings and run `hivelore index memories` first."
+          );
+          process.exitCode = 1;
+          return;
+        }
+        results.push(scoreRetrievalCase(c.name, c.expect_ids, retrieval.ids));
       }
       retrievalAgg = aggregateRetrieval(results);
     }
@@ -8044,7 +8079,7 @@ function registerEval(program2) {
       });
       if (!opts.json) ui.success(`Recorded eval score ${report.score}/100 to history.`);
     }
-    const baselineFile = opts.baselineFile ? path32.isAbsolute(opts.baselineFile) ? opts.baselineFile : path32.join(root, opts.baselineFile) : path32.join(root, ".ai", "eval", "baseline.json");
+    const baselineFile = opts.baselineFile ? path32.isAbsolute(opts.baselineFile) ? opts.baselineFile : path32.join(root, opts.baselineFile) : path32.join(root, ".ai", "eval", opts.semanticRanking ? "semantic-baseline.json" : "baseline.json");
     if (opts.baseline) {
       const snapshot = {
         saved_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8081,6 +8116,7 @@ function registerEval(program2) {
       console.log(JSON.stringify({
         root,
         k,
+        ranking_mode: opts.semanticRanking ? "semantic" : "deterministic",
         spec_source: resolvedSpec.source,
         provenance: {
           synthesized: resolvedSpec.synthesized,
@@ -8240,7 +8276,7 @@ async function resolveSpec(opts, root, memoriesDir) {
     authored: 0
   };
 }
-async function runRetrieval(c, k, ctx) {
+async function runRetrieval(c, k, ctx, semanticRanking = false) {
   const out = await getBriefing(
     {
       task: c.task,
@@ -8254,17 +8290,17 @@ async function runRetrieval(c, k, ctx) {
       include_stale: false,
       track: false,
       memory_scopes: ["team", "module"],
-      deterministic: true,
+      deterministic: !semanticRanking,
       format: "compact",
       min_semantic_score: 0
     },
     ctx
   );
-  return out.memories.map((m) => m.id);
+  return { ids: out.memories.map((m) => m.id), searchMode: out.search_mode };
 }
 async function runSensorCase(c, ctx) {
   const out = await antiPatternsCheck(
-    { diff: c.diff, paths: c.paths ?? [], limit: 50, semantic: false },
+    { diff: c.diff, paths: c.paths ?? [], limit: 50, semantic: false, track: false },
     ctx
   );
   return out.warnings.filter((w) => w.reasons.includes("sensor")).map((w) => w.id);
@@ -8357,7 +8393,7 @@ import {
   loadMemoriesFromDir as loadMemoriesFromDir12,
   memoryFilePath as memoryFilePath6,
   parseSince as parseSince2,
-  readUsageEvents as readUsageEvents2,
+  readUsageEvents as readUsageEvents3,
   resolveHaivePaths as resolveHaivePaths30,
   serializeMemory as serializeMemory13,
   suggestTopicKey
@@ -8388,7 +8424,7 @@ function registerMemorySuggest(memory2) {
     }
     const root = findProjectRoot32(opts.dir);
     const paths = resolveHaivePaths30(root);
-    const events = await readUsageEvents2(paths);
+    const events = await readUsageEvents3(paths);
     if (events.length === 0) {
       if (opts.json) {
         console.log(JSON.stringify({ suggestions: [] }));
@@ -8765,6 +8801,8 @@ import "commander";
 import {
   codeMapPath as codeMapPath2,
   assessSensorHealth as assessSensorHealth2,
+  assessBehaviourCoverage as assessBehaviourCoverage2,
+  renderBehaviourCoverageLine as renderBehaviourCoverageLine2,
   sensorPromotedAtMap as sensorPromotedAtMap2,
   countSourceFilesOnDisk,
   extractReferencedPaths,
@@ -8773,12 +8811,12 @@ import {
   findProjectRoot as findProjectRoot35,
   getUsage as getUsage9,
   isStackPackSeed as isStackPackSeed2,
-  loadCodeMap as loadCodeMap6,
+  loadCodeMap as loadCodeMap7,
   loadConfig as loadConfig10,
   loadMemoriesFromDirDetailed,
   loadSensorLedger as loadSensorLedger2,
   loadUsageIndex as loadUsageIndex15,
-  readUsageEvents as readUsageEvents3,
+  readUsageEvents as readUsageEvents4,
   resolveHaivePaths as resolveHaivePaths33
 } from "@hivelore/core";
 
@@ -9027,14 +9065,15 @@ function registerDoctor(program2) {
       }
     }
     const lintReport = await lintMemoriesAsync(root);
-    if (lintReport.findings.length > 0) {
+    const actionableLintFindings = lintReport.findings.filter((finding) => finding.severity !== "info");
+    if (actionableLintFindings.length > 0) {
       const warnCount = lintReport.findings.filter((finding) => finding.severity === "warn").length;
       const errorCount = lintReport.findings.filter((finding) => finding.severity === "error").length;
       const severity = errorCount > 0 ? "error" : warnCount > 0 ? "warn" : "info";
       findings.push({
         severity,
         code: "memory-lint-findings",
-        message: `memory lint reports ${lintReport.findings.length} finding${lintReport.findings.length === 1 ? "" : "s"} (${errorCount} error, ${warnCount} warn, ${lintReport.findings.length - errorCount - warnCount} info).`,
+        message: `memory lint reports ${actionableLintFindings.length} actionable finding${actionableLintFindings.length === 1 ? "" : "s"} (${errorCount} error, ${warnCount} warn).`,
         fix: "hivelore memory lint --fix --apply"
       });
     }
@@ -9103,7 +9142,7 @@ function registerDoctor(program2) {
     }
     const astSensorCount = sensorMemories.filter((m) => m.memory.frontmatter.sensor?.kind === "ast").length;
     if (astSensorCount > 0) {
-      const { astEngineAvailable: astEngineAvailable2 } = await import("./server-WW6JHBYY.js");
+      const { astEngineAvailable: astEngineAvailable2 } = await import("./server-V3ZGBTAG.js");
       if (!await astEngineAvailable2()) {
         findings.push({
           severity: "warn",
@@ -9164,7 +9203,7 @@ function registerDoctor(program2) {
         fix: "Review the sensor manually; no automatic delete/retire command is provided."
       });
     }
-    const codeMap = await loadCodeMap6(paths);
+    const codeMap = await loadCodeMap7(paths);
     if (!codeMap) {
       findings.push({
         severity: "warn",
@@ -9186,7 +9225,7 @@ function registerDoctor(program2) {
         });
       }
       const onDisk = await countSourceFilesOnDisk(root);
-      if (onDisk >= 20 && indexedCount < onDisk * 0.5) {
+      if (isCodeMapNearEmpty(indexedCount, onDisk)) {
         findings.push({
           severity: "warn",
           code: "code-map-near-empty",
@@ -9196,6 +9235,7 @@ function registerDoctor(program2) {
       }
     }
     findings.push(...await collectHarnessCoverageFindings(codeMap, memories));
+    findings.push(...collectBehaviourCoverageFindings(codeMap, memories));
     findings.push(...await collectSemanticIndexFindings(paths, config, memories.length, codeMap));
     try {
       const scaffoldGaps = await collectScaffoldLoopGaps(paths);
@@ -9209,7 +9249,7 @@ function registerDoctor(program2) {
       }
     } catch {
     }
-    const events = await readUsageEvents3(paths);
+    const events = await readUsageEvents4(paths);
     if (events.length === 0) {
       findings.push({
         severity: "info",
@@ -9273,7 +9313,8 @@ function registerDoctor(program2) {
         fix: "Edit .ai/haive.config.json: set autoSessionEnd: true (or re-run `hivelore init` without --manual)."
       });
     }
-    findings.push(...await collectInstallFindings(root, "0.43.2"));
+    findings.push(...await collectInstallFindings(root, "0.46.0"));
+    findings.push(...await collectMcpRuntimeFindings(paths, "0.46.0"));
     findings.push(...await collectToolchainFindings(root));
     try {
       const legacyRaw = execSync("haive-mcp --version", {
@@ -9281,7 +9322,7 @@ function registerDoctor(program2) {
         timeout: 3e3,
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
-      const cliVersion = "0.43.2";
+      const cliVersion = "0.46.0";
       if (legacyRaw && legacyRaw !== cliVersion) {
         findings.push({
           severity: "warn",
@@ -9337,6 +9378,39 @@ npm uninstall -g @hivelore/mcp`
     emit(findings, opts, repairs);
   });
 }
+function isCodeMapNearEmpty(indexedCount, sourceFilesOnDisk) {
+  return sourceFilesOnDisk >= 20 && indexedCount < sourceFilesOnDisk * 0.05;
+}
+function mcpRuntimeVersionFinding(marker, expectedVersion, processAlive) {
+  if (!processAlive || !marker.version || marker.version === expectedVersion) return null;
+  return {
+    severity: "warn",
+    code: "active-mcp-server-stale",
+    message: `An active MCP server is still v${marker.version} while the installed CLI is v${expectedVersion}. MCP clients keep server processes alive across package upgrades.`,
+    fix: "Restart the IDE/agent MCP client, then confirm get_briefing.server_version matches `hivelore --version`.",
+    section: "Agent coverage"
+  };
+}
+async function collectMcpRuntimeFindings(paths, expectedVersion) {
+  const markerFile = path37.join(paths.runtimeDir, "mcp-server.json");
+  if (!existsSync40(markerFile)) return [];
+  try {
+    const marker = JSON.parse(await readFile16(markerFile, "utf8"));
+    let alive = false;
+    if (typeof marker.pid === "number") {
+      try {
+        process.kill(marker.pid, 0);
+        alive = true;
+      } catch {
+        alive = false;
+      }
+    }
+    const finding = mcpRuntimeVersionFinding(marker, expectedVersion, alive);
+    return finding ? [finding] : [];
+  } catch {
+    return [];
+  }
+}
 function emit(findings, opts, repairs = []) {
   const classified = findings.map((finding) => ({
     ...finding,
@@ -9505,6 +9579,33 @@ async function collectHarnessCoverageFindings(codeMap, memories) {
   });
   return findings;
 }
+function collectBehaviourCoverageFindings(codeMap, memories) {
+  if (!codeMap) return [];
+  const codeFiles = Object.keys(codeMap.files);
+  const cov = assessBehaviourCoverage2({ memories, codeFiles });
+  if (cov.mainAreas.length === 0) return [];
+  const uncoveredHint = cov.uncoveredAreas.length > 0 && cov.totalOracles > 0 ? `
+  No behavioural oracle: ${cov.uncoveredAreas.slice(0, 5).map((a) => `\`${a}\``).join(", ")}` + (cov.uncoveredAreas.length > 5 ? `, +${cov.uncoveredAreas.length - 5} more` : "") : "";
+  let fix;
+  if (cov.uncoveredAreas.length > 0) {
+    const lines = cov.uncoveredAreaSuggestions.slice(0, 4).map(
+      (s) => s.candidateLessonId ? `hivelore sensors scaffold ${s.candidateLessonId} --red-ref <pre-fix-commit>   # guard ${s.area}` : `hivelore memory tried --paths ${s.area}/ --what "<incident>" --why-failed "<why>"   # then scaffold --red-ref for ${s.area}`
+    );
+    const more = cov.uncoveredAreas.length > 4 ? `
+  # +${cov.uncoveredAreas.length - 4} more area(s)` : "";
+    fix = "Scaffold a behavioural oracle for each uncovered area:\n  " + lines.join("\n  ") + more;
+  } else if (cov.armedOracles < cov.totalOracles || cov.redProvenOracles < cov.armedOracles) {
+    fix = "Arm warn-only oracles to `block` and re-propose with `--red-ref` so each substantiates its incident.";
+  }
+  return [{
+    severity: "info",
+    code: "behaviour-coverage",
+    section: "Protection",
+    coverage_percent: Math.round(cov.areasWithOracle.length / cov.mainAreas.length * 100),
+    message: `Behaviour harness: ${renderBehaviourCoverageLine2(cov)}.` + uncoveredHint,
+    fix
+  }];
+}
 async function collectSemanticIndexFindings(paths, config, memoryCount, codeMap) {
   const findings = [];
   const autoWantsCodeSearch = Boolean(config.autopilot || config.autoRepair?.codeSearch);
@@ -9516,7 +9617,7 @@ async function collectSemanticIndexFindings(paths, config, memoryCount, codeMap)
       severity: autoWantsCodeSearch ? "warn" : "info",
       code: "embeddings-unavailable",
       message: "@hivelore/embeddings is not available, so get_briefing falls back to lexical ranking and code_search cannot run.",
-      fix: "npm install -g @hivelore/cli@latest\nhaive embeddings status",
+      fix: "npm install -g @hivelore/embeddings@latest\nhivelore index status",
       section: "Index health"
     });
     return findings;
@@ -9528,7 +9629,7 @@ async function collectSemanticIndexFindings(paths, config, memoryCount, codeMap)
         severity: "warn",
         code: "semantic-memory-index-missing",
         message: "Memory embeddings index is missing or empty; get_briefing will report literal_fallback instead of semantic ranking.",
-        fix: "hivelore embeddings index",
+        fix: "hivelore index memories",
         section: "Index health"
       });
     }
@@ -10030,7 +10131,7 @@ import {
   detectSensorWeakening,
   isSensorScannablePath,
   findProjectRoot as findProjectRoot37,
-  loadCodeMap as loadCodeMap7,
+  loadCodeMap as loadCodeMap8,
   renderBootstrapChecklist,
   findUncapturedFailures,
   handoffAgeMs,
@@ -10963,7 +11064,7 @@ async function checkBootstrapComplete(paths, config, productionCodeChanged) {
   } catch {
   }
   const memories = existsSync42(paths.memoriesDir) ? await loadMemoriesFromDir15(paths.memoriesDir) : [];
-  const codeMap = await loadCodeMap7(paths);
+  const codeMap = await loadCodeMap8(paths);
   const codeFiles = codeMap ? Object.keys(codeMap.files).filter((file) => existsSync42(path40.join(paths.root, file))) : [];
   let existingModules = [];
   try {
@@ -11028,7 +11129,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
       findings: [{ severity: "info", code: "enforcement-off", message: "Hivelore enforcement is disabled." }]
     });
   }
-  findings.push(...await inspectIntegrationVersions(root, "0.43.2"));
+  findings.push(...await inspectIntegrationVersions(root, "0.46.0"));
   if (config.enforcement?.requireBriefingFirst !== false && stage !== "ci") {
     const hasBriefing = await hasRecentBriefingMarker(paths, sessionId);
     findings.push(hasBriefing ? { severity: "ok", code: "briefing-loaded", message: "A recent Hivelore briefing marker exists." } : {
@@ -11271,15 +11372,26 @@ async function verifyDecisionCoverage(paths, stage, sessionId) {
 }
 async function runPrecommitPolicy(paths, gate, stage, config) {
   const snapshot = await getPolicyDiffSnapshot(paths.root, stage);
-  const weakenings = detectSensorWeakening(snapshot.diff);
+  const weakeningApprovals = await resolveSensorWeakeningApprovals(paths.root, stage);
+  const detectedWeakenings = detectSensorWeakening(snapshot.diff);
+  const weakenings = detectedWeakenings.filter((weakening) => !weakeningApprovals.has(weakening.memory_id));
+  const approvedWeakenings = detectedWeakenings.filter((weakening) => weakeningApprovals.has(weakening.memory_id));
   const weakeningFindings = weakenings.length > 0 ? [{
     severity: config.enforcement?.sensorWeakeningGate === "block" ? "error" : "warn",
     code: "sensor-weakened",
     message: `This diff weakens the enforcement surface \u2014 ${weakenings.length} sensor change(s) need review: ` + weakenings.slice(0, 5).map((w) => `${w.memory_id} (${w.change}: ${w.detail})`).join(", ") + (weakenings.length > 5 ? ", \u2026" : "") + ".",
-    fix: "If the demotion/removal is intentional, say so in the commit message; otherwise restore the sensor (`hivelore sensors list` shows the current state).",
+    fix: "If intentional, add `Hivelore-Sensor-Change: <memory-id>` to the commit message and set `HIVELORE_SENSOR_WEAKENING_APPROVALS=<memory-id>` for the local commit hook; otherwise restore the sensor.",
     memory_ids: [...new Set(weakenings.map((w) => w.memory_id))].slice(0, 10),
     impact: config.enforcement?.sensorWeakeningGate === "block" ? 30 : 8
   }] : [];
+  if (approvedWeakenings.length > 0) {
+    weakeningFindings.push({
+      severity: "ok",
+      code: "sensor-weakening-approved",
+      message: `Reviewed sensor change(s) approved for ${[...new Set(approvedWeakenings.map((w) => w.memory_id))].join(", ")}.`,
+      memory_ids: [...new Set(approvedWeakenings.map((w) => w.memory_id))]
+    });
+  }
   if (gate === "off") {
     return [
       { severity: "info", code: "precommit-policy-off", message: "Anti-pattern gate is disabled (enforcement.antiPatternGate=off)." },
@@ -11337,6 +11449,7 @@ async function runPrecommitPolicy(paths, gate, stage, config) {
     } catch {
     }
   }
+  const noticeFinding = result.notice ? [{ severity: "info", code: "precommit-policy-notice", message: result.notice }] : [];
   if (!result.should_block) {
     return [
       {
@@ -11344,6 +11457,7 @@ async function runPrecommitPolicy(paths, gate, stage, config) {
         code: "precommit-policy-pass",
         message: `${stage === "ci" ? "CI" : "Pre-commit"} policy passed for ${touchedPaths.length} changed file(s).`
       },
+      ...noticeFinding,
       ...reviewFinding,
       ...sensorFindings,
       ...weakeningFindings
@@ -11360,11 +11474,34 @@ async function runPrecommitPolicy(paths, gate, stage, config) {
       memory_ids: blockingWarnings.slice(0, 10).map((w) => w.id),
       impact: 45
     },
+    ...noticeFinding,
     ...reviewFinding,
     ...sensorFindings,
     ...weakeningFindings
   ];
 }
+function parseSensorWeakeningApprovals(text) {
+  const approved = /* @__PURE__ */ new Set();
+  if (!text) return approved;
+  const trailer = /^Hivelore-Sensor-Change:\s*(.+)$/gmi;
+  for (const match of text.matchAll(trailer)) {
+    for (const id of (match[1] ?? "").split(/[\s,]+/)) if (id) approved.add(id);
+  }
+  if (!text.includes("Hivelore-Sensor-Change:")) {
+    for (const id of text.split(/[\s,]+/)) if (id) approved.add(id);
+  }
+  return approved;
+}
+async function resolveSensorWeakeningApprovals(root, stage) {
+  const approved = parseSensorWeakeningApprovals(process.env["HIVELORE_SENSOR_WEAKENING_APPROVALS"]);
+  if (stage !== "ci") return approved;
+  try {
+    const { stdout } = await execFileAsync2("git", ["log", "-1", "--pretty=%B"], { cwd: root });
+    for (const id of parseSensorWeakeningApprovals(stdout)) approved.add(id);
+  } catch {
+  }
+  return approved;
+}
 async function stagedFileContent(root, rel) {
   try {
     return await runCommand2("git", ["show", `:${rel}`], root);
@@ -12632,6 +12769,7 @@ import {
   addedLineNumbersFromDiff as addedLineNumbersFromDiff2,
   buildProposeCommand,
   scaffoldPostIncidentTest,
+  incidentHintsFromDiff,
   selectCommandSensors as selectCommandSensors2,
   TEST_FRAMEWORKS,
   sensorPatternBrittleness as sensorPatternBrittleness2,
@@ -12642,6 +12780,14 @@ import {
   withoutQuarantineNote
 } from "@hivelore/core";
 var exec5 = promisify7(execFile7);
+function rejectProposal(opts, reason, guidance) {
+  if (opts.json) console.log(JSON.stringify({ accepted: false, reason, guidance }, null, 2));
+  else {
+    ui.error(`Rejected (${reason}).`);
+    ui.warn(guidance);
+  }
+  process.exitCode = 1;
+}
 function registerSensors(program2) {
   const sensors = program2.command("sensors").description("Operate executable sensors derived from Hivelore memories");
   sensors.command("list").description("List memories carrying executable sensors").option("--json", "emit JSON", false).option("-d, --dir <dir>", "project root").action(async (opts) => {
@@ -12682,7 +12828,10 @@ function registerSensors(program2) {
     const targets = scannableSensorTargets(diff);
     const hits = runSensors2(memories, targets);
     const astMemories = (await runnableSensorMemories(paths, false)).filter(
-      (m) => m.frontmatter.sensor?.kind === "ast" && m.frontmatter.sensor.pattern
+      (m) => {
+        const sensor = m.frontmatter.sensor;
+        return sensor?.kind === "ast" && Boolean(sensor.pattern || sensor.rule);
+      }
     );
     const astHits = [];
     let astUnrunnable = 0;
@@ -12930,16 +13079,14 @@ function registerSensors(program2) {
   });
   sensors.command("propose").description(
     "Propose a discriminating sensor for a memory \u2014 you write the pattern, Hivelore validates it before\n  trusting it to block. Mirrors the MCP `propose_sensor` tool (the agent-authored path).\n\n  A `block` proposal is accepted ONLY if it is not brittle, stays SILENT on the current code,\n  and FIRES on the bad example. Rejected proposals are not written \u2014 fix and re-run.\n\n  Example:\n    hivelore sensors propose <memory-id> \\\n      --pattern 'stripe\\.paymentIntents\\.create' --absent 'idempotencyKey' \\\n      --bad-example 'stripe.paymentIntents.create({ amount })'"
-  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | ast (structural \u2014 comments/strings can't false-positive) | shell | test (route the team's own oracle)", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--rule <json>", "kind=ast: full ast-grep Rule JSON (kind/inside/has/not/all/any)").option("--language <name>", "kind=ast: explicit language for non-standard extensions").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--red-ref <ref>", "kind=shell|test: pre-fix commit/ref \u2014 validation replays it in a scratch worktree and requires the oracle to FAIL there (records red_proven)").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
+  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | ast (structural \u2014 comments/strings can't false-positive) | shell | test (route the team's own oracle)", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--rule <json>", "kind=ast: full ast-grep Rule JSON (kind/inside/has/not/all/any)").option("--language <name>", "kind=ast: explicit language for non-standard extensions").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--red-ref <ref>", "kind=shell|test: pre-fix commit/ref \u2014 validation replays it in a scratch worktree and requires the oracle to FAIL there (records red_proven)").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("--json", "emit a machine-readable proposal verdict", false).option("-d, --dir <dir>", "project root").action(async (id, opts) => {
     if (opts.kind === "shell" || opts.kind === "test" || opts.kind === "ast") {
       if ((opts.kind === "shell" || opts.kind === "test") && !opts.command?.trim()) {
-        ui.error("--kind shell|test requires --command.");
-        process.exitCode = 1;
+        rejectProposal(opts, "missing-command", "--kind shell|test requires --command.");
         return;
       }
       if (opts.kind === "ast" && !opts.pattern?.trim() && !opts.rule?.trim()) {
-        ui.error("--kind ast requires --pattern or --rule <json>.");
-        process.exitCode = 1;
+        rejectProposal(opts, "missing-ast-rule", "--kind ast requires --pattern or --rule <json>.");
         return;
       }
       let astRule;
@@ -12949,13 +13096,12 @@ function registerSensors(program2) {
           if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("rule must be a JSON object");
           astRule = parsed;
         } catch (err) {
-          ui.error(`--rule must be valid ast-grep Rule JSON: ${err instanceof Error ? err.message : String(err)}`);
-          process.exitCode = 1;
+          rejectProposal(opts, "invalid-ast-rule", `--rule must be valid ast-grep Rule JSON: ${err instanceof Error ? err.message : String(err)}`);
           return;
         }
       }
       const root2 = findProjectRoot39(opts.dir);
-      const { proposeSensor } = await import("./server-WW6JHBYY.js");
+      const { proposeSensor } = await import("./server-V3ZGBTAG.js");
       const out = await proposeSensor(
         {
           memory_id: id,
@@ -12976,6 +13122,11 @@ function registerSensors(program2) {
         },
         { paths: resolveHaivePaths36(root2) }
       );
+      if (opts.json) {
+        console.log(JSON.stringify(out, null, 2));
+        if (!out.accepted) process.exitCode = 1;
+        return;
+      }
       if (out.accepted) {
         ui.success(`${opts.kind === "ast" ? "AST" : "Command"} sensor accepted (${out.severity}) on ${id}`);
         ui.info(`  ${out.guidance}`);
@@ -12987,8 +13138,7 @@ function registerSensors(program2) {
       return;
     }
     if (!opts.pattern?.trim()) {
-      ui.error("kind=regex requires --pattern.");
-      process.exitCode = 1;
+      rejectProposal(opts, "missing-pattern", "kind=regex requires --pattern.");
       return;
     }
     const severity = opts.severity === "warn" ? "warn" : "block";
@@ -12996,8 +13146,7 @@ function registerSensors(program2) {
       new RegExp(opts.pattern, opts.flags ?? "");
       if (opts.absent) new RegExp(opts.absent, opts.flags ?? "");
     } catch (err) {
-      ui.error(`Invalid regex: ${String(err)}`);
-      process.exitCode = 1;
+      rejectProposal(opts, "invalid-regex", `Invalid regex: ${String(err)}`);
       return;
     }
     const root = findProjectRoot39(opts.dir);
@@ -13005,8 +13154,7 @@ function registerSensors(program2) {
     const loaded = existsSync44(paths.memoriesDir) ? await loadMemoriesFromDir16(paths.memoriesDir) : [];
     const found = loaded.find(({ memory: memory2 }) => memory2.frontmatter.id === id);
     if (!found) {
-      ui.error(`No memory found with id ${id}`);
-      process.exitCode = 1;
+      rejectProposal(opts, "memory-not-found", `No memory found with id ${id}`);
       return;
     }
     const anchorPaths = opts.paths ? opts.paths.split(",").map((s) => s.trim()).filter(Boolean) : found.memory.frontmatter.anchor.paths;
@@ -13028,6 +13176,18 @@ function registerSensors(program2) {
       last_fired: null
     };
     const verdict = judgeProposedSensor(sensor, { currentTargets, badExamples });
+    if (opts.json && !verdict.accepted) {
+      console.log(JSON.stringify({
+        accepted: verdict.accepted,
+        reason: verdict.reason ?? null,
+        severity,
+        memory_id: id,
+        self_check: verdict.self_check,
+        brittle: verdict.brittle
+      }, null, 2));
+      if (!verdict.accepted) process.exitCode = 1;
+      return;
+    }
     if (!verdict.accepted) {
       ui.error(`Rejected (${verdict.reason}).`);
       if (verdict.reason === "fires-on-current") {
@@ -13041,6 +13201,17 @@ function registerSensors(program2) {
       return;
     }
     await writeFile27(found.filePath, serializeMemory15({ frontmatter: { ...found.memory.frontmatter, sensor }, body: found.memory.body }), "utf8");
+    if (opts.json) {
+      console.log(JSON.stringify({
+        accepted: true,
+        reason: null,
+        severity,
+        memory_id: id,
+        self_check: verdict.self_check,
+        brittle: verdict.brittle
+      }, null, 2));
+      return;
+    }
     ui.success(`Sensor accepted (${severity}) on ${id}`);
     ui.info(`pattern=${JSON.stringify(opts.pattern)}${opts.absent ? `  absent=${JSON.stringify(opts.absent)}` : ""}`);
     ui.info(
@@ -13054,7 +13225,10 @@ function registerSensors(program2) {
   });
   sensors.command("scaffold").description(
     "Generate a PENDING post-incident test from a lesson (mem_tried/attempt/gotcha) \u2014 the on-ramp to\n  a command sensor. Writes a test stub carrying the incident's provenance, then prints the exact\n  `sensors propose --kind test` line to arm it once you've written the assertion. It never arms a\n  sensor itself \u2014 propose_sensor stays the sole validated writer.\n\n  Example:\n    hivelore sensors scaffold 2026-07-03-attempt-refund-exceeds-capture --framework vitest"
-  ).argument("<memory-id>", "lesson id to scaffold a test from").option("--framework <fw>", `test framework: ${TEST_FRAMEWORKS.join(" | ")} (auto-detected when omitted)`).option("--out <path>", "override the generated test file path (project-relative)").option("--stdout", "print the test to stdout instead of writing a file", false).option("--force", "overwrite an existing file at the target path", false).option("-d, --dir <dir>", "project root").action(async (id, opts) => {
+  ).argument("<memory-id>", "lesson id to scaffold a test from").option("--framework <fw>", `test framework: ${TEST_FRAMEWORKS.join(" | ")} (auto-detected when omitted)`).option("--out <path>", "override the generated test file path (project-relative)").option("--stdout", "print the test to stdout instead of writing a file", false).option("--force", "overwrite an existing file at the target path", false).option(
+    "--red-ref <ref>",
+    "pre-fix incident commit/ref: the scaffold names the symbols the fix (<ref>..HEAD) touched and pre-fills the example around them, so the assertion is a targeted edit, not a blank page"
+  ).option("-d, --dir <dir>", "project root").action(async (id, opts) => {
     const root = findProjectRoot39(opts.dir);
     const paths = resolveHaivePaths36(root);
     const loaded = existsSync44(paths.memoriesDir) ? await loadMemoriesFromDir16(paths.memoriesDir) : [];
@@ -13074,13 +13248,28 @@ function registerSensors(program2) {
     const allGroups = await detectTestFrameworksForAnchors(root, fm.anchor.paths ?? []);
     const groups = opts.out ? allGroups.slice(0, 1) : allGroups;
     const fields = parseLessonFields(found.memory.body);
+    let incidentHints;
+    if (opts.redRef) {
+      try {
+        const args = ["diff", `${opts.redRef}`, "HEAD", "--", ...fm.anchor.paths ?? []];
+        const { stdout } = await exec5("git", args, { cwd: root, maxBuffer: 64 * 1024 * 1024 });
+        incidentHints = incidentHintsFromDiff(stdout, { redRef: opts.redRef });
+        if (incidentHints.changedSymbols.length === 0 && incidentHints.changedFiles.length === 0) {
+          ui.warn(`--red-ref ${opts.redRef}: no changed symbols found in the anchor scope \u2014 using the generic template.`);
+          incidentHints = void 0;
+        }
+      } catch (err) {
+        ui.warn(`--red-ref ${opts.redRef}: could not read the fix diff (${err instanceof Error ? err.message : String(err)}) \u2014 using the generic template.`);
+      }
+    }
     const lesson = {
       memoryId: id,
       title: fields.title || id,
       whyFailed: fields.whyFailed,
       instead: fields.instead,
       incident: fm.sensor?.incident,
-      paths: fm.anchor.paths
+      paths: fm.anchor.paths,
+      incidentHints
     };
     let scaffolds = groups.map(
       (g) => scaffoldPostIncidentTest(lesson, { framework: forced ?? g.framework, outPath: opts.out, baseDir: g.baseDir })
@@ -13183,7 +13372,7 @@ async function runnableSensorMemories(paths, regexOnly = true) {
 }
 async function stagedDiff(root) {
   try {
-    const { stdout } = await exec5("git", ["diff", "--cached"], { cwd: root });
+    const { stdout } = await exec5("git", ["diff", "--cached"], { cwd: root, maxBuffer: 256 * 1024 * 1024 });
     return stdout;
   } catch (err) {
     throw new Error(`git diff --cached failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -13961,7 +14150,7 @@ function registerBridges(program2) {
 
 // src/index.ts
 var program = new Command48();
-program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.43.2").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
+program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.46.0").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
 registerInit(program);
 registerResolveProject(program);
 registerEnforce(program);
@@ -14051,7 +14240,7 @@ program.parseAsync(process.argv).catch((err) => {
       console.error(`\x1B[31m\u2717\x1B[0m ${field}${issue.message}`);
     }
   } else {
-    console.error(err instanceof Error ? err.message : err);
+    console.error(err instanceof Error ? process.env.HIVELORE_DEBUG ? err.stack ?? err.message : err.message : err);
   }
   process.exit(1);
 });