@hivelore/core 0.39.2 → 0.43.2

package/dist/index.js

@@ -28,9 +28,18 @@ var AnchorSchema = z.object({
   symbols: z.array(z.string()).default([])
 });
 var SensorSchema = z.object({
-  kind: z.enum(["regex", "shell", "test"]).default("regex"),
-  /** Regex source (for kind=regex), matched against added diff lines / file content. */
+  kind: z.enum(["regex", "ast", "shell", "test"]).default("regex"),
+  /**
+   * kind=regex: regex source, matched against added diff lines / file content.
+   * kind=ast: an ast-grep structural pattern (e.g. `stripe.paymentIntents.create($$$)`) — matched
+   * on the AST of changed files, so comments and string literals can never false-positive. Requires
+   * the optional `@ast-grep/napi` engine; without it the sensor is unrunnable (warn, never block).
+   */
   pattern: z.string().optional(),
+  /** kind=ast: full ast-grep Rule object (`kind`, `inside`, `has`, `not`, `all`, `any`, …). */
+  rule: z.record(z.unknown()).optional(),
+  /** kind=ast: explicit language name for extensionless/non-standard files (e.g. python, go). */
+  language: z.string().optional(),
   /**
    * Optional "correct-usage" regex (kind=regex). When `pattern` (the risky call) matches but this
    * regex ALSO appears within a small window around the match, the catch is SUPPRESSED — the diff
@@ -56,6 +65,13 @@ var SensorSchema = z.object({
    * the incident the test exists to prevent". Surfaced in the block message and the prevention receipt.
    */
   incident: z.string().optional(),
+  /**
+   * kind=shell|test only: the oracle was PROVEN to fail (RED) on the incident state at arming time
+   * (`sensors propose --red-ref`): the command passed on the presumed-correct tree AND failed on
+   * the replayed incident tree. Distinguishes "a test is routed" from "the test demonstrably
+   * catches the incident". Surfaced in the prevention receipt.
+   */
+  red_proven: z.boolean().optional(),
   /** `warn` surfaces in review; `block` can hard-block the commit (only when the gate opts in). */
   severity: z.enum(["warn", "block"]).default("warn"),
   /** True when Hivelore generated this sensor automatically (vs. hand-authored). */
@@ -951,10 +967,11 @@ function buildPreventionReceipt(events, memories, usage, options) {
       stage: event.stage ?? null,
       exit_code: event.exit_code ?? null,
       message: sensor?.message ?? null,
-      incident: sensor?.incident ?? null
+      incident: sensor?.incident ?? null,
+      red_proven: sensor?.red_proven === true
     };
   }).sort((a, b) => b.at.localeCompare(a.at));
-  const preventedCountTotal = Object.values(usage.by_id).reduce((sum, item) => sum + item.prevented_count, 0);
+  const preventedCountTotal = Object.values(usage.by_id).reduce((sum, item) => sum + (item.prevented_count ?? 0), 0);
   return {
     generated_at: now.toISOString(),
     since: options.since.toISOString(),
@@ -976,7 +993,8 @@ function renderPreventionReceipt(receipt) {
     const exit = row.exit_code === null ? "" : `, exit ${row.exit_code}`;
     const stage = row.stage ? ` \u2014 caught at ${row.stage}` : "";
     const incident = row.incident ? `  \u21A9 incident: ${row.incident}` : "";
-    lines.push(`  \u2717\u2192\u2713 ${row.at.slice(0, 10)}  ${row.id.padEnd(32)} (${kind}${exit}${stage})${incident}`);
+    const red = row.red_proven ? "  \u2713 RED-proven" : "";
+    lines.push(`  \u2717\u2192\u2713 ${row.at.slice(0, 10)}  ${row.id.padEnd(32)} (${kind}${exit}${stage})${incident}${red}`);
   }
   lines.push(
     `  Trend: ${receipt.total} this window vs ${receipt.previous_total} previous window (${receipt.total <= receipt.previous_total ? "recurrences declining" : "recurrences rising"}).`
@@ -1175,6 +1193,43 @@ async function recordProjectContextEmission(paths, hash, now = Date.now()) {
   });
 }
 
+// src/priority.ts
+var DEFAULT_PRIORITY_SIGNALS = {
+  type: "",
+  tags: [],
+  requiresHumanApproval: false,
+  directAnchor: false,
+  directSymbol: false,
+  exactTaskMatch: false,
+  strongSemantic: false,
+  usefulSemantic: false,
+  moduleOrDomainMatch: false,
+  tagTaskMatch: false
+};
+function prioritySignals(partial) {
+  return { ...DEFAULT_PRIORITY_SIGNALS, ...partial };
+}
+function classifyMemoryPriority(signals) {
+  const isNegative = signals.type === "attempt";
+  const isSkill2 = signals.type === "skill";
+  if (signals.requiresHumanApproval || signals.directAnchor || signals.directSymbol || isNegative && (signals.exactTaskMatch || signals.strongSemantic) || isSkill2 && (signals.exactTaskMatch || signals.strongSemantic)) {
+    return "must_read";
+  }
+  if (isStackPackSeed({ tags: signals.tags }) || isEnvWorkaroundMemory({ tags: signals.tags })) {
+    if (isStackPackSeed({ tags: signals.tags }) && (signals.exactTaskMatch || signals.strongSemantic)) {
+      return "useful";
+    }
+    return "background";
+  }
+  if (isSkill2 || signals.moduleOrDomainMatch || signals.exactTaskMatch || signals.usefulSemantic || signals.tagTaskMatch) {
+    return "useful";
+  }
+  return "background";
+}
+function priorityRank(priority) {
+  return priority === "must_read" ? 3 : priority === "useful" ? 2 : 1;
+}
+
 // src/eval.ts
 function round32(n) {
   return Math.round(n * 1e3) / 1e3;
@@ -1302,6 +1357,69 @@ function synthesizeSelfEvalCases(memories, options = {}) {
   }
   return cases;
 }
+function appendProposedRetrievalCases(specRaw, cases) {
+  let spec = {};
+  if (specRaw?.trim()) {
+    try {
+      spec = JSON.parse(specRaw);
+    } catch {
+      spec = {};
+    }
+  }
+  const existingNames = /* @__PURE__ */ new Set([
+    ...(spec.retrieval ?? []).map((c) => c.name),
+    ...(spec.proposed_retrieval ?? []).map((c) => c.name)
+  ]);
+  const fresh = cases.filter((c) => !existingNames.has(c.name));
+  if (fresh.length > 0) spec.proposed_retrieval = [...spec.proposed_retrieval ?? [], ...fresh];
+  return JSON.stringify(spec, null, 2) + "\n";
+}
+function approveProposedCases(specRaw) {
+  let spec;
+  try {
+    spec = JSON.parse(specRaw);
+  } catch {
+    return { raw: specRaw, approved: 0 };
+  }
+  const proposed = spec.proposed_retrieval ?? [];
+  if (proposed.length === 0) return { raw: specRaw, approved: 0 };
+  spec.retrieval = [...spec.retrieval ?? [], ...proposed];
+  delete spec.proposed_retrieval;
+  return { raw: JSON.stringify(spec, null, 2) + "\n", approved: proposed.length };
+}
+function runTierContract() {
+  const cases = [
+    {
+      name: "stack-pack seed + strong task evidence \u2192 useful (rescue path stays alive)",
+      expected: "useful",
+      signals: prioritySignals({ type: "convention", tags: ["stack-pack"], strongSemantic: true, usefulSemantic: true })
+    },
+    {
+      name: "stack-pack seed + weak evidence \u2192 background (crowding guard stays)",
+      expected: "background",
+      signals: prioritySignals({ type: "convention", tags: ["stack-pack"], usefulSemantic: true, tagTaskMatch: true })
+    },
+    {
+      name: "env workaround + strong evidence \u2192 background (hard cap stays)",
+      expected: "background",
+      signals: prioritySignals({ type: "gotcha", tags: ["dev-env"], strongSemantic: true, exactTaskMatch: true })
+    },
+    {
+      name: "direct anchor \u2192 must_read (anchors always win)",
+      expected: "must_read",
+      signals: prioritySignals({ type: "convention", directAnchor: true })
+    },
+    {
+      name: "attempt + exact task match \u2192 must_read (negative knowledge first)",
+      expected: "must_read",
+      signals: prioritySignals({ type: "attempt", exactTaskMatch: true })
+    }
+  ];
+  return cases.map(({ name, expected, signals }) => {
+    const actual = classifyMemoryPriority(signals);
+    return { name, expected, actual, pass: actual === expected };
+  });
+}
 
 // src/confidence.ts
 var DEFAULT_CONFIDENCE_THRESHOLDS = {
@@ -2445,6 +2563,8 @@ var DEFAULT_CONFIG = {
     antiPatternGate: "anchored",
     bootstrapGate: "block",
     humanCommits: "relaxed",
+    commandSensorUnrunnable: "warn",
+    sensorWeakeningGate: "warn",
     scoreThreshold: 80,
     cleanupGeneratedArtifacts: true,
     toolProfile: "enforcement",
@@ -2479,6 +2599,8 @@ var AUTOPILOT_DEFAULTS = {
     antiPatternGate: "anchored",
     bootstrapGate: "block",
     humanCommits: "relaxed",
+    commandSensorUnrunnable: "warn",
+    sensorWeakeningGate: "warn",
     scoreThreshold: 85,
     cleanupGeneratedArtifacts: true,
     toolProfile: "enforcement",
@@ -3958,6 +4080,34 @@ function runSensors(memories, targets) {
   }
   return hits;
 }
+var COMMAND_ENV_EXACT = /* @__PURE__ */ new Set([
+  "PATH",
+  "HOME",
+  "LANG",
+  "LANGUAGE",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "TERM",
+  "SHELL",
+  "USER",
+  "LOGNAME",
+  "PWD",
+  "CI",
+  "COLORTERM",
+  "TZ"
+]);
+var COMMAND_ENV_PREFIXES = ["LC_", "NODE_", "NVM_", "npm_", "HIVELORE_", "HAIVE_"];
+function scrubbedCommandEnv(env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value === void 0) continue;
+    if (COMMAND_ENV_EXACT.has(key) || COMMAND_ENV_PREFIXES.some((p) => key.startsWith(p))) {
+      out[key] = value;
+    }
+  }
+  return out;
+}
 function incidentSuffix(incident) {
   const ref = incident?.trim();
   return ref ? `  \u21A9 guards incident: ${ref}` : "";
@@ -3986,6 +4136,34 @@ function selectCommandSensors(memories, changedPaths) {
   }
   return specs;
 }
+function addedLineNumbersFromDiff(diff) {
+  const result = /* @__PURE__ */ new Map();
+  let currentPath = null;
+  let newLine = 0;
+  for (const line of diff.split("\n")) {
+    if (line.startsWith("+++ ")) {
+      const raw = line.slice(4).trim();
+      currentPath = raw === "/dev/null" ? null : normalizeProjectPath(raw);
+      continue;
+    }
+    const hunk = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+    if (hunk) {
+      newLine = Number(hunk[1]);
+      continue;
+    }
+    if (!currentPath) continue;
+    if (line.startsWith("+") && !line.startsWith("+++")) {
+      let set = result.get(currentPath);
+      if (!set) result.set(currentPath, set = /* @__PURE__ */ new Set());
+      set.add(newLine);
+      newLine++;
+    } else if (line.startsWith("-") && !line.startsWith("---")) {
+    } else if (!line.startsWith("\\")) {
+      newLine++;
+    }
+  }
+  return result;
+}
 function sensorTargetsFromDiff(diff) {
   const targets = [];
   let currentPath = null;
@@ -4050,6 +4228,7 @@ function diffFileChanges(diff) {
       const newPath = raw === "/dev/null" ? null : normalizeProjectPath(raw);
       current = {
         path: newPath ?? oldPath ?? "",
+        created: oldPath === null && newPath !== null,
         deleted: newPath === null,
         removed: [],
         added: []
@@ -4077,6 +4256,7 @@ function detectSensorWeakening(diff) {
       weakenings.push({ file: file.path, memory_id: memoryId, change, detail });
     };
     const removedBlockSeverity = file.removed.some((l) => SEVERITY_BLOCK_RE.test(l));
+    if (file.created) continue;
     if (file.deleted) {
       if (file.removed.some((l) => SENSOR_BLOCK_START_RE.test(l)) && removedBlockSeverity) {
         flag("memory-deleted", "memory file with a block sensor deleted");
@@ -4099,7 +4279,10 @@ function detectSensorWeakening(diff) {
     }
     const removedAbsent = file.removed.find((l) => SENSOR_ABSENT_KEY_RE.test(l));
     const addedAbsent = file.added.find((l) => SENSOR_ABSENT_KEY_RE.test(l));
-    if (addedAbsent !== void 0 && addedAbsent.trim() !== removedAbsent?.trim()) {
+    const addingNewSensorBlock = file.added.some((l) => SENSOR_BLOCK_START_RE.test(l)) && !file.removed.some(
+      (l) => SENSOR_BLOCK_START_RE.test(l) || SENSOR_ORACLE_KEY_RE.test(l) || SEVERITY_BLOCK_RE.test(l) || SEVERITY_WARN_RE.test(l)
+    );
+    if (!addingNewSensorBlock && addedAbsent !== void 0 && addedAbsent.trim() !== removedAbsent?.trim()) {
       flag("suppression-broadened", removedAbsent === void 0 ? "absent marker added" : "absent marker changed");
     }
     if (file.removed.some((l) => SENSOR_BLOCK_START_RE.test(l)) && removedBlockSeverity && !file.added.some((l) => SENSOR_BLOCK_START_RE.test(l))) {
@@ -5407,6 +5590,33 @@ function findUncapturedFailures(failures, captureTimes, options = {}) {
   out.sort((a, b) => a.ts.localeCompare(b.ts));
   return out;
 }
+var EXPLORATORY_RE = /^(ls|find|grep|rg|cat|head|tail|which|stat)\b/i;
+function distillFailureObservations(failures, options = {}) {
+  const max = options.max ?? 3;
+  const clusters = /* @__PURE__ */ new Map();
+  for (const f of failures) {
+    const summary = f.summary.trim();
+    if (!summary || EXPLORATORY_RE.test(summary.replace(/^Bash:\s*/i, ""))) continue;
+    const key = normalizeSummary(summary);
+    const existing = clusters.get(key);
+    if (existing) {
+      existing.count++;
+      for (const file of f.files ?? []) existing.files.add(file);
+    } else {
+      clusters.set(key, { first: f, count: 1, files: new Set(f.files ?? []) });
+    }
+  }
+  return [...clusters.values()].sort((a, b) => b.count - a.count || b.first.ts.localeCompare(a.first.ts)).slice(0, max).map(({ first, count, files }) => {
+    const summary = first.summary.trim();
+    const firstLine = summary.split("\n")[0].slice(0, 120);
+    return {
+      what: `${first.tool} failed: ${firstLine}`,
+      why_failed: summary.slice(0, 400),
+      paths: [...files].slice(0, 6),
+      occurrences: count
+    };
+  });
+}
 
 // src/coverage.ts
 var DEFAULT_COVERING_TYPES = ["decision", "convention", "gotcha", "architecture"];
@@ -5906,43 +6116,6 @@ async function handoffAgeMs(root, now = /* @__PURE__ */ new Date()) {
   }
 }
 
-// src/priority.ts
-var DEFAULT_PRIORITY_SIGNALS = {
-  type: "",
-  tags: [],
-  requiresHumanApproval: false,
-  directAnchor: false,
-  directSymbol: false,
-  exactTaskMatch: false,
-  strongSemantic: false,
-  usefulSemantic: false,
-  moduleOrDomainMatch: false,
-  tagTaskMatch: false
-};
-function prioritySignals(partial) {
-  return { ...DEFAULT_PRIORITY_SIGNALS, ...partial };
-}
-function classifyMemoryPriority(signals) {
-  const isNegative = signals.type === "attempt";
-  const isSkill2 = signals.type === "skill";
-  if (signals.requiresHumanApproval || signals.directAnchor || signals.directSymbol || isNegative && (signals.exactTaskMatch || signals.strongSemantic) || isSkill2 && (signals.exactTaskMatch || signals.strongSemantic)) {
-    return "must_read";
-  }
-  if (isStackPackSeed({ tags: signals.tags }) || isEnvWorkaroundMemory({ tags: signals.tags })) {
-    if (isStackPackSeed({ tags: signals.tags }) && (signals.exactTaskMatch || signals.strongSemantic)) {
-      return "useful";
-    }
-    return "background";
-  }
-  if (isSkill2 || signals.moduleOrDomainMatch || signals.exactTaskMatch || signals.usefulSemantic || signals.tagTaskMatch) {
-    return "useful";
-  }
-  return "background";
-}
-function priorityRank(priority) {
-  return priority === "must_read" ? 3 : priority === "useful" ? 2 : 1;
-}
-
 // src/agent-context.ts
 var AGENT_ENV_SIGNALS = [
   { name: "HAIVE_SESSION_ID", label: "hivelore-run-wrapper" },
@@ -5960,6 +6133,92 @@ function detectAgentContext(env = typeof process !== "undefined" ? process.env :
   const signals = AGENT_ENV_SIGNALS.filter(({ name }) => (env[name] ?? "").trim().length > 0).map(({ name, label }) => `${label} (${name})`);
   return { agent: signals.length > 0, signals: [...new Set(signals)] };
 }
+
+// src/pr-review-ingest.ts
+var REVIEW_LEARNING_MARKER = /(^|\s)\/?hivelore[:,]?\s+remember\b|(^|\s)hivelore:/i;
+var INSTRUCTION_RE = /\b(never|always|don'?t|do not|must(?: not)?|should(?: not|n'?t)?|avoid|prefer|instead of|use\s+\S+\s+instead)\b/i;
+var MAX_INSTRUCTION_CHARS = 500;
+var MIN_INSTRUCTION_CHARS = 12;
+function prNumberFrom(comment) {
+  const m = comment.pull_request_url?.match(/\/pulls\/(\d+)$/);
+  return m ? Number(m[1]) : void 0;
+}
+function extractReviewLearnings(payload) {
+  if (!Array.isArray(payload)) return [];
+  const comments = payload;
+  const learnings = [];
+  for (const comment of comments) {
+    if (typeof comment?.id !== "number") continue;
+    if ((comment.user?.type ?? "").toLowerCase() === "bot") continue;
+    const body = (comment.body ?? "").trim();
+    if (body.length < MIN_INSTRUCTION_CHARS) continue;
+    const marked = REVIEW_LEARNING_MARKER.test(body);
+    if (!marked && !INSTRUCTION_RE.test(body)) continue;
+    const instruction = body.replace(REVIEW_LEARNING_MARKER, " ").replace(/\s+/g, " ").trim().slice(0, MAX_INSTRUCTION_CHARS);
+    if (instruction.length < MIN_INSTRUCTION_CHARS) continue;
+    learnings.push({
+      thread_id: comment.in_reply_to_id ?? comment.id,
+      comment_id: comment.id,
+      ...comment.path ? { path: comment.path } : {},
+      ...typeof (comment.line ?? comment.original_line) === "number" ? { line: comment.line ?? comment.original_line } : {},
+      author: comment.user?.login ?? "reviewer",
+      instruction,
+      ...comment.html_url ? { url: comment.html_url } : {},
+      ...prNumberFrom(comment) !== void 0 ? { pr_number: prNumberFrom(comment) } : {}
+    });
+  }
+  return learnings;
+}
+function reviewLearningsToDrafts(learnings, options = {}) {
+  const limit = options.limit ?? 20;
+  const drafts = [];
+  const seenThreads = /* @__PURE__ */ new Set();
+  for (const learning of learnings) {
+    if (drafts.length >= limit) break;
+    if (seenThreads.has(learning.thread_id)) {
+      const idx = drafts.findIndex((d) => d.key === `github-pr:${learning.thread_id}`);
+      if (idx >= 0) drafts.splice(idx, 1);
+    }
+    seenThreads.add(learning.thread_id);
+    const key = `github-pr:${learning.thread_id}`;
+    const slugSource = learning.instruction.toLowerCase().replace(/[^a-z0-9\s]/g, " ");
+    const slug = slugSource.trim().split(/\s+/).slice(0, 6).join("-") || "review-learning";
+    const finding = {
+      tool: "github-pr",
+      ruleId: "review-learning",
+      severity: "major",
+      message: learning.instruction,
+      path: learning.path ?? "",
+      ...learning.line !== void 0 ? { line: learning.line } : {},
+      key
+    };
+    const baseFm = buildFrontmatter({
+      type: "convention",
+      slug,
+      scope: options.scope ?? "team",
+      module: options.module,
+      tags: ["review-learning"],
+      paths: learning.path ? [learning.path] : [],
+      author: options.author ?? learning.author
+    });
+    const frontmatter = { ...baseFm, status: "proposed", topic: `ingest:${key}` };
+    const provenance = [
+      learning.pr_number !== void 0 ? `PR #${learning.pr_number}` : null,
+      `@${learning.author}`,
+      learning.url ?? null
+    ].filter(Boolean).join(" \xB7 ");
+    const body = `# Review learning: ${learning.instruction.slice(0, 80)}
+
+${learning.instruction}
+
+` + (learning.path ? `Applies to: \`${learning.path}\`${learning.line !== void 0 ? ` (line ${learning.line} at review time)` : ""}
+
+` : "") + `_From a review thread (${provenance}). Review: approve, refine, or reject \u2014 then consider \`hivelore sensors propose\` to make it a deterministic gate._
+`;
+    drafts.push({ key, topic: `ingest:${key}`, frontmatter, body, finding, has_sensor: false });
+  }
+  return drafts;
+}
 export {
   AUTOPILOT_DEFAULTS,
   ActivationSchema,
@@ -5998,6 +6257,7 @@ export {
   PREVENTION_DEBOUNCE_MS,
   PROJECT_CONTEXT_FILE,
   PROJECT_CONTEXT_THROTTLE_MS,
+  REVIEW_LEARNING_MARKER,
   RUNTIME_JOURNAL_FILENAME,
   SCAFFOLD_MARKER_RE,
   SEED_QUALITY_FLOOR,
@@ -6010,6 +6270,7 @@ export {
   USAGE_FILE,
   USAGE_LOG_DIR,
   USAGE_LOG_FILE,
+  addedLineNumbersFromDiff,
   addedLinesFromDiff,
   aggregateRetrieval,
   aggregateSensors,
@@ -6018,11 +6279,13 @@ export {
   antiPatternGateParams,
   appendEvalHistory,
   appendPreventionEvent,
+  appendProposedRetrievalCases,
   appendRuntimeJournalEntry,
   appendSensorEvaluations,
   appendUsageEvent,
   applyConflictResolution,
   applyFeedbackAdjustment,
+  approveProposedCases,
   assessBootstrapState,
   assessScaffoldLoop,
   assessSensorHealth,
@@ -6064,6 +6327,7 @@ export {
   detectStacksFromManifests,
   diffContract,
   diffHasDistinctiveOverlap,
+  distillFailureObservations,
   distinctiveCap,
   draftsFromFindings,
   emptyUsage,
@@ -6075,6 +6339,7 @@ export {
   existingGateMissShas,
   extractActionsBriefBody,
   extractReferencedPaths,
+  extractReviewLearnings,
   extractSensorExamples,
   extractSnippet,
   extractTestFilePathsFromCommand,
@@ -6189,8 +6454,10 @@ export {
   resolveProjectInfo,
   retirementSignal,
   revertedShaFromCommit,
+  reviewLearningsToDrafts,
   runRegexSensor,
   runSensors,
+  runTierContract,
   runtimeJournalPath,
   saveCodeMap,
   saveConfig,
@@ -6199,6 +6466,7 @@ export {
   scannableSensorTargets,
   scoreRetrievalCase,
   scoreSensorCase,
+  scrubbedCommandEnv,
   selectCommandSensors,
   sensorAppliesToPath,
   sensorLedgerPath,