@lamentis/naome 1.4.1 → 1.4.3

package/crates/naome-cli/src/task_commands/record.rs

@@ -1,48 +1,65 @@
-use std::fs;
 use std::path::Path;
 
 use naome_core::task_proof_plan;
 use serde_json::{json, Value};
 
-use super::common::{print_json, read_task_state};
+use super::check_run::{evidence_fingerprint, successful_receipts, CheckRunReceipt};
+use super::common::{agent_session, print_json_with_session, read_task_state, write_task_state};
 
 pub(super) fn record_proof(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
     if !args.iter().any(|arg| arg == "--from-proof-plan") {
         return Err("naome task record-proof requires --from-proof-plan".into());
     }
-    let plan = task_proof_plan(root)?;
+    let session = agent_session(args)?;
     let dry_run = args.iter().any(|arg| arg == "--dry-run");
-    let recorded = !dry_run && !plan.proof_recording.checks_to_record.is_empty();
+    print_json_with_session(
+        record_proof_payload(root, dry_run, session.as_deref())?,
+        session.as_deref(),
+    )
+}
+
+pub(super) fn record_proof_value(
+    root: &Path,
+    session: Option<&str>,
+) -> Result<Value, Box<dyn std::error::Error>> {
+    record_proof_payload(root, false, session)
+}
+
+fn record_proof_payload(
+    root: &Path,
+    dry_run: bool,
+    session: Option<&str>,
+) -> Result<Value, Box<dyn std::error::Error>> {
+    let plan = task_proof_plan(root)?;
+    let paths = plan.proof_recording.paths.clone();
+    let check_ids = plan.proof_recording.checks_to_record.clone();
+    let (can_record, findings, receipts) = recordable_receipts(root, &check_ids, &paths)?;
+    let recorded = !dry_run && can_record && !check_ids.is_empty();
     let recorded_ids = if recorded {
-        write_proof_batch(root, &plan.proof_recording)?
+        write_proof_batch(
+            root,
+            &plan.proof_recording.path_set_id,
+            &plan.proof_recording.proof_batch_id,
+            &paths,
+            &receipts,
+        )?
     } else {
         RecordedProof {
             path_set_id: plan.proof_recording.path_set_id.clone(),
             proof_batch_id: plan.proof_recording.proof_batch_id.clone(),
         }
     };
-    if dry_run && !plan.proof_recording.checks_to_record.is_empty() {
-        print_json(json!({
+    Ok(json!({
             "schema": "naome.task.record-proof.v1",
             "dryRun": dry_run,
             "recorded": recorded,
             "pathSetId": recorded_ids.path_set_id,
-            "paths": plan.proof_recording.paths,
+            "paths": paths,
             "proofBatchId": recorded_ids.proof_batch_id,
-            "checksRecorded": plan.proof_recording.checks_to_record,
-            "agentInstruction": "Record proof only after the listed checks exited 0 for the current task diff."
-        }))?;
-        return Ok(());
-    }
-    print_json(json!({
-        "schema": "naome.task.record-proof.v1",
-        "dryRun": dry_run,
-        "recorded": recorded,
-        "pathSetId": recorded_ids.path_set_id,
-        "paths": plan.proof_recording.paths,
-        "proofBatchId": recorded_ids.proof_batch_id,
-        "checksRecorded": plan.proof_recording.checks_to_record,
-        "agentInstruction": "Record proof only after the listed checks exited 0 for the current task diff."
+            "checksRecorded": if recorded || dry_run && can_record { check_ids } else { Vec::<String>::new() },
+            "findings": findings,
+            "agentInstruction": if recorded { "Proof recorded from recent successful safe check evidence." } else { "Run task run-check --record-proof or task loop --execute-safe before recording proof." },
+            "agentSession": session
     }))
 }
 
@@ -51,17 +68,48 @@ struct RecordedProof {
     proof_batch_id: String,
 }
 
+pub(super) fn record_receipts_for_checks(
+    root: &Path,
+    check_ids: &[String],
+    paths: &[String],
+    session: Option<&str>,
+) -> Result<bool, Box<dyn std::error::Error>> {
+    let (can_record, _findings, receipts) = recordable_receipts(root, check_ids, paths)?;
+    if !can_record || receipts.is_empty() {
+        return Ok(false);
+    }
+    let task_id = read_task_state(root)?
+        .get("activeTask")
+        .and_then(|task| task.get("id"))
+        .and_then(Value::as_str)
+        .unwrap_or("task")
+        .to_string();
+    let batch_id = format!("{task_id}-proof");
+    let receipts = receipts
+        .into_iter()
+        .map(|mut receipt| {
+            if receipt.agent_session.is_none() {
+                receipt.agent_session = session.map(ToString::to_string);
+            }
+            receipt
+        })
+        .collect::<Vec<_>>();
+    write_proof_batch(root, "current-task-diff", &batch_id, paths, &receipts)?;
+    Ok(true)
+}
+
 fn write_proof_batch(
     root: &Path,
-    recording: &naome_core::ProofRecording,
+    path_set_base: &str,
+    proof_batch_base: &str,
+    paths: &[String],
+    receipts: &[CheckRunReceipt],
 ) -> Result<RecordedProof, Box<dyn std::error::Error>> {
-    let path = root.join(".naome/task-state.json");
     let mut state = read_task_state(root)?;
-    let checked_at = state
-        .get("updatedAt")
-        .and_then(Value::as_str)
-        .unwrap_or("1970-01-01T00:00:00.000Z")
-        .to_string();
+    let checked_at = receipts
+        .first()
+        .map(|receipt| receipt.checked_at.clone())
+        .unwrap_or_else(|| "1970-01-01T00:00:00.000Z".to_string());
     let active = state
         .get_mut("activeTask")
         .and_then(Value::as_object_mut)
@@ -71,21 +119,21 @@ fn write_proof_batch(
         .or_insert_with(|| json!({}))
         .as_object_mut()
         .ok_or("activeTask.proofPathSets must be an object")?;
-    let path_set_id = unique_path_set_id(path_sets, &recording.path_set_id);
-    path_sets.insert(path_set_id.clone(), json!(recording.paths));
+    let path_set_id = unique_path_set_id(path_sets, path_set_base);
+    path_sets.insert(path_set_id.clone(), json!(paths));
     let batches = active
         .entry("proofBatches")
         .or_insert_with(|| json!([]))
         .as_array_mut()
         .ok_or("activeTask.proofBatches must be an array")?;
-    let proof_batch_id = unique_proof_batch_id(batches, &recording.proof_batch_id);
+    let proof_batch_id = unique_proof_batch_id(batches, proof_batch_base);
     batches.push(proof_batch(
-        recording,
+        receipts,
         &checked_at,
         &path_set_id,
         &proof_batch_id,
     ));
-    fs::write(path, format!("{}\n", serde_json::to_string_pretty(&state)?))?;
+    write_task_state(root, &state)?;
     Ok(RecordedProof {
         path_set_id,
         proof_batch_id,
@@ -93,7 +141,7 @@ fn write_proof_batch(
 }
 
 fn proof_batch(
-    recording: &naome_core::ProofRecording,
+    receipts: &[CheckRunReceipt],
     checked_at: &str,
     path_set_id: &str,
     proof_batch_id: &str,
@@ -102,12 +150,103 @@ fn proof_batch(
         "id": proof_batch_id,
         "checkedAt": checked_at,
         "evidencePathSet": path_set_id,
-        "proofs": recording.checks_to_record.iter().map(|check_id| {
-            json!({ "checkId": check_id, "exitCode": 0 })
+        "proofs": receipts.iter().map(|receipt| {
+            json!({
+                "checkId": receipt.check_id,
+                "command": receipt.command,
+                "cwd": receipt.cwd,
+                "exitCode": receipt.exit_code,
+                "checkedAt": receipt.checked_at,
+                "evidenceFingerprint": receipt.evidence_fingerprint,
+                "agentSession": receipt.agent_session
+            })
         }).collect::<Vec<_>>()
     })
 }
 
+fn recordable_receipts(
+    root: &Path,
+    check_ids: &[String],
+    paths: &[String],
+) -> Result<(bool, Vec<Value>, Vec<CheckRunReceipt>), Box<dyn std::error::Error>> {
+    let receipts = successful_receipts(root)?;
+    let current_fingerprint = evidence_fingerprint(root, paths)?;
+    let task_id = read_task_state(root)?
+        .get("activeTask")
+        .and_then(|task| task.get("id"))
+        .and_then(Value::as_str)
+        .map(ToString::to_string);
+    let mut selected = Vec::new();
+    let mut findings = Vec::new();
+    for check_id in check_ids {
+        let expected = super::check_run::read_verification_check(root, check_id)?;
+        let matching_check = receipts
+            .iter()
+            .rev()
+            .find(|receipt| receipt.check_id == *check_id);
+        let Some(receipt) = matching_check else {
+            findings.push(no_recent_success(check_id));
+            continue;
+        };
+        if receipt.task_id != task_id {
+            findings.push(json!({
+                "id": "task.proof.receipt_task_mismatch",
+                "severity": "error",
+                "message": format!("Recent receipt for {check_id} was produced for a different task."),
+                "path": null,
+                "suggestedFix": "Rerun the check for the active task before recording proof.",
+                "agentInstruction": "Do not record proof from another task."
+            }));
+            continue;
+        }
+        if !expected
+            .as_ref()
+            .is_some_and(|check| receipt.command == check.command && receipt.cwd == check.cwd)
+        {
+            findings.push(no_recent_success(check_id));
+            continue;
+        }
+        if paths != receipt.evidence_paths {
+            findings.push(json!({
+                "id": "task.proof.receipt_path_mismatch",
+                "severity": "error",
+                "message": format!("Recent receipt for {check_id} covers a different path set."),
+                "path": null,
+                "suggestedFix": "Rerun the check against the current task-owned changed paths.",
+                "agentInstruction": "Do not record proof when receipt paths differ from the current task diff."
+            }));
+            continue;
+        }
+        if receipt.evidence_fingerprint != current_fingerprint {
+            findings.push(json!({
+                "id": "task.proof.stale_receipt_content",
+                "severity": "error",
+                "message": format!("Recent receipt for {check_id} does not match current file contents."),
+                "path": null,
+                "suggestedFix": "Rerun the check after the latest edits.",
+                "agentInstruction": "Do not record proof from stale check output."
+            }));
+            continue;
+        }
+        match matching_check.cloned() {
+            Some(receipt) => selected.push(receipt),
+            None => findings.push(no_recent_success(check_id)),
+        }
+    }
+    Ok((findings.is_empty(), findings, selected))
+}
+
+fn no_recent_success(check_id: &str) -> Value {
+    json!({
+        "id": "task.proof.no_recent_success",
+        "severity": "error",
+        "message": format!("No recent successful safe check evidence covers current task paths for {check_id}."),
+        "path": null,
+        "suggestedFix": "Run naome task run-check --check <id> --record-proof --json or naome task loop --execute-safe --json.",
+        "agentInstruction": "Do not record proof until NAOME has just executed the check successfully."
+    })
+}
+
 fn unique_path_set_id(path_sets: &serde_json::Map<String, Value>, base: &str) -> String {
     unique_id(base, |candidate| path_sets.contains_key(candidate))
 }

package/crates/naome-cli/src/task_commands/repair.rs

@@ -3,14 +3,20 @@ use std::path::Path;
 use naome_core::task_status_report;
 use serde_json::json;
 
-use super::common::{print_json, value_after};
+use super::common::{agent_session, print_json_with_session, value_after};
 
 pub(super) fn repair_preview(
     root: &Path,
     args: &[String],
 ) -> Result<(), Box<dyn std::error::Error>> {
-    if !args.iter().any(|arg| arg == "--dry-run") {
-        return Err("naome task repair requires --dry-run in v1.4.1".into());
+    let session = agent_session(args)?;
+    let dry_run = args.iter().any(|arg| arg == "--dry-run");
+    let execute_safe = args.iter().any(|arg| arg == "--execute-safe");
+    if dry_run && execute_safe {
+        return Err("naome task repair accepts only one of --dry-run or --execute-safe".into());
+    }
+    if !dry_run && !execute_safe {
+        return Err("naome task repair requires --dry-run or --execute-safe".into());
     }
     let plan_id = value_after(args, "--plan").ok_or("naome task repair requires --plan <id>")?;
     let status = task_status_report(root)?;
@@ -19,12 +25,53 @@ pub(super) fn repair_preview(
         .iter()
         .find(|item| item.id == plan_id)
         .cloned();
-    print_json(json!({
-        "schema": "naome.task.repair-preview.v1",
-        "planId": plan_id,
-        "found": plan.is_some(),
-        "wouldExecute": false,
-        "plan": plan,
-        "agentInstruction": "Review this dry-run output and execute only safe commands explicitly allowed by NAOME."
-    }))
+    let mut steps = Vec::new();
+    let mut executed = false;
+    let mut requires_user_approval = false;
+    if execute_safe {
+        if let Some(plan) = &plan {
+            if !can_execute_safe(plan) {
+                requires_user_approval = true;
+            } else {
+                match plan.kind.as_str() {
+                    "rerun_check" if plan.check_ids.len() == 1 => {
+                        steps.push(super::check_run::run_check_by_id(
+                            root,
+                            &plan.check_ids[0],
+                            false,
+                            session.as_deref(),
+                        )?);
+                        executed = true;
+                    }
+                    "record_proof" => {
+                        steps.push(super::record::record_proof_value(root, session.as_deref())?);
+                        executed = true;
+                    }
+                    _ => {
+                        requires_user_approval = true;
+                    }
+                }
+            }
+        }
+    }
+    print_json_with_session(
+        json!({
+            "schema": if dry_run { "naome.task.repair-preview.v1" } else { "naome.task.repair-execute.v1" },
+            "planId": plan_id,
+            "found": plan.is_some(),
+            "wouldExecute": dry_run && plan.as_ref().is_some_and(can_execute_safe),
+            "executed": executed,
+            "requiresUserApproval": requires_user_approval || plan.as_ref().is_some_and(|item| item.requires_user_approval),
+            "plan": plan,
+            "steps": steps,
+            "agentInstruction": if executed { "Executed only NAOME safe check/proof repair steps." } else { "Review this output; unsafe repair plans require human approval." }
+        }),
+        session.as_deref(),
+    )
+}
+
+fn can_execute_safe(item: &naome_core::RepairPlanItem) -> bool {
+    item.safe_to_execute
+        && !item.requires_user_approval
+        && matches!(item.kind.as_str(), "rerun_check" | "record_proof")
 }

package/crates/naome-cli/src/task_commands/scope_suggestions.rs

@@ -0,0 +1,109 @@
+use std::path::Path;
+use std::process::Command;
+
+use serde_json::json;
+
+use super::common::{agent_session, print_json_with_session};
+use super::path_policy::is_ignored;
+use super::planner;
+
+pub(super) fn scope_suggestions(
+    root: &Path,
+    args: &[String],
+) -> Result<(), Box<dyn std::error::Error>> {
+    let session = agent_session(args)?;
+    if !args.iter().any(|arg| arg == "--from-changed") {
+        return Err("naome task scope-suggestions requires --from-changed".into());
+    }
+    let mut suggestions = rename_suggestions(root)
+        .into_iter()
+        .chain(loader_suggestions(root))
+        .filter(|suggestion| {
+            !suggestion
+                .get("path")
+                .and_then(serde_json::Value::as_str)
+                .is_some_and(|path| is_ignored(root, path))
+        })
+        .collect::<Vec<_>>();
+    suggestions.sort_by(|left, right| {
+        left.get("path")
+            .and_then(serde_json::Value::as_str)
+            .unwrap_or("")
+            .cmp(
+                right
+                    .get("path")
+                    .and_then(serde_json::Value::as_str)
+                    .unwrap_or(""),
+            )
+    });
+    print_json_with_session(
+        json!({
+            "schema": "naome.task.scope-suggestions.v1",
+            "suggestions": suggestions,
+            "agentInstruction": "Suggestions are read-only hints; task scope mutation still requires explicit approval."
+        }),
+        session.as_deref(),
+    )
+}
+
+fn rename_suggestions(root: &Path) -> Vec<serde_json::Value> {
+    let Ok(output) = Command::new("git")
+        .args(["status", "--porcelain=v1", "-z"])
+        .current_dir(root)
+        .output()
+    else {
+        return Vec::new();
+    };
+    if !output.status.success() {
+        return Vec::new();
+    }
+    let mut suggestions = Vec::new();
+    let entries = output.stdout.split(|byte| *byte == 0).collect::<Vec<_>>();
+    let mut index = 0;
+    while index < entries.len() {
+        let entry = entries[index];
+        index += 1;
+        if entry.len() < 4 {
+            continue;
+        }
+        let status = String::from_utf8_lossy(&entry[..2]);
+        if status.contains('R') && index < entries.len() {
+            let old = String::from_utf8_lossy(entries[index]).replace('\\', "/");
+            index += 1;
+            let new = String::from_utf8_lossy(&entry[3..]).replace('\\', "/");
+            for path in [old, new] {
+                suggestions.push(json!({
+                    "path": path,
+                    "reason": "paired path for renamed file",
+                    "confidence": 0.95,
+                    "requiresUserApproval": true
+                }));
+            }
+        }
+    }
+    suggestions
+}
+
+fn loader_suggestions(root: &Path) -> Vec<serde_json::Value> {
+    planner::changed_paths(root)
+        .into_iter()
+        .filter(|path| path.ends_with(".test.js") || path.ends_with("_test.rs"))
+        .filter_map(|path| {
+            let loader = if path.starts_with("scripts/") {
+                Some("scripts/naome-installer-support.js".to_string())
+            } else if path.contains("/tests/") {
+                path.split("/tests/")
+                    .next()
+                    .map(|prefix| format!("{prefix}/tests/support/mod.rs"))
+            } else {
+                None
+            }?;
+            Some(json!({
+                "path": loader,
+                "reason": "fixture support helper for changed test",
+                "confidence": 0.7,
+                "requiresUserApproval": true
+            }))
+        })
+        .collect()
+}

package/crates/naome-cli/src/task_commands.rs

@@ -1,10 +1,21 @@
 use std::path::Path;
 
+mod agent_snapshot;
+mod can_edit;
+mod check_run;
+mod commit_preflight;
 mod common;
+mod compact_proof;
+mod complete;
+mod loop_control;
+mod path_policy;
+mod planner;
+mod preflight;
 mod readiness;
 mod record;
 mod repair;
 mod scope_request;
+mod scope_suggestions;
 mod timeline;
 
 use naome_core::{
@@ -19,9 +30,18 @@ pub fn run_task_command(root: &Path, args: &[String]) -> Result<(), Box<dyn std:
         Some("migrate-ledger") => migrate_ledger(root, args),
         Some("status") => task_status(root, args),
         Some("proof-plan") => proof_plan(root, args),
+        Some("agent-snapshot") => agent_snapshot::agent_snapshot(root, args),
+        Some("preflight") => preflight::preflight(root, args),
+        Some("can-edit") => can_edit::can_edit(root, args),
+        Some("run-check") => check_run::run_check_command(root, args),
         Some("can-transition") => can_transition(root, args),
         Some("repair") => repair::repair_preview(root, args),
         Some("record-proof") => record::record_proof(root, args),
+        Some("compact-proof") => compact_proof::compact_proof(root, args),
+        Some("complete") => complete::complete_task(root, args),
+        Some("loop") => loop_control::task_loop(root, args),
+        Some("commit-preflight") => commit_preflight::commit_preflight(root, args),
+        Some("scope-suggestions") => scope_suggestions::scope_suggestions(root, args),
         Some("request-scope") => scope_request::request_scope(root, args),
         Some("can-commit") => readiness::can_commit(root, args),
         Some("timeline") => timeline::timeline(root, args),
@@ -31,9 +51,10 @@ pub fn run_task_command(root: &Path, args: &[String]) -> Result<(), Box<dyn std:
 }
 
 fn task_status(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let session = common::agent_session(args)?;
     let report = task_status_report(root)?;
     if args.iter().any(|arg| arg == "--json") {
-        println!("{}", serde_json::to_string_pretty(&report)?);
+        common::print_json_with_session(serde_json::to_value(&report)?, session.as_deref())?;
     } else {
         print!("{}", format_task_status(&report));
     }
@@ -42,9 +63,10 @@ fn task_status(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::E
 }
 
 fn proof_plan(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let session = common::agent_session(args)?;
     let report = task_proof_plan(root)?;
     if args.iter().any(|arg| arg == "--json") {
-        println!("{}", serde_json::to_string_pretty(&report)?);
+        common::print_json_with_session(serde_json::to_value(&report)?, session.as_deref())?;
     } else {
         print!("{}", format_task_proof_plan(&report));
     }
@@ -53,6 +75,7 @@ fn proof_plan(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Er
 }
 
 fn can_transition(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let session = common::agent_session(args)?;
     let Some(target) = args
         .windows(2)
         .find(|window| window[0] == "--to")
@@ -62,7 +85,7 @@ fn can_transition(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error
     };
     let report = task_transition_readiness(root, target)?;
     if args.iter().any(|arg| arg == "--json") {
-        println!("{}", serde_json::to_string_pretty(&report)?);
+        common::print_json_with_session(serde_json::to_value(&report)?, session.as_deref())?;
     } else {
         println!(
             "NAOME task transition {target}: {}",

package/crates/naome-cli/tests/task_cli_agent_controls.rs

@@ -1,11 +1,10 @@
 use std::fs;
-use std::process::Command;
 
 use serde_json::{json, Value};
 
 mod task_cli_support;
 
-use task_cli_support::{fixture_root, init_git, task_state, write_fixture_file};
+use task_cli_support::{fixture_root, init_git, run_json, task_state, write_fixture_file};
 
 #[test]
 fn status_json_exposes_policy_hints_and_recovery_guidance() {
@@ -83,6 +82,14 @@ fn record_proof_from_plan_writes_compact_batch() {
     init_git(&root);
     write_fixture_file(&root, "README.md", "changed\n");
 
+    let check = run_json(
+        &root,
+        ["task", "run-check", "--check", "diff-check", "--json"],
+    );
+    assert_eq!(check["schema"], "naome.task.run-check.v1");
+    assert_eq!(check["executed"], true);
+    assert_eq!(check["recordedProof"], false);
+
     let recorded = run_json(
         &root,
         ["task", "record-proof", "--from-proof-plan", "--json"],
@@ -201,17 +208,3 @@ fn review_fix_mode_is_structured_not_inferred_from_prompt_text() {
         .unwrap()
         .contains("explicit allowedPaths"));
 }
-
-fn run_json<const N: usize>(root: &std::path::Path, args: [&str; N]) -> Value {
-    let output = Command::new(env!("CARGO_BIN_EXE_naome"))
-        .args(args)
-        .current_dir(root)
-        .output()
-        .unwrap();
-    assert!(
-        output.status.success(),
-        "{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    serde_json::from_slice(&output.stdout).unwrap()
-}