@massu/core 2.5.1 → 2.5.3

package/dist/hooks/auto-learning-pipeline.js

@@ -36,6 +36,15 @@ var init_memory_path = __esm({
   }
 });
 
+// src/lib/corrections-md.ts
+var CORRECTIONS_FILENAME;
+var init_corrections_md = __esm({
+  "src/lib/corrections-md.ts"() {
+    "use strict";
+    CORRECTIONS_FILENAME = "corrections.md";
+  }
+});
+
 // src/credentials.ts
 import { homedir } from "os";
 import { resolve } from "path";
@@ -137,7 +146,7 @@ var init_config_memory_schema = __esm({
           message: "memory.recall.embedEndpoint must be an http(s) URL"
         }).optional(),
         embedModel: z.string().min(1).optional()
-      }).default({}),
+      }).prefault({}),
       // --- Contradiction / supersede gate (plan-living-memory-slice-2-temporal-model, P5-001) ---
       // When a new high-value memory (decision/correction) is written, find
       // semantically-related existing records and, if the new one contradicts an
@@ -166,7 +175,7 @@ var init_config_memory_schema = __esm({
         annotateSuperseded: z.boolean().default(false),
         // Time budget (ms) for the contradiction check; exceeded → fail-open (ADD).
         budgetMs: z.number().int().positive().default(800)
-      }).default({}),
+      }).prefault({}),
       // --- Background consolidation, the "sleep-time" pass
       //     (plan-living-memory-slice-3-consolidation) ---
       // Keeps memory sharp over years: dedupes, distills dying sessions into
@@ -212,7 +221,7 @@ var init_config_memory_schema = __esm({
         // Surface optional upgrades (e.g. "a local model was detected") in chat.
         suggestUpgrades: z.boolean().default(true),
         suggestIntervalDays: z.number().int().positive().default(30)
-      }).default({}),
+      }).prefault({}),
       // A-20 (Slice 4) — memory FILES: the mirror, and the one switch that decides whether
       // Massu may ever WRITE into the user's memory directory.
       //
@@ -237,7 +246,7 @@ var init_config_memory_schema = __esm({
         // turn of EVERY session, so an unbounded index is a permanent context tax — and the
         // per-session cap bounds only the RATE, never the total.
         indexMaxLines: z.number().int().min(1).default(50)
-      }).default({}),
+      }).prefault({}),
       // --- Cross-repo memory surfacing (plan-living-memory-slice-5-cross-repo-surfacing) ---
       // A decision made in one of your repos can surface in another — opt-in per
       // decision AND opt-in per repo, signed, verified, and materialized ONLY on
@@ -262,8 +271,8 @@ var init_config_memory_schema = __esm({
           enabled: z.boolean().default(true),
           maxCrossRepoItems: z.number().int().min(0).default(1),
           minScore: z.number().optional()
-        }).default({})
-      }).default({})
+        }).prefault({})
+      }).prefault({})
     }).optional();
   }
 });
@@ -443,13 +452,19 @@ function getResolvedPaths() {
     settingsLocalPath: resolve2(root, claudeDirName, "settings.local.json")
   };
 }
-var DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
+var DEFAULT_KNOWLEDGE_SOURCE_FILES, DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_memory_path();
+    init_corrections_md();
     init_credentials();
     init_config_memory_schema();
+    DEFAULT_KNOWLEDGE_SOURCE_FILES = [
+      "CLAUDE.md",
+      "MEMORY.md",
+      CORRECTIONS_FILENAME
+    ];
     DomainConfigSchema = z2.object({
       name: z2.string().default("Unknown"),
       routers: z2.array(z2.string()).default([]),
@@ -578,34 +593,40 @@ var init_config = __esm({
       fixDetection: z2.object({
         enabled: z2.boolean().default(true),
         lookbackDays: z2.number().default(7),
-        signals: z2.array(z2.string()).default([
-          "removed_broken_code",
-          "added_error_handling",
-          "method_name_correction",
-          "auth_fix",
-          "nil_handling_fix",
-          "concurrency_fix",
-          "async_pattern_fix",
-          "added_missing_import"
-        ])
-      }).default({}),
+        // ⛔ NO DEFAULT LIST HERE, DELIBERATELY — the heuristics are the SSOT.
+        //
+        // This carried a hand-typed copy of all eight signal names while
+        // `fix-detector.ts` already read `config…signals ?? FIX_HEURISTICS.map(h => h.name)`.
+        // Because zod ALWAYS materialised the default, that fallback — the correct expression
+        // — was unreachable, and the duplicate was the only thing in effect. Two authoring
+        // sites for one vocabulary, and the drift is SILENT: a name listed here that no longer
+        // exists simply never matches `enabledSignals.has(...)`, so a retired heuristic lingers
+        // as a dead entry with no error. Retiring `method_name_correction` would have landed at
+        // one site of two (CR-74).
+        //
+        // Optional, so an ABSENT value reaches the `??` and the heuristic list defines itself
+        // (Rule 25). An explicit list in massu.config.yaml still overrides, which is the only
+        // behaviour anyone actually configured — measured: `fix-detector.ts:267` is the sole
+        // consumer and no config file in the repo sets it.
+        signals: z2.array(z2.string()).optional()
+      }).prefault({}),
       failureClassification: z2.object({
         enabled: z2.boolean().default(true),
         thresholds: z2.object({
           known: z2.number().default(5),
           similar: z2.number().default(3)
-        }).default({}),
+        }).prefault({}),
         scoring: z2.object({
           diffPatternWeight: z2.number().default(3),
           filePatternWeight: z2.number().default(2),
           promptKeywordWeight: z2.number().default(2)
-        }).default({})
-      }).default({}),
+        }).prefault({})
+      }).prefault({}),
       pipeline: z2.object({
         requireIncidentReport: z2.boolean().default(true),
         requirePreventionRule: z2.boolean().default(true),
         requireEnforcement: z2.boolean().default(true)
-      }).default({}),
+      }).prefault({}),
       // plan-v0.2-interactive-rule-approval P-D-008 / P-D-009: project-configured
       // custom destinations for the rule-candidate funnel. The classifier matches
       // a candidate to one of these entries when none of the framework
@@ -638,7 +659,7 @@ var init_config = __esm({
         memory: z2.boolean().default(true),
         analytics: z2.boolean().default(true),
         audit: z2.boolean().default(true)
-      }).default({ memory: true, analytics: true, audit: true })
+      }).prefault({ memory: true, analytics: true, audit: true })
     }).optional();
     ConventionsConfigSchema = z2.object({
       claudeDirName: z2.string().default(".claude").refine(
@@ -669,7 +690,7 @@ var init_config = __esm({
         "session-state",
         "agents"
       ]),
-      knowledgeSourceFiles: z2.array(z2.string()).default(["CLAUDE.md", "MEMORY.md", "corrections.md"]),
+      knowledgeSourceFiles: z2.array(z2.string()).default([...DEFAULT_KNOWLEDGE_SOURCE_FILES]),
       excludePatterns: z2.array(z2.string()).default(["/ARCHIVE/", "/SESSION-HISTORY/"])
     }).optional();
     PythonDomainConfigSchema = z2.object({
@@ -685,6 +706,23 @@ var init_config = __esm({
     }).optional();
     PathsConfigSchema = z2.object({
       source: z2.string().default("src"),
+      /**
+       * Where this stack's tests live, relative to the project root.
+       *
+       * Added 2026-09-20 for P4.3 of docs/plans/2026-09-20-stack-conformant-asset-rendering.md.
+       * ~25 shipped assets told every customer their tests belong in
+       * `packages/core/src/__tests__/` — massu's OWN layout — and no vocabulary could express
+       * the alternative because none existed. A test directory is a first-class property of
+       * every stack (`tests/` on FastAPI, `test/` on Rails, `src/test/java` on Spring,
+       * `Tests/` on SwiftPM, and Go keeps `_test.go` beside the source), so it belongs here
+       * rather than in prose.
+       *
+       * OPTIONAL, so every config written before this key existed keeps loading unchanged; an
+       * asset that needs it uses `{{paths.tests | default("...")}}`. All 13 shipped templates
+       * declare it, each with the convention it follows recorded at the site (G32 option 2),
+       * and `stack-template-conformance.test.ts` asserts that.
+       */
+      tests: z2.string().optional(),
       aliases: z2.record(z2.string(), z2.string()).default({ "@": "src" }),
       monorepo_roots: z2.array(z2.string()).optional(),
       routers: z2.string().optional(),
@@ -697,6 +735,13 @@ var init_config = __esm({
     });
     LanguageFrameworkEntrySchema = z2.object({
       framework: z2.string().optional(),
+      // `source_dirs` is emitted by `init` (commands/init.ts:417) and existence-checked
+      // by config validation (init.ts:868-876), but until 2026-08-14 it survived only via
+      // `.passthrough()` — declared in the file, untyped in the schema. `lib/source-layout.ts`
+      // derives the index builders' candidate set from it, so it is typed here rather than
+      // read as an unknown: a consumer that has to shape-check its own SoT is one branch away
+      // from silently contributing `undefined` to a path predicate.
+      source_dirs: z2.array(z2.string()).optional(),
       test_framework: z2.string().optional(),
       test: z2.string().optional(),
       runtime: z2.string().optional(),
@@ -787,14 +832,14 @@ var init_config = __esm({
       project: z2.object({
         name: z2.string().default("my-project"),
         root: z2.string().default("auto")
-      }).default({ name: "my-project", root: "auto" }),
-      framework: FrameworkConfigSchema.default({
+      }).prefault({ name: "my-project", root: "auto" }),
+      framework: FrameworkConfigSchema.prefault({
         type: "typescript",
         router: "none",
         orm: "none",
         ui: "none"
       }),
-      paths: PathsConfigSchema.default({ source: "src", aliases: { "@": "src" } }),
+      paths: PathsConfigSchema.prefault({ source: "src", aliases: { "@": "src" } }),
       toolPrefix: z2.string().default("massu"),
       dbAccessPattern: z2.string().optional(),
       knownMismatches: z2.record(z2.string(), z2.record(z2.string(), z2.string())).optional(),
@@ -3988,9 +4033,10 @@ var init_hook_failure_signal = __esm({
 // src/hooks/auto-learning-pipeline.ts
 init_config();
 import { execFileSync } from "child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync6, unlinkSync as unlinkSync2, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { createHash } from "crypto";
+import { existsSync as existsSync10, readFileSync as readFileSync7, unlinkSync as unlinkSync2, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync7 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join6 } from "path";
+import { join as join6, dirname as dirname8 } from "path";
 
 // src/hooks/lib/write-hook-message.ts
 var HOOK_EVENTS = [
@@ -4029,17 +4075,627 @@ function writeHookContext(hookEventName, message) {
 
 // src/hooks/auto-learning-pipeline.ts
 init_hook_failure_signal();
+
+// src/hooks/lib/is-direct-invocation.ts
+import { pathToFileURL } from "url";
+function isDirectInvocation(moduleUrl) {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  try {
+    return moduleUrl === pathToFileURL(entry).href;
+  } catch {
+    return false;
+  }
+}
+
+// src/hooks/lib/session-touched-files.ts
+import { readFileSync as readFileSync6, existsSync as existsSync9, realpathSync } from "fs";
+import { relative, isAbsolute, resolve as resolve5 } from "path";
+var FILE_WRITING_TOOLS = Object.freeze({
+  Edit: ["file_path"],
+  Write: ["file_path"],
+  MultiEdit: ["file_path"],
+  NotebookEdit: ["notebook_path", "file_path"]
+});
+function canonical(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+function toRepoRelative(root, filePath) {
+  if (typeof filePath !== "string" || filePath === "") return null;
+  const absRaw = isAbsolute(filePath) ? filePath : resolve5(root, filePath);
+  const canonicalRoot = canonical(root);
+  const abs = resolve5(canonical(resolve5(absRaw, "..")), absRaw.split("/").pop() ?? "");
+  const rel = relative(canonicalRoot, abs).split("\\").join("/");
+  if (rel === "" || rel.startsWith("../")) return null;
+  return rel;
+}
+function transcriptTouchedFiles(root, transcriptPath) {
+  let raw;
+  try {
+    raw = readFileSync6(transcriptPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const out = /* @__PURE__ */ new Set();
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const message = entry.message;
+    const content = message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      if (!block || typeof block !== "object") continue;
+      const b = block;
+      if (b.type !== "tool_use") continue;
+      const keys = b.name ? FILE_WRITING_TOOLS[b.name] : void 0;
+      if (!keys || !b.input) continue;
+      for (const key of keys) {
+        const rel = toRepoRelative(root, b.input[key]);
+        if (rel) out.add(rel);
+      }
+    }
+  }
+  return out;
+}
+function flagFileTouchedFiles(root, flagPath) {
+  if (!existsSync9(flagPath)) return null;
+  let raw;
+  try {
+    raw = readFileSync6(flagPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const out = /* @__PURE__ */ new Set();
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const rel = toRepoRelative(root, JSON.parse(line).file ?? "");
+      if (rel) out.add(rel);
+    } catch {
+      continue;
+    }
+  }
+  return out;
+}
+function sessionTouchedFiles(opts) {
+  const sources = [];
+  if (opts.transcriptPath) sources.push(transcriptTouchedFiles(opts.root, opts.transcriptPath));
+  if (opts.flagPath) sources.push(flagFileTouchedFiles(opts.root, opts.flagPath));
+  const readable = sources.filter((s) => s !== null);
+  if (readable.length === 0) return null;
+  const union = /* @__PURE__ */ new Set();
+  for (const s of readable) for (const f of s) union.add(f);
+  return union;
+}
+
+// src/hooks/lib/git-safe-env.ts
+var GIT_ENV_LEAKS = [
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_COMMON_DIR",
+  "GIT_PREFIX"
+];
+function gitSafeEnv(extra = {}, source = process.env) {
+  const e = { ...source, ...extra };
+  for (const k of GIT_ENV_LEAKS) delete e[k];
+  return e;
+}
+
+// src/hooks/lib/code-spans.ts
+import { extname } from "path";
+var DQ = { open: '"', close: '"', escapes: true, multiline: false };
+var SQ = { open: "'", close: "'", escapes: true, multiline: false };
+var C_COMMENTS = { lineComments: ["//"], blockComments: [["/*", "*/"]] };
+var JS = {
+  id: "js",
+  ...C_COMMENTS,
+  strings: [DQ, SQ, { open: "`", close: "`", escapes: true, multiline: true, interpolation: true }],
+  regexLiterals: true
+};
+var C = { id: "c", ...C_COMMENTS, strings: [DQ, SQ] };
+var GO = {
+  id: "go",
+  ...C_COMMENTS,
+  strings: [DQ, SQ, { open: "`", close: "`", escapes: false, multiline: true }]
+};
+var JVM = {
+  id: "jvm",
+  ...C_COMMENTS,
+  strings: [{ open: '"""', close: '"""', escapes: true, multiline: true }, DQ, SQ]
+};
+var SWIFT = {
+  id: "swift",
+  ...C_COMMENTS,
+  strings: [{ open: '"""', close: '"""', escapes: true, multiline: true }, DQ]
+};
+var RUST = {
+  id: "rust",
+  ...C_COMMENTS,
+  strings: [{ open: '"', close: '"', escapes: true, multiline: true }],
+  rustChars: true
+};
+var PYTHON = {
+  id: "python",
+  lineComments: ["#"],
+  blockComments: [],
+  strings: [
+    { open: '"""', close: '"""', escapes: true, multiline: true },
+    { open: "'''", close: "'''", escapes: true, multiline: true },
+    DQ,
+    SQ
+  ]
+};
+var SHELL = {
+  id: "shell",
+  lineComments: ["#"],
+  blockComments: [],
+  strings: [
+    { open: '"', close: '"', escapes: true, multiline: true },
+    { open: "'", close: "'", escapes: false, multiline: true }
+  ],
+  hashNeedsBoundary: true
+};
+var RUBY = {
+  id: "ruby",
+  lineComments: ["#"],
+  blockComments: [],
+  strings: [
+    { open: '"', close: '"', escapes: true, multiline: true },
+    { open: "'", close: "'", escapes: true, multiline: true }
+  ]
+};
+var LEX_SPECS = Object.freeze({
+  ".ts": JS,
+  ".tsx": JS,
+  ".mts": JS,
+  ".cts": JS,
+  ".js": JS,
+  ".jsx": JS,
+  ".mjs": JS,
+  ".cjs": JS,
+  ".c": C,
+  ".h": C,
+  ".cc": C,
+  ".cpp": C,
+  ".hpp": C,
+  ".cs": C,
+  ".dart": C,
+  ".m": C,
+  ".mm": C,
+  ".go": GO,
+  ".java": JVM,
+  ".kt": JVM,
+  ".kts": JVM,
+  ".scala": JVM,
+  ".groovy": JVM,
+  ".swift": SWIFT,
+  ".rs": RUST,
+  ".py": PYTHON,
+  ".pyi": PYTHON,
+  ".sh": SHELL,
+  ".bash": SHELL,
+  ".zsh": SHELL,
+  ".rb": RUBY
+});
+function lexSpecFor(path) {
+  const ext = extname(path).toLowerCase();
+  return Object.prototype.hasOwnProperty.call(LEX_SPECS, ext) ? LEX_SPECS[ext] : null;
+}
+var RUST_CHAR_RE = /^'(?:\\(?:u\{[0-9a-fA-F]{1,6}\}|x[0-9a-fA-F]{2}|.)|[^\\'\n])'/;
+var IDENT_CHAR_RE = /[A-Za-z0-9_$]/;
+var SHELL_WORD_BREAK = /* @__PURE__ */ new Set([" ", "	", ";", "|", "&", "(", ")"]);
+var REGEX_AFTER_KEYWORD = /* @__PURE__ */ new Set([
+  "return",
+  "typeof",
+  "case",
+  "in",
+  "of",
+  "delete",
+  "void",
+  "throw",
+  "new",
+  "yield",
+  "await",
+  "else",
+  "do"
+]);
+function regexLiteralLength(line, i, lastSig) {
+  if (lastSig === ")" || lastSig === "]") return 0;
+  if (lastSig !== "" && IDENT_CHAR_RE.test(lastSig)) {
+    const m = /([A-Za-z_$][A-Za-z0-9_$]*)\s*$/.exec(line.slice(0, i));
+    if (!m || !REGEX_AFTER_KEYWORD.has(m[1])) return 0;
+  }
+  let inClass = false;
+  for (let j = i + 1; j < line.length; j++) {
+    const ch = line[j];
+    if (ch === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "/") return j - i + 1;
+  }
+  return 0;
+}
+function projectLine(line, spec, st) {
+  const out = line.split("");
+  const blank = (from, len) => {
+    for (let k = from; k < from + len && k < out.length; k++) out[k] = " ";
+  };
+  let i = 0;
+  while (i < line.length) {
+    const mode = st.mode;
+    if (mode.kind === "block") {
+      if (line.startsWith(mode.close, i)) {
+        blank(i, mode.close.length);
+        i += mode.close.length;
+        st.mode = { kind: "code" };
+      } else {
+        blank(i, 1);
+        i++;
+      }
+      continue;
+    }
+    if (mode.kind === "string") {
+      const r = mode.rule;
+      if (r.escapes && line[i] === "\\") {
+        blank(i, 2);
+        i += 2;
+        continue;
+      }
+      if (r.interpolation && line.startsWith("${", i)) {
+        blank(i, 2);
+        i += 2;
+        st.holes.push(0);
+        st.mode = { kind: "code" };
+        st.lastSig = "";
+        continue;
+      }
+      if (line.startsWith(r.close, i)) {
+        blank(i, r.close.length);
+        i += r.close.length;
+        st.mode = { kind: "code" };
+        st.lastSig = '"';
+        continue;
+      }
+      blank(i, 1);
+      i++;
+      continue;
+    }
+    const ch = line[i];
+    if (st.holes.length > 0) {
+      const top = st.holes.length - 1;
+      if (ch === "{") st.holes[top]++;
+      else if (ch === "}") {
+        if (st.holes[top] === 0) {
+          st.holes.pop();
+          blank(i, 1);
+          i++;
+          st.mode = { kind: "string", rule: spec.strings.find((s) => s.interpolation) };
+          continue;
+        }
+        st.holes[top]--;
+      }
+    }
+    const lc = spec.lineComments.find((m) => line.startsWith(m, i));
+    if (lc && (!spec.hashNeedsBoundary || i === 0 || SHELL_WORD_BREAK.has(line[i - 1]))) {
+      blank(i, line.length - i);
+      break;
+    }
+    const bc = spec.blockComments.find(([open]) => line.startsWith(open, i));
+    if (bc) {
+      blank(i, bc[0].length);
+      i += bc[0].length;
+      st.mode = { kind: "block", close: bc[1] };
+      continue;
+    }
+    if (spec.rustChars && ch === "'") {
+      const m = RUST_CHAR_RE.exec(line.slice(i));
+      if (m) {
+        blank(i, m[0].length);
+        i += m[0].length;
+        st.lastSig = "'";
+        continue;
+      }
+      i++;
+      continue;
+    }
+    const sr = spec.strings.find((s) => line.startsWith(s.open, i));
+    if (sr) {
+      blank(i, sr.open.length);
+      i += sr.open.length;
+      st.mode = { kind: "string", rule: sr };
+      continue;
+    }
+    if (spec.regexLiterals && ch === "/") {
+      const len = regexLiteralLength(line, i, st.lastSig);
+      if (len > 0) {
+        blank(i, len);
+        i += len;
+        st.lastSig = "/";
+        continue;
+      }
+    }
+    if (ch !== " " && ch !== "	") st.lastSig = ch;
+    i++;
+  }
+  if (st.mode.kind === "string" && !st.mode.rule.multiline) st.mode = { kind: "code" };
+  return out.join("");
+}
+function projectCode(lines, spec) {
+  const st = { mode: { kind: "code" }, holes: [], lastSig: "" };
+  return lines.map((l) => projectLine(l, spec, st));
+}
+function unquoteGitPath(p) {
+  const s = p.startsWith('"') && p.endsWith('"') ? p.slice(1, -1) : p;
+  return s.startsWith("b/") ? s.slice(2) : s;
+}
+function diffCodeView(diff, opts = {}) {
+  const files = [];
+  let cur = null;
+  let hunk = null;
+  let newLine = 0;
+  let inHeader = false;
+  const startFile = (path) => {
+    const f = { path, hunks: [], removed: [] };
+    files.push(f);
+    return f;
+  };
+  for (const line of diff.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      cur = startFile("");
+      hunk = null;
+      inHeader = true;
+      continue;
+    }
+    if (inHeader && line.startsWith("+++ ")) {
+      const p = line.slice(4).trim();
+      if (cur) cur.path = p === "/dev/null" ? "" : unquoteGitPath(p);
+      continue;
+    }
+    if (inHeader && (line.startsWith("--- ") || !line.startsWith("@@"))) continue;
+    const hh = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hh) {
+      inHeader = false;
+      if (!cur) cur = startFile("");
+      hunk = { newSide: [], addedAt: [] };
+      cur.hunks.push(hunk);
+      newLine = parseInt(hh[1], 10);
+      continue;
+    }
+    if (!cur) cur = startFile("");
+    if (!hunk) {
+      hunk = { newSide: [], addedAt: [] };
+      cur.hunks.push(hunk);
+      newLine = 1;
+    }
+    if (line.startsWith("+")) {
+      hunk.addedAt.push({ idx: hunk.newSide.length, lineNo: newLine });
+      hunk.newSide.push(line.slice(1));
+      newLine++;
+    } else if (line.startsWith("-")) {
+      cur.removed.push(line.slice(1));
+    } else if (line.startsWith(" ")) {
+      hunk.newSide.push(line.slice(1));
+      newLine++;
+    }
+  }
+  return files.map((f) => {
+    const spec = f.path ? lexSpecFor(f.path) : null;
+    const rawAdded = f.hunks.flatMap(
+      (h) => h.addedAt.map((a) => ({ lineNo: a.lineNo, raw: h.newSide[a.idx] }))
+    );
+    if (!spec) {
+      return { path: f.path, mode: "raw", added: rawAdded.map((a) => ({ ...a, code: a.raw })), removed: f.removed };
+    }
+    const text = opts.postImage ? opts.postImage(f.path) : null;
+    if (text !== null && text !== void 0) {
+      const post = text.split(/\r\n|\n|\r/);
+      if (rawAdded.every((a) => post[a.lineNo - 1] === a.raw)) {
+        const proj = projectCode(post, spec);
+        return {
+          path: f.path,
+          mode: "post-image",
+          added: rawAdded.map((a) => ({ ...a, code: proj[a.lineNo - 1] })),
+          removed: f.removed
+        };
+      }
+    }
+    const added = [];
+    for (const h of f.hunks) {
+      const proj = projectCode(h.newSide, spec);
+      for (const a of h.addedAt) added.push({ lineNo: a.lineNo, raw: h.newSide[a.idx], code: proj[a.idx] });
+    }
+    return { path: f.path, mode: "hunk", added, removed: f.removed };
+  });
+}
+
+// src/hooks/auto-learning-pipeline.ts
 var HOOK_EVENT = "Stop";
 var MAX_FULL_DIFF_BYTES = 2 * 1024 * 1024;
+var DOC_EXCLUDE_PATHSPEC = [
+  ":(exclude)*.md",
+  ":(exclude)*.markdown",
+  ":(exclude)*.mdx",
+  ":(exclude)*.rst",
+  ":(exclude)*.adoc",
+  ":(exclude)*.txt",
+  ":(exclude)docs/**",
+  // massu's OWN runtime artifacts: agent-result JSONL, workflow logs, rule candidates.
+  // Audit findings quote source lines verbatim, so leaving these in scope re-creates the
+  // prose-as-code false positive with the hook's own output as the input.
+  ":(exclude).massu/**"
+];
+var CODE_ONLY_PATHSPEC = ["--", ".", ...DOC_EXCLUDE_PATHSPEC];
+var MAX_SESSION_PATHSPEC_FILES = 500;
+var FIX_PATTERN_RE = /^\+.*(?:\b(?:try|except|catch|guard|throw|raise|assert|validate)\b|\bif\b.*\b(?:null|nil|None|undefined)\b)/gm;
+var REMOVED_BROKEN_RE = /^-.*\b(?:bug|broken|crash|wrong|incorrect|typo|fail|error|miss|stale)\b/gm;
 function getSessionFlagPath(sessionId) {
   return join6(tmpdir2(), "massu-auto-learning", `fixes-${sessionId.slice(0, 12)}.jsonl`);
 }
+function getSessionAckPath(sessionId) {
+  return join6(tmpdir2(), "massu-auto-learning", `shown-${sessionId.slice(0, 12)}.json`);
+}
+function matchKey(file, side, line) {
+  return createHash("sha256").update(`${file}\0${side}\0${line}`).digest("hex").slice(0, 32);
+}
+function readShownKeys(ackPath) {
+  try {
+    const parsed = JSON.parse(readFileSync7(ackPath, "utf-8"));
+    return new Set(Array.isArray(parsed.shown) ? parsed.shown.filter((k) => typeof k === "string") : []);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function writeShownKeys(ackPath, keys) {
+  mkdirSync7(dirname8(ackPath), { recursive: true });
+  writeFileSync3(ackPath, JSON.stringify({ shown: [...keys].sort() }), "utf-8");
+}
+function freshMatches(matchKeys, shown) {
+  return [...new Set(matchKeys)].filter((k) => !shown.has(k));
+}
+var RECENT_INCIDENT_WINDOW_MS = 12 * 60 * 60 * 1e3;
+function recentIncidentFiles(dir, nowMs = Date.now()) {
+  try {
+    return readdirSync2(dir).filter((f) => f.endsWith(".md")).filter((f) => {
+      try {
+        return nowMs - statSync2(join6(dir, f)).mtimeMs <= RECENT_INCIDENT_WINDOW_MS;
+      } catch {
+        return false;
+      }
+    }).sort();
+  } catch {
+    return [];
+  }
+}
+var MAX_POST_IMAGE_BYTES = MAX_FULL_DIFF_BYTES;
+function readPostImageFrom(root) {
+  return (rel) => {
+    try {
+      const abs = join6(root, rel);
+      if (statSync2(abs).size > MAX_POST_IMAGE_BYTES) return null;
+      return readFileSync7(abs, "utf-8");
+    } catch {
+      return null;
+    }
+  };
+}
+function scoreDiff(diff, postImage) {
+  const fixRe = new RegExp(FIX_PATTERN_RE.source);
+  const brokenRe = new RegExp(REMOVED_BROKEN_RE.source);
+  let fixPatterns = 0;
+  let removedBroken = 0;
+  const matchKeys = [];
+  const lexModes = {};
+  for (const view of diffCodeView(diff, { postImage })) {
+    lexModes[view.path] = view.mode;
+    for (const a of view.added) {
+      if (fixRe.test(`+${a.code}`)) {
+        fixPatterns++;
+        matchKeys.push(matchKey(view.path, "+", a.raw));
+      }
+    }
+    for (const r of view.removed) {
+      if (brokenRe.test(`-${r}`)) {
+        removedBroken++;
+        matchKeys.push(matchKey(view.path, "-", r));
+      }
+    }
+  }
+  return { fixPatterns, removedBroken, matchKeys, lexModes };
+}
+function scanUncommittedForFix(opts) {
+  const none = { fixPatterns: 0, removedBroken: 0, matchKeys: [], lexModes: {} };
+  const git = opts.git ?? ((args, t, m) => execFileSync("git", [...args], {
+    cwd: opts.root,
+    // `cwd` does NOT scope git: GIT_DIR in the environment outranks it, and a leaked one
+    // would make this read a different repository while looking correct. This hook runs
+    // at Stop and is never reachable from a git hook, so nothing here depends on the
+    // index a commit-time hook is handed — the variables are removed rather than asserted.
+    env: gitSafeEnv(),
+    timeout: t,
+    encoding: "utf-8",
+    maxBuffer: m
+  }));
+  if (opts.sessionTouched === null) {
+    return { uncommittedFix: false, reason: "unattributable", filesScanned: 0, ...none };
+  }
+  if (opts.sessionTouched.size === 0) {
+    return { uncommittedFix: false, reason: "not-this-session", filesScanned: 0, ...none };
+  }
+  try {
+    const nameOnly = git(["diff", "--name-only", ...CODE_ONLY_PATHSPEC], 3e3, 1024 * 1024);
+    const changed = nameOnly.split("\n").map((s) => s.trim()).filter(Boolean);
+    if (changed.length === 0) {
+      return { uncommittedFix: false, reason: "no-changes", filesScanned: 0, ...none };
+    }
+    const mine = changed.filter((f) => opts.sessionTouched.has(f));
+    if (mine.length === 0) {
+      return { uncommittedFix: false, reason: "not-this-session", filesScanned: 0, ...none };
+    }
+    const scoped = mine.length <= MAX_SESSION_PATHSPEC_FILES ? ["--", ...mine, ...DOC_EXCLUDE_PATHSPEC] : [...CODE_ONLY_PATHSPEC];
+    const shortstat = git(["diff", "--shortstat", ...scoped], 2e3, 64 * 1024);
+    const insertions = parseInt(shortstat.match(/(\d+) insertion/)?.[1] ?? "0", 10);
+    const deletions = parseInt(shortstat.match(/(\d+) deletion/)?.[1] ?? "0", 10);
+    if ((insertions + deletions) * 80 > MAX_FULL_DIFF_BYTES) {
+      return { uncommittedFix: false, reason: "over-cap", filesScanned: mine.length, ...none };
+    }
+    const fullDiff = git(["diff", ...scoped], 5e3, MAX_FULL_DIFF_BYTES);
+    const scored = scoreDiff(fullDiff, opts.postImage ?? readPostImageFrom(opts.root));
+    const hit = scored.fixPatterns > 3 || scored.removedBroken > 1;
+    return {
+      uncommittedFix: hit,
+      reason: hit ? "fix-detected" : "no-signal",
+      filesScanned: mine.length,
+      ...scored
+    };
+  } catch {
+    return { uncommittedFix: false, reason: "git-unavailable", filesScanned: 0, ...none };
+  }
+}
+function formatFixSummary(sessionFixes) {
+  if (sessionFixes.length === 0) return [];
+  const byFile = /* @__PURE__ */ new Map();
+  for (const fix of sessionFixes) {
+    const existing = byFile.get(fix.file) ?? [];
+    existing.push(...fix.signals);
+    byFile.set(fix.file, [...new Set(existing)]);
+  }
+  const lines = [
+    "",
+    `  ${sessionFixes.length} fix signal(s) across ${byFile.size} file(s) detected during this session:`,
+    ""
+  ];
+  for (const [file, signals] of byFile) {
+    lines.push(`    - ${file} (${signals.join(", ")})`);
+  }
+  return lines;
+}
 async function main() {
   try {
     const input = await readStdin();
     const hookInput = JSON.parse(input);
     const config = getConfig();
-    if (config.autoLearning?.enabled === false) {
+    if (config.autoLearning?.enabled === false || config.autoLearning?.fixDetection?.enabled === false) {
       process.exit(0);
       return;
     }
@@ -4049,46 +4705,35 @@ async function main() {
     const autoLearn = config.autoLearning;
     const flagPath = getSessionFlagPath(hookInput.session_id);
     let sessionFixes = [];
-    if (existsSync9(flagPath)) {
+    if (existsSync10(flagPath)) {
       try {
-        sessionFixes = readFileSync6(flagPath, "utf-8").split("\n").filter(Boolean).map((line) => JSON.parse(line));
+        sessionFixes = readFileSync7(flagPath, "utf-8").split("\n").filter(Boolean).map((line) => JSON.parse(line));
       } catch {
       }
     }
-    let uncommittedFix = false;
-    try {
-      const nameOnly = execFileSync("git", ["diff", "--name-only"], {
-        cwd: root,
-        timeout: 3e3,
-        encoding: "utf-8",
-        maxBuffer: 1024 * 1024
-      });
-      if (nameOnly.trim()) {
-        const shortstat = execFileSync("git", ["diff", "--shortstat"], {
-          cwd: root,
-          timeout: 2e3,
-          encoding: "utf-8",
-          maxBuffer: 64 * 1024
-        });
-        const insertions = parseInt(shortstat.match(/(\d+) insertion/)?.[1] ?? "0", 10);
-        const deletions = parseInt(shortstat.match(/(\d+) deletion/)?.[1] ?? "0", 10);
-        const estimatedBytes = (insertions + deletions) * 80;
-        if (estimatedBytes <= MAX_FULL_DIFF_BYTES) {
-          const fullDiff = execFileSync("git", ["diff"], {
-            cwd: root,
-            timeout: 5e3,
-            encoding: "utf-8",
-            maxBuffer: MAX_FULL_DIFF_BYTES
-          });
-          const fixPatterns = (fullDiff.match(/^\+.*(try|except|catch|guard|throw|raise|assert|validate|if.*null|if.*nil|if.*None|if.*undefined)/gm) || []).length;
-          const removedBroken = (fullDiff.match(/^-.*(bug|broken|crash|wrong|incorrect|typo|fail|error|miss|stale)/gm) || []).length;
-          if (fixPatterns > 3 || removedBroken > 1) {
-            uncommittedFix = true;
-          }
-        }
+    const scan = scanUncommittedForFix({
+      root,
+      sessionTouched: sessionTouchedFiles({
+        root,
+        transcriptPath: hookInput.transcript_path,
+        flagPath
+      })
+    });
+    const ackPath = getSessionAckPath(hookInput.session_id);
+    const shown = readShownKeys(ackPath);
+    const fresh = scan.uncommittedFix ? freshMatches(scan.matchKeys, shown) : [];
+    const uncommittedFix = fresh.length > 0;
+    if (scan.uncommittedFix) {
+      try {
+        writeShownKeys(ackPath, /* @__PURE__ */ new Set([...shown, ...scan.matchKeys]));
+      } catch {
       }
-    } catch {
     }
+    const modes = Object.entries(scan.lexModes);
+    const rawFallback = modes.filter(([, m]) => m === "raw").map(([f]) => f || "<headerless>");
+    process.stderr.write(
+      `[massu auto-learning] scan reason=${scan.reason} files=${scan.filesScanned} fixPatterns=${scan.fixPatterns} removedBroken=${scan.removedBroken} lexed=${modes.length - rawFallback.length}/${modes.length}` + (rawFallback.length ? ` raw-fallback=[${rawFallback.join(", ")}]` : "") + (scan.uncommittedFix ? ` new-lines=${fresh.length} (${fresh.length === 0 ? "already shown \u2014 silent" : "notice"})` : "") + "\n"
+    );
     if (sessionFixes.length === 0 && !uncommittedFix) {
       cleanup(flagPath);
       process.exit(0);
@@ -4099,28 +4744,23 @@ async function main() {
     lines.push("============================================================================");
     lines.push(" MASSU AUTO-LEARNING PIPELINE \u2014 ACTION REQUIRED BEFORE SESSION END");
     lines.push("============================================================================");
-    if (sessionFixes.length > 0) {
-      lines.push("");
-      lines.push(`  ${sessionFixes.length} bug fix(es) detected during this session:`);
-      lines.push("");
-      const byFile = /* @__PURE__ */ new Map();
-      for (const fix of sessionFixes) {
-        const existing = byFile.get(fix.file) ?? [];
-        existing.push(...fix.signals);
-        byFile.set(fix.file, [...new Set(existing)]);
-      }
-      for (const [file, signals] of byFile) {
-        lines.push(`    - ${file} (${signals.join(", ")})`);
-      }
-    }
+    lines.push(...formatFixSummary(sessionFixes));
     if (uncommittedFix) {
       lines.push("");
       lines.push("  Additional uncommitted fix patterns detected in git diff.");
     }
+    const todaysIncidents = recentIncidentFiles(join6(root, incidentDir));
     lines.push("");
-    lines.push("  Complete these steps before this session ends:");
+    if (todaysIncidents.length > 0) {
+      lines.push("  ALREADY SATISFIED TODAY (verify these cover the fixes above):");
+      for (const f of todaysIncidents.slice(0, 5)) lines.push(`    - ${incidentDir}/${f}`);
+      lines.push("");
+      lines.push("  If they do, nothing further is required. Otherwise:");
+    } else {
+      lines.push("  Complete these steps before this session ends:");
+    }
     lines.push("");
-    if (autoLearn?.pipeline?.requireIncidentReport !== false) {
+    if (autoLearn?.pipeline?.requireIncidentReport !== false && todaysIncidents.length === 0) {
       lines.push("  STEP 1: INCIDENT REPORT");
       lines.push(`    For each distinct bug fixed, create: ${incidentDir}/YYYY-MM-DD-<slug>.md`);
       lines.push("    Include: Date, Severity, Symptoms, Root Cause, Fix, Files Changed, Prevention Rules");
@@ -4157,9 +4797,9 @@ async function main() {
 }
 function cleanup(flagPath) {
   try {
-    if (existsSync9(flagPath)) unlinkSync2(flagPath);
+    if (existsSync10(flagPath)) unlinkSync2(flagPath);
     const dir = join6(tmpdir2(), "massu-auto-learning");
-    if (existsSync9(dir)) {
+    if (existsSync10(dir)) {
       const now = Date.now();
       for (const file of readdirSync2(dir)) {
         const fullPath = join6(dir, file);
@@ -4176,17 +4816,35 @@ function cleanup(flagPath) {
   }
 }
 function readStdin() {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
-    process.stdin.on("end", () => resolve5(data));
-    setTimeout(() => resolve5(data), 5e3);
+    process.stdin.on("end", () => resolve6(data));
+    setTimeout(() => resolve6(data), 5e3);
   });
 }
-main();
+if (isDirectInvocation(import.meta.url)) {
+  main();
+}
 export {
-  MAX_FULL_DIFF_BYTES
+  CODE_ONLY_PATHSPEC,
+  DOC_EXCLUDE_PATHSPEC,
+  FIX_PATTERN_RE,
+  MAX_FULL_DIFF_BYTES,
+  MAX_POST_IMAGE_BYTES,
+  MAX_SESSION_PATHSPEC_FILES,
+  RECENT_INCIDENT_WINDOW_MS,
+  REMOVED_BROKEN_RE,
+  formatFixSummary,
+  freshMatches,
+  getSessionAckPath,
+  matchKey,
+  readShownKeys,
+  recentIncidentFiles,
+  scanUncommittedForFix,
+  scoreDiff,
+  writeShownKeys
 };