@nodii/dev 0.6.23 → 0.6.25

package/README.md

@@ -298,6 +298,8 @@ style check as a submit (`CHANGE_SET_IMAGE_STYLE`).
 ```bash
 nodii-dev hook claude-figma-pre       # reads Claude Code hook JSON on stdin
 nodii-dev hook claude-figma-post      # reads Claude Code hook JSON on stdin
+nodii-dev hook safety-pre             # silent safety decision; blocks with exit 2
+nodii-dev hook safety-post            # silently records resources created by successful commands
 nodii-dev hook print-settings         # prints managed-settings JSON; writes nothing
 
 nodii-dev lane start KEY --title TEXT --kind dev_fix|new_build|docs_change|uat_fix|prod_fix
@@ -307,7 +309,8 @@ nodii-dev lane step KEY --side backend|frontend --start|--done|--block STEP [--r
                     # --block --reason records the new reason (Dev issue 125 moves it onto the step)
 nodii-dev lane evidence KEY --pr|--commit|--figma|--deploy|--dev-check REF
 nodii-dev lane heartbeat KEY [--note TEXT]
-nodii-dev lane review KEY
+nodii-dev lane review KEY --file REVIEW.json
+nodii-dev lane reviews KEY
 nodii-dev lane land KEY
 nodii-dev lane verify KEY --dev-check REF
 nodii-dev lane list [--kind KIND] [--status STATUS] [--machine UUID]
@@ -354,6 +357,28 @@ nodii-dev harness check [--json]               # 0 current, 1 differs from Dev,
 nodii-dev harness update --check               # the same check
 ```
 
+`harness install` and `harness update` merge the two safety hooks into
+`.claude/settings.json`; every installed hook invokes only `nodii-dev`. The
+pre-hook blocks edits outside a lane's optional `ownedPaths`, generated UI/API
+files, unsafe Git operations, stale or missing review receipts, lane identity
+changes, production-secret/test-auth bypasses, cleanup of Docker resources the
+run did not create, and deploy/apply commands without an exact grant. Allowed
+calls produce no output.
+
+Until Dev exposes a lane's owned paths (AGENT-HARNESS-10), an edit with no
+ownership field emits a nudge instead of claiming it is safe or blocking an
+unproven violation. Likewise, a deploy with no `NODII_DEV_GO_FILE` source
+nudges for AGENT-HARNESS-13; when the source exists, a missing exact grant is
+blocked. A Compose project whose normalized name is the lane key counts as
+lane-owned, as does a project recorded by a successful `docker compose up`.
+
+`lane review` writes its receipt to private Git metadata, pinning both `HEAD`
+and `origin/main`; it never adds a repository file. Set `NODII_DEV_GO_FILE` to
+the coordinator grant file so an exact `GO deploy <HEAD>` line can authorize a
+deploy. A coordinator's exceptional `--no-verify` also requires
+`NODII_DEV_NO_VERIFY_REASON`; the CLI records the reason in private Git
+metadata. Lanes and subagents can never use `--no-verify`.
+
 ### DS conformance: `design roles` and `design check` (DEC-0034)
 
 Every UI role names exactly one DS component (MW6-14). Resolve your brief's
@@ -688,6 +713,14 @@ The command reaches Dev through the edge, so it needs the edge's route for
 `/devops/api/v1/lanes/:id/non-issue`; until that is on an environment, the
 command gets the edge's 404 there.
 
+`lane review` reads one JSON object with the review's exact `origin/main`
+commit in `base`, exact reviewed commit in `head`,
+`iterationCount`, `exitReason`, `appliedPatches`, `unresolvedProposals`,
+`reviewerErrors`, and `findings`. Each finding has `perspective` (`code` or
+`rules`), `severity`, `summary`, `detail`, `disposition`, optional `path` and
+`line`, and a required `clauseId` for rules findings. `lane reviews` reads the
+append-only history, including whether each cited clause was a missed trigger.
+
 Heartbeat notes are optional and limited by Dev to 500 characters.
 Prioritize and deprioritize require a 1–500 character reason, which the CLI
 sends to Dev. `lane review` records the review gate.

package/dist/cli.js

@@ -23,6 +23,7 @@ import {
 import { heartbeatCurrentLane, postHook, postHookFailure, preHook, settingsSnippet, workflowSuggestion } from "./hooks.js";
 import { setupCommand } from "./setup.js";
 import { harnessCommand } from "./harness.js";
+import { safetyPostHook, safetyPreHook } from "./safety.js";
 import { doctorCommand } from "./doctor.js";
 import {
   figmaChangeSetShow,
@@ -119,7 +120,7 @@ Usage: nodii-dev <command> [options] [--json]
   figma changeset show CHANGE_SET       # items, variants, round, decision and comment (with the previous round's)
   figma file add FILE_KEY --name TEXT --kind design-system|surfaces|prototype [--module M]
                                         # register a Figma file in Dev so it can be locked
-  hook claude-figma-pre|claude-figma-post|print-settings
+  hook claude-figma-pre|claude-figma-post|safety-pre|safety-post|print-settings
   setup [--yes|--check]                 # dry-run by default
   harness install|update [--include-drafts[=false]] [--adopt PATH,...] [--dry-run]
   harness check                         # 0 current, 1 differs from Dev, 2 not installed
@@ -138,7 +139,9 @@ Usage: nodii-dev <command> [options] [--json]
   lane step <key> --side SIDE --start|--done|--block <step> [--reason TEXT]
                                         # --block --reason on a blocked step records its new reason
   lane evidence <key> --pr|--commit|--figma|--deploy|--dev-check REF
-  lane heartbeat|review|land|verify|prioritize|deprioritize|stop <key>
+  lane heartbeat|land|verify|prioritize|deprioritize|stop <key>
+  lane review <key> --file REVIEW.json  # base/head, outcome and clause-cited findings
+  lane reviews <key>                    # stored review history for the lane
   lane non-issue <key> --reason TEXT --evidence TEXT --reroute KEY[,KEY]|none
                  --branch carried:KEY|dropped[:REASON] [--commits SHA[,SHA]]
                                         # DEC-0011: terminal non_issue; issue -> wont_do; slot frees
@@ -771,6 +774,31 @@ export async function main(argv = process.argv.slice(2)) {
         );
       }
     }
+    if (action === "safety-pre") {
+      // A malformed or unavailable safety check must not turn into permission.
+      try {
+        const result = await safetyPreHook(JSON.parse(await stdinText()));
+        for (const nudge of result.nudges ?? []) console.log(nudge);
+        return;
+      } catch (error) {
+        throw new CliError(
+          error?.code ?? "SAFETY_HOOK_FAILED",
+          error?.message ?? String(error),
+          2,
+          error?.details,
+        );
+      }
+    }
+    if (action === "safety-post") {
+      try {
+        await safetyPostHook(JSON.parse(await stdinText()));
+      } catch (error) {
+        // A post-hook cannot undo a completed command; report state-tracking
+        // failure without making Claude treat the completed command as failed.
+        console.error(`nodii-dev safety post hook: ${error?.code ?? "ERROR"}: ${error?.message ?? String(error)}`);
+      }
+      return;
+    }
     if (action === "lane-heartbeat") {
       const result = await heartbeatCurrentLane();
       return emit(result, json, result.heartbeated ? `Heartbeat recorded for ${result.key}.` : "No current-branch lane; no heartbeat sent.");

package/dist/core.js

@@ -4,7 +4,7 @@ import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 
-export const VERSION = "0.6.23";
+export const VERSION = "0.6.25";
 export const configPath = () =>
   process.env.NODII_DEV_CONFIG_PATH ??
   join(homedir(), ".config/nodii-dev/config.json");