@nurix/etna 0.19.44 → 0.19.46

package/data/harnesses/apollo/hooks/lib/state.mjs

@@ -0,0 +1,157 @@
+// harness/code/hooks/lib/state.mjs — the bookkeeping queue (docs/operations/bookkeeping.md) and the
+// machine-local state dir (.claude/state/). The row grammar is the contract between the awareness
+// detector (writer), the bookkeeper agent (drain), the compliance gates (walls), and CI (backstop):
+//   - auto: {YYYY-MM-DD} · {finding-kind} · {description} → {action} | sid={session_id}
+//   - note: {YYYY-MM-DD} · {area} · {context} → lands-in: {owning doc | backlog | memory} | sid=…
+//   - needs-session: {YYYY-MM-DD} · {what could not be grounded} → main session resolves | refs={ts}
+//   - waived: {YYYY-MM-DD} · {what is deferred} · reason: {why} → expires={YYYY-MM-DD}
+// Unresolved = auto + note + needs-session. waived: rows are resolved history until expires= passes.
+
+import fs from "node:fs";
+import path from "node:path";
+
+export const QUEUE_PATH = ["docs", "operations", "bookkeeping.md"];
+
+export const QUEUE_HEADER = `# Bookkeeping
+
+The shared work queue keeping documentation and code in sync — rows are appended mechanically (auto:) and by working sessions (note:), drained by the bookkeeper agent, and walled at commit: a commit is possible only when every row is resolved or waived. Row grammar and lifecycle: the behavioral-hooks feature doc. A \`waived:\` row carries \`expires=\` and is PR-reviewable history.
+`;
+
+export function queueFile(projectDir) {
+  return path.join(projectDir, ...QUEUE_PATH);
+}
+
+const ROW_RE = /^-\s+(auto|note|needs-session|waived):\s+(.*)$/;
+
+// Parse the queue text into rows: { kind, date, body, raw }. Non-row lines are ignored.
+export function parseQueue(text) {
+  const rows = [];
+  for (const line of String(text || "").split(/\r?\n/)) {
+    const m = ROW_RE.exec(line.trim());
+    if (!m) continue;
+    const body = m[2].trim();
+    const date = (/^(\d{4}-\d{2}-\d{2})/.exec(body) || [])[1] || "";
+    rows.push({ kind: m[1], date, body, raw: line });
+  }
+  return rows;
+}
+
+export function readQueue(projectDir) {
+  try {
+    return parseQueue(fs.readFileSync(queueFile(projectDir), "utf8"));
+  } catch (e) {
+    return [];
+  }
+}
+
+// Counts by kind; `unresolved` is the number the walls act on.
+export function countRows(rows) {
+  const c = { auto: 0, note: 0, needsSession: 0, waived: 0 };
+  for (const row of rows) {
+    if (row.kind === "auto") c.auto += 1;
+    else if (row.kind === "note") c.note += 1;
+    else if (row.kind === "needs-session") c.needsSession += 1;
+    else if (row.kind === "waived") c.waived += 1;
+  }
+  c.unresolved = c.auto + c.note + c.needsSession;
+  return c;
+}
+
+// Format one auto: row per the grammar; the sid tail is the only provenance kept —
+// a transcript path or timestamp is machine noise in a PR-reviewed queue.
+export function formatAutoRow({ date, kind, description, action, sessionId }) {
+  return `- auto: ${date} · ${kind} · ${description} → ${action} | sid=${sessionId || "-"}`;
+}
+
+// Append rows to the queue, creating the file with its genre header when absent.
+// Dedupes on the row text before the `| sid=` tail, so a re-fired detector never stacks duplicates.
+export function appendRows(projectDir, rowLines) {
+  if (!rowLines || rowLines.length === 0) return 0;
+  const file = queueFile(projectDir);
+  let text = "";
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch (e) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    text = QUEUE_HEADER + "\n";
+  }
+  const key = (line) => line.split("| sid=")[0].trim();
+  const existing = new Set(parseQueue(text).map((r) => key(r.raw)));
+  const fresh = rowLines.filter((line) => !existing.has(key(line)));
+  if (fresh.length === 0) return 0;
+  if (!text.endsWith("\n")) text += "\n";
+  fs.writeFileSync(file, text + fresh.join("\n") + "\n");
+  return fresh.length;
+}
+
+// Delete queue rows matching the predicate (used by the detector to auto-resolve
+// rows whose finding the session has since addressed). Returns the count removed.
+export function resolveRows(projectDir, predicate) {
+  const file = queueFile(projectDir);
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch (e) {
+    return 0;
+  }
+  let removed = 0;
+  const kept = text.split(/\r?\n/).filter((line) => {
+    const m = ROW_RE.exec(line.trim());
+    if (!m) return true;
+    const row = { kind: m[1], body: m[2].trim(), raw: line };
+    if (predicate(row)) {
+      removed += 1;
+      return false;
+    }
+    return true;
+  });
+  if (removed > 0) fs.writeFileSync(file, kept.join("\n"));
+  return removed;
+}
+
+// Unexpired waived rows for a finding kind (the dead-glob allowlist CI honors).
+// A waived row covers a glob when its body names it verbatim.
+export function unexpiredWaivers(rows, kind, today) {
+  return rows.filter((row) => {
+    if (row.kind !== "waived") return false;
+    if (kind && !row.body.includes(kind)) return false;
+    const expires = (/expires=(\d{4}-\d{2}-\d{2})/.exec(row.body) || [])[1];
+    if (!expires) return false;
+    return expires >= today;
+  });
+}
+
+// Ensure .claude/state/ exists and is self-ignoring (a `*` .gitignore inside it),
+// so consumers never see machine-local state as untracked noise. Returns the dir.
+export function stateDir(projectDir) {
+  const dir = path.join(projectDir, ".claude", "state");
+  fs.mkdirSync(dir, { recursive: true });
+  const ignore = path.join(dir, ".gitignore");
+  if (!fs.existsSync(ignore)) fs.writeFileSync(ignore, "*\n");
+  return dir;
+}
+
+// Session-scoped ask memory: an `ask` gate fires once per (session, class); after the user has
+// answered it once, repeats in the same session pass silently (the runtime's own permission
+// prompts still apply). Records live in .claude/state/asked.tsv — machine-local, self-ignored.
+export function askedThisSession(projectDir, sessionId, key) {
+  if (!sessionId) return false;
+  try {
+    const text = fs.readFileSync(path.join(projectDir, ".claude", "state", "asked.tsv"), "utf8");
+    return text.split("\n").includes(`${sessionId}\t${key}`);
+  } catch (e) {
+    return false;
+  }
+}
+
+export function recordAsked(projectDir, sessionId, key) {
+  if (!sessionId) return;
+  fs.appendFileSync(path.join(stateDir(projectDir), "asked.tsv"), `${sessionId}\t${key}\n`);
+}
+
+// Append one tab-separated line to .claude/state/touched.tsv (file → owning doc map for the session).
+export function recordTouched(projectDir, relPath, docs) {
+  const dir = stateDir(projectDir);
+  const line = `${new Date().toISOString()}\t${relPath}\t${docs.join(",") || "-"}\n`;
+  fs.appendFileSync(path.join(dir, "touched.tsv"), line);
+}

package/data/harnesses/code/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.5.10",
+  "version": "3.5.11",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "552c88cf99bf"
+  "digest": "9074f75982ad"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -123,6 +123,14 @@ function driftBanner(projectDir) {
   const waivers = unexpiredWaivers(queueRows, "dead-glob", today());
   const unwaivedDead = dead.filter((d) => !waivers.some((w) => w.body.includes(d.glob)));
 
+  // A queued dead-glob row covered by an unexpired waiver is resolved history — drop it,
+  // so waiving a finding class actually empties the rows it supersedes.
+  resolveRows(projectDir, (row) => {
+    if (row.kind !== "auto" || !row.body.includes("dead-glob")) return false;
+    const m = /`([^`]+)`/.exec(row.body);
+    return !!m && waivers.some((w) => w.body.includes(`\`${m[1]}\``));
+  });
+
   // Docs older than the code they own (doc mtime < newest owned-file mtime).
   const staleDocs = [];
   for (const entry of scanFeatureDocs(projectDir)) {
@@ -313,7 +321,9 @@ function detectorForFile(projectDir, rel, meta, rows) {
 
 function detectRenames(projectDir, command, meta, rows) {
   if (!/\bgit mv\b|\bmv\b/.test(command || "")) return;
+  const waivers = unexpiredWaivers(readQueue(projectDir), "dead-glob", today());
   for (const { glob, doc } of deadGlobs(projectDir)) {
+    if (waivers.some((w) => w.body.includes(`\`${glob}\``))) continue;
     rows.push(
       formatAutoRow({
         ...meta,

package/data/harnesses/code/hooks/compliance.mjs

@@ -178,7 +178,7 @@ function approvedPackages(projectDir) {
 }
 
 function packageGate(projectDir, command) {
-  const m = /\b(?:pnpm|npm|yarn|bun)\s+(?:add|install|i)\s+(.+)/.exec(command);
+  const m = new RegExp(String.raw`(?:^|&&|;|\|)\s*(?:sudo\s+)?(?:pnpm|npm|yarn|bun)\s+(?:add|install|i)\s+(.+)`).exec(command);
   if (!m) return null;
   const approved = approvedPackages(projectDir);
   if (approved.size === 0) return null; // no rules file installed — nothing to enforce
@@ -196,6 +196,22 @@ function packageGate(projectDir, command) {
   return null;
 }
 
+// The repo a Bash command acts on: an explicit `cd <dir>` in the command wins, then the
+// payload's cwd, then the session's home project — a session may operate across repos
+// (forge + consumer), and gating a commit against the wrong repo blocks or passes falsely.
+function commandRoot(projectDir, payload, command) {
+  const cdMatch = /(?:^|&&|;)\s*cd\s+"?([^"\s;&]+)"?/.exec(command || "");
+  for (const candidate of [cdMatch && cdMatch[1], payload.cwd]) {
+    if (!candidate || !path.isAbsolute(candidate)) continue;
+    try {
+      if (fs.statSync(candidate).isDirectory()) return candidate;
+    } catch (e) {
+      /* fall through */
+    }
+  }
+  return projectDir;
+}
+
 // An ask class fires once per session: the first occurrence asks, later ones pass silently —
 // the user has already exercised judgment on this class this session.
 function askOnce(projectDir, sessionId, key, message) {
@@ -204,14 +220,20 @@ function askOnce(projectDir, sessionId, key, message) {
   return decision("ask", message);
 }
 
+// Command matchers anchor at statement boundaries (start, &&, ;, |) so quoted text — an
+// echoed payload, a commit message naming a command — can never trigger a gate.
+const AT_STATEMENT = String.raw`(?:^|&&|;|\|)\s*(?:sudo\s+)?(?:npx\s+(?:--yes\s+)?)?`;
+const statement = (body) => new RegExp(AT_STATEMENT + body);
+
 function bashGate(projectDir, command, sessionId) {
   if (!command) return null;
 
-  if (/\bgit\s+commit\b/.test(command)) {
+  if (statement(String.raw`git\s+commit\b`).test(command)) {
     return commitGate(projectDir);
   }
 
-  if (/\bgit\s+(checkout\s+-b|switch\s+-c|branch\s+\S+|worktree\s+add)\b/.test(command)) {
+  // `git branch <name>` creates; flag-led forms (--show-current, --list, -d, -vv) query or manage
+  if (statement(String.raw`git\s+(checkout\s+-b|switch\s+-c|branch\s+(?!-)\S+|worktree\s+add)`).test(command)) {
     return askOnce(
       projectDir,
       sessionId,
@@ -221,7 +243,7 @@ function bashGate(projectDir, command, sessionId) {
   }
 
   if (
-    /\bwrangler\b.*(\bd1\s+execute\b.*--remote|\bsecret\s+(put|bulk)\b|\bdeploy\b)/.test(command) &&
+    statement(String.raw`wrangler(?:@\S+)?\b.*(\bd1\s+execute\b.*--remote|\bsecret\s+(put|bulk)\b|\bdeploy\b)`).test(command) &&
     !/--dry-run\b|--local\b/.test(command)
   ) {
     return askOnce(
@@ -269,12 +291,17 @@ function plansCompletedThisSession(projectDir) {
 function stopGate(projectDir, payload) {
   if (payload.stop_hook_active) return null; // the runtime's infinite-loop guard — never re-block
 
-  const counts = countRows(readQueue(projectDir));
+  // The Stop wall is scoped to this session's own rows (plus sid-less ones) — a concurrent
+  // session's open work must not block this one's stop. The commit wall stays global.
+  const mine = readQueue(projectDir).filter(
+    (row) => !/\bsid=/.test(row.body) || row.body.includes(`sid=${payload.session_id}`)
+  );
+  const counts = countRows(mine);
   if (counts.unresolved > 0 && !bookkeeperDispatched(payload.transcript_path)) {
     return {
       decision: "block",
       reason:
-        `${counts.unresolved} unresolved bookkeeping rows (${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session) in docs/operations/bookkeeping.md. ` +
+        `${counts.unresolved} unresolved bookkeeping rows from this session (${counts.auto} auto, ${counts.note} note, ${counts.needsSession} needs-session) in docs/operations/bookkeeping.md. ` +
         "Dispatch the `bookkeeper` agent to drain them, resolve them now, or convert to `waived:` rows with reason + expiry. " +
         "If implementation of the open plan is complete, also report it and offer the verification gate — never run it unbidden.",
     };
@@ -311,7 +338,7 @@ function main() {
   if (event === "PreToolUse") {
     const input = payload.tool_input || {};
     if (payload.tool_name === "Bash") {
-      out = bashGate(projectDir, input.command, payload.session_id);
+      out = bashGate(commandRoot(projectDir, payload, input.command), input.command, payload.session_id);
     } else {
       const rel = relIfInside(projectDir, input.file_path || input.notebook_path);
       if (rel) out = fileGate(projectDir, rel, payload.tool_name);

package/data/harnesses/code/hooks/lib/state.mjs

@@ -1,8 +1,8 @@
 // harness/code/hooks/lib/state.mjs — the bookkeeping queue (docs/operations/bookkeeping.md) and the
 // machine-local state dir (.claude/state/). The row grammar is the contract between the awareness
 // detector (writer), the bookkeeper agent (drain), the compliance gates (walls), and CI (backstop):
-//   - auto: {YYYY-MM-DD} · {finding-kind} · {description} → {action} | sid={session_id} tp={transcript_path} ts={ISO}
-//   - note: {YYYY-MM-DD} · {area} · {context} → lands-in: {owning doc | backlog | memory} | sid=… tp=… ts=…
+//   - auto: {YYYY-MM-DD} · {finding-kind} · {description} → {action} | sid={session_id}
+//   - note: {YYYY-MM-DD} · {area} · {context} → lands-in: {owning doc | backlog | memory} | sid=…
 //   - needs-session: {YYYY-MM-DD} · {what could not be grounded} → main session resolves | refs={ts}
 //   - waived: {YYYY-MM-DD} · {what is deferred} · reason: {why} → expires={YYYY-MM-DD}
 // Unresolved = auto + note + needs-session. waived: rows are resolved history until expires= passes.
@@ -57,9 +57,10 @@ export function countRows(rows) {
   return c;
 }
 
-// Format one auto: row per the grammar; sid/tp/ts come from the hook payload.
-export function formatAutoRow({ date, kind, description, action, sessionId, transcriptPath, ts }) {
-  return `- auto: ${date} · ${kind} · ${description} → ${action} | sid=${sessionId || "-"} tp=${transcriptPath || "-"} ts=${ts || "-"}`;
+// Format one auto: row per the grammar; the sid tail is the only provenance kept —
+// a transcript path or timestamp is machine noise in a PR-reviewed queue.
+export function formatAutoRow({ date, kind, description, action, sessionId }) {
+  return `- auto: ${date} · ${kind} · ${description} → ${action} | sid=${sessionId || "-"}`;
 }
 
 // Append rows to the queue, creating the file with its genre header when absent.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.44",
+    "version": "0.19.46",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -19,6 +19,7 @@
         "node": ">=18.0.0"
     },
     "scripts": {
+        "test": "node --test 'tests/**/*.test.mjs'",
         "build:data": "node scripts/build-data.js",
         "prepack": "node scripts/build-data.js",
         "validate:codex-agents": "node lib/codex/validate-codex-agents.mjs"
@@ -41,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "0140c843638d"
+    "etnaFingerprint": "efebb48c460d"
 }

package/data/harnesses/apollo/hooks/generate-ownership-index.mjs

@@ -1,148 +0,0 @@
-// harness/apollo/hooks/generate-ownership-index.mjs — SessionStart hook: scan docs/features/**/*.md,
-// extract the focal frontmatter (owns / module / keywords / status), and inject a compact
-// code-path → owning-doc index via additionalContext. Fires on startup/resume/clear/compact so the
-// map survives /clear and /compact and is regenerated fresh every time. Writes no file.
-
-import fs from "node:fs";
-import path from "node:path";
-
-// Read all of stdin synchronously; returns "" if nothing is piped.
-function readStdin() {
-  try {
-    return fs.readFileSync(0, "utf8");
-  } catch (e) {
-    return "";
-  }
-}
-
-// Resolve the project root: CLAUDE_PROJECT_DIR env, else payload cwd, else process cwd.
-function resolveProjectDir(payload) {
-  return process.env.CLAUDE_PROJECT_DIR || (payload && payload.cwd) || process.cwd();
-}
-
-// Recursively collect every .md file under dir (returns [] if the dir is absent).
-function listMarkdown(dir) {
-  const out = [];
-  let entries;
-  try {
-    entries = fs.readdirSync(dir, { withFileTypes: true });
-  } catch (e) {
-    return out;
-  }
-  for (const entry of entries) {
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) out.push(...listMarkdown(full));
-    else if (entry.isFile() && entry.name.endsWith(".md")) out.push(full);
-  }
-  return out;
-}
-
-// Pull the leading `--- … ---` frontmatter block; "" if the file has none.
-function frontmatter(text) {
-  const m = /^?---\r?\n([\s\S]*?)\r?\n---/.exec(text);
-  return m ? m[1] : "";
-}
-
-// Trim surrounding whitespace, then strip one layer of matching quotes.
-function unquote(s) {
-  return String(s).trim().replace(/^["']|["']$/g, "").trim();
-}
-
-// Read one frontmatter key: scalar (`k: v`), inline array (`k: [a, b]`), or a following `- item` block.
-// Returns a string for scalars, an array for lists, or undefined when the key is absent.
-function field(block, key) {
-  const lines = block.split(/\r?\n/);
-  const head = new RegExp(`^${key}\\s*:\\s*(.*)$`);
-  for (let i = 0; i < lines.length; i++) {
-    const m = head.exec(lines[i]);
-    if (!m) continue;
-    const raw = m[1].trim();
-    if (raw === "") {
-      const items = [];
-      for (let j = i + 1; j < lines.length; j++) {
-        const li = /^\s*-\s+(.*)$/.exec(lines[j]);
-        if (!li) break;
-        items.push(unquote(li[1]));
-      }
-      return items;
-    }
-    if (raw.startsWith("[")) {
-      return raw.replace(/^\[|\]$/g, "").split(",").map((s) => unquote(s)).filter(Boolean);
-    }
-    return unquote(raw);
-  }
-  return undefined;
-}
-
-// Coerce a field that may be scalar/array/undefined into a clean string array.
-function asList(v) {
-  if (v == null) return [];
-  return (Array.isArray(v) ? v : [v]).map((s) => String(s).trim()).filter(Boolean);
-}
-
-// Build the ownership index text from every feature doc's frontmatter.
-function buildIndex(projectDir) {
-  const featuresDir = path.join(projectDir, "docs", "features");
-  const files = listMarkdown(featuresDir);
-  const lines = [];
-  let deprecated = 0;
-  for (const file of files) {
-    let text;
-    try {
-      text = fs.readFileSync(file, "utf8");
-    } catch (e) {
-      continue;
-    }
-    const block = frontmatter(text);
-    if (!block) continue;
-    const owns = asList(field(block, "owns"));
-    if (owns.length === 0) continue;
-    const status = (field(block, "status") || "active").toString().toLowerCase();
-    if (status === "deprecated") {
-      deprecated += 1;
-      continue; // keep deprecated docs out of the routing lines
-    }
-    const moduleLabel = (field(block, "module") || "—").toString();
-    const keywords = asList(field(block, "keywords"));
-    const doc = path.relative(projectDir, file).split(path.sep).join("/");
-    const kw = keywords.length ? `[${keywords.join(", ")}]` : "[]";
-    for (const glob of owns) {
-      lines.push(`${glob} → ${doc} · ${moduleLabel} · ${kw} · ${status}`);
-    }
-  }
-  if (lines.length === 0) return "";
-  lines.sort();
-  const header =
-    "# Ownership index (generated) — code-path glob → owning feature doc · module · keywords · status\n" +
-    "# Match the file or topic you're about to touch, then read the owning doc before changing it.\n";
-  const footer = deprecated > 0 ? `\n# (${deprecated} deprecated feature doc(s) omitted)` : "";
-  return header + lines.join("\n") + footer;
-}
-
-function main() {
-  const raw = readStdin();
-  let payload = {};
-  try {
-    payload = raw ? JSON.parse(raw) : {};
-  } catch (e) {
-    payload = {};
-  }
-  const index = buildIndex(resolveProjectDir(payload));
-  if (!index) return; // no feature docs yet → inject nothing
-  process.stdout.write(
-    JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: "SessionStart",
-        additionalContext: index,
-      },
-    })
-  );
-}
-
-try {
-  main();
-} catch (e) {
-  // Best-effort: a routing index is a convenience, never a gate. Inject nothing on failure.
-} finally {
-  process.exit(0);
-}