@nurix/etna 0.19.79 → 0.19.81

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "354c269e4457",
+    "fingerprint": "798dd0b4e94c",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.10.5",
+  "version": "3.10.7",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "3614b17652aa"
+  "digest": "3e27328dde24"
 }

package/data/harnesses/code/hooks/awareness.mjs

@@ -31,7 +31,7 @@ import {
   recordTouched,
 } from "./lib/state.mjs";
 import { frozenStatus } from "./lib/frozen.mjs";
-import { approvedPackages } from "./lib/approved.mjs";
+import { approvedPackages, rejectedPackages } from "./lib/approved.mjs";
 import {
   recordSession,
   liveSiblings,
@@ -484,15 +484,24 @@ function detectOutcomes(projectDir, meta, rows) {
       } catch (e) {
         continue;
       }
+      // A row is raised for a *rejected* package only — a decision already taken and violated.
+      // A package with no decision either way is not a defect: it is a dimension nobody has ruled
+      // on, harvested centrally by the fleet package census. Raising rows on absence turned the
+      // commit wall into a tax on every unlisted dependency and produced waivers, not decisions.
+      const rejected = rejectedPackages(projectDir);
       const names = [...Object.keys(manifest.dependencies || {}), ...Object.keys(manifest.devDependencies || {})];
       for (const name of names) {
-        if (approved.has(name) || raised(`\`${name}\` (package-off-catalog`)) continue;
+        if (approved.has(name) || raised(`\`${name}\` (package-rejected`)) continue;
+        const no = rejected.get(name);
+        if (!no) continue;
         rows.push(
           formatAutoRow({
             ...meta,
-            kind: "package-off-catalog",
-            description: `${rel} declares \`${name}\` (package-off-catalog), absent from the approved table`,
-            action: "remove the dependency, or add it to .claude/hooks/approved-packages.md by explicit user decision",
+            kind: "package-rejected",
+            description: `${rel} declares \`${name}\` (package-rejected), which the approved table rejects`,
+            action: no.use
+              ? `replace it with \`${no.use}\`, or change the decision in .claude/hooks/approved-packages.md`
+              : `use the choice ${no.rule} prescribes for this stack, or change the decision`,
           })
         );
       }

package/data/harnesses/code/hooks/compliance.mjs

@@ -13,7 +13,7 @@ import { readQueue, countRows, askedThisSession, recordAsked } from "./lib/state
 import { frozenStatus } from "./lib/frozen.mjs";
 import { undischargedRows } from "./lib/ledger.mjs";
 import { appendEvent, unresolvedDenials, sessionLogPath, malformedEventLines } from "./lib/session-log.mjs";
-import { approvedPackages } from "./lib/approved.mjs";
+import { approvedPackages, rejectedPackages } from "./lib/approved.mjs";
 import { claimActivity, releaseActivity, recentForeignTouches } from "./lib/claims.mjs";
 
 function readSafe(file) {
@@ -277,6 +277,7 @@ function packageGate(projectDir, command, sessionId) {
   if (!m) return null;
   const approved = approvedPackages(projectDir);
   if (approved.size === 0) return null; // no rules file installed — nothing to enforce
+  const rejected = rejectedPackages(projectDir);
   const raw = m[1] || "";
   // Test packages install at `latest`, outside the table's pin set (.claude/rules/testing.md).
   // Two dev-only installs are a decision already taken rather than a new one: a companion in an
@@ -291,16 +292,25 @@ function packageGate(projectDir, command, sessionId) {
   const args = raw.split(/\s+/).filter((a) => a && !a.startsWith("-") && PKG_SPEC.test(a));
   for (const arg of args) {
     const pkg = arg.startsWith("@") ? arg.split("@").slice(0, 2).join("@") : arg.split("@")[0];
+    if (approved.has(pkg)) continue;
     if (isDev && pkg.startsWith("@") && approvedScopes.has(pkg.split("/")[0])) continue;
-    if (!approved.has(pkg)) {
+    // Approved wins over rejected: `jest` is banned for web and Express and prescribed for Expo,
+    // so a name in both is a prescription somewhere and must not be denied.
+    const no = rejected.get(pkg);
+    if (no) {
+      const instead = no.use
+        ? `Use \`${no.use}\`${no.version ? ` ${no.version}` : ""}${no.purpose ? ` — ${no.purpose}` : ""}.`
+        : `The prescribed choice for your stack is in ${no.rule}.`;
       return deny(
         projectDir,
         sessionId,
         "package-table",
         pkg,
-        `BLOCKED — package table. \`${pkg}\` is not in the approved table (.claude/hooks/approved-packages.md; test packages: .claude/rules/testing.md). The table changes only by explicit user decision.`
+        `BLOCKED — \`${pkg}\` is rejected here. ${instead} Rejections are recorded in .claude/hooks/approved-packages.md; changing one is an explicit user decision.`
       );
     }
+    // No decision exists for this package — not approved, not rejected. Allowed, and harvested
+    // centrally by the fleet package census rather than blocked here.
   }
   // Every named package is approved — a package-table denial for one of them is a successful retry.
   for (const arg of args) {
@@ -313,15 +323,18 @@ function packageGate(projectDir, command, sessionId) {
 // The repo a Bash command acts on: an explicit `cd <dir>` in the command wins, then the
 // payload's cwd, then the session's home project — a session may operate across repos
 // (forge + consumer), and gating a commit against the wrong repo blocks or passes falsely.
+// A candidate is normalized to its git toplevel: a cwd inside the repo (packages/studio)
+// still gates — and writes the session log — against the repo root, not the subdirectory.
 function commandRoot(projectDir, payload, command) {
   const cdMatch = /(?:^|&&|;)\s*cd\s+"?([^"\s;&]+)"?/.exec(command || "");
   for (const candidate of [cdMatch && cdMatch[1], payload.cwd]) {
     if (!candidate || !path.isAbsolute(candidate)) continue;
     try {
-      if (fs.statSync(candidate).isDirectory()) return candidate;
+      if (!fs.statSync(candidate).isDirectory()) continue;
     } catch (e) {
-      /* fall through */
+      continue;
     }
+    return git(candidate, ["rev-parse", "--show-toplevel"]) || candidate;
   }
   return projectDir;
 }

package/data/harnesses/code/hooks/lib/approved.mjs

@@ -56,3 +56,35 @@ export function approvedPackages(projectDir) {
   }
   return names;
 }
+
+// A rejection is a decision already taken, and it names its replacement: the approved table's rows
+// are `| package | version | use | don't use |`, so every name in a Don't-use cell points at that
+// row's package. testing.md's framework table bans by stack without a single substitute, so those
+// rejections carry the rule reference instead. Absence from both maps is not a rejection — it is a
+// dimension nobody has ruled on, and the gate lets it through (the census harvests it centrally).
+export function rejectedPackages(projectDir) {
+  const rejected = new Map();
+  const table = path.join(projectDir, ".claude", "hooks", "approved-packages.md");
+  for (const line of readSafe(table).split("\n")) {
+    const cells = line.split("|");
+    if (cells.length < 6) continue;
+    const pkg = /`([^`]+)`/.exec(cells[1] || "");
+    if (!pkg || pkg[1] === "Package" || pkg[1] === "---") continue;
+    const version = (/`?([^`|]+)`?/.exec((cells[2] || "").trim()) || [])[1] || "";
+    for (const m of (cells[4] || "").matchAll(/`(@?[a-z0-9][\w./-]*)`/g)) {
+      if (m[1] === pkg[1]) continue; // "`mermaid` via CDN" bans a delivery, not the row's own package
+      rejected.set(m[1], { use: pkg[1], version: version.trim(), purpose: (cells[3] || "").trim() });
+    }
+  }
+  const testing = path.join(projectDir, ".claude", "rules", "testing.md");
+  let banColumn = -1;
+  for (const line of readSafe(testing).split("\n")) {
+    banColumn = banColumnOf(line, banColumn);
+    if (banColumn < 0 || !line.trimStart().startsWith("|")) continue;
+    const cell = line.split("|")[banColumn] || "";
+    for (const m of cell.matchAll(/`(@?[a-z0-9][\w./-]*)`/g)) {
+      if (!rejected.has(m[1])) rejected.set(m[1], { rule: "testing.md § Frameworks by stack" });
+    }
+  }
+  return rejected;
+}

package/data/harnesses/code/rules/general.md

@@ -33,9 +33,17 @@ How a package's `src/` is laid out. A single-runtime package drops `server/` and
 
 ## Packages
 
-**Only packages in the approved table** — `.claude/hooks/approved-packages.md`, enforced by the PreToolUse install gate, which names the file on a block. The table changes only by explicit user decision.
+**The approved table is `.claude/hooks/approved-packages.md`**, enforced by the PreToolUse install gate. It records three states, and the gate treats them differently:
 
-Two **dev-only** installs are exempt, each a decision already taken rather than a new one: a scoped companion of an approved package (`@testing-library/react` is on the table, so `-D @testing-library/user-event` needs no row of its own) and `@types/*`. An unscoped or runtime install is always judged against the table.
+| The package is… | What happens |
+| --- | --- |
+| in the **Package** column | installs |
+| in a **Don't use** column | **blocked**, and the block names that row's replacement — `moment` answers "use `date-fns`" |
+| in neither | **installs.** No decision exists, so there is nothing to enforce |
+
+A rejection is a decision and binds; an absence is not one and never blocks work. Unlisted packages are harvested across the fleet by the package census, and become rows — or bans — by explicit user decision. **Never edit the table to unblock yourself**; a rejection changes only on the user's say-so.
+
+Two **dev-only** installs are exempt even from the rejection check being reached: a scoped companion of an approved package (`@testing-library/react` is on the table, so `-D @testing-library/user-event` needs no row of its own) and `@types/*`.
 
 ## API Response Envelope
 

package/data/harnesses/etna/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "4c78e401fa54"
+  "digest": "b76f5c26d6a9"
 }

package/data/harnesses/etna/rules/general.md

@@ -33,9 +33,17 @@ How a package's `src/` is laid out. A single-runtime package drops `server/` and
 
 ## Packages
 
-**Only packages in the approved table** — `.claude/hooks/approved-packages.md`, enforced by the PreToolUse install gate, which names the file on a block. The table changes only by explicit user decision.
+**The approved table is `.claude/hooks/approved-packages.md`**, enforced by the PreToolUse install gate. It records three states, and the gate treats them differently:
 
-Two **dev-only** installs are exempt, each a decision already taken rather than a new one: a scoped companion of an approved package (`@testing-library/react` is on the table, so `-D @testing-library/user-event` needs no row of its own) and `@types/*`. An unscoped or runtime install is always judged against the table.
+| The package is… | What happens |
+| --- | --- |
+| in the **Package** column | installs |
+| in a **Don't use** column | **blocked**, and the block names that row's replacement — `moment` answers "use `date-fns`" |
+| in neither | **installs.** No decision exists, so there is nothing to enforce |
+
+A rejection is a decision and binds; an absence is not one and never blocks work. Unlisted packages are harvested across the fleet by the package census, and become rows — or bans — by explicit user decision. **Never edit the table to unblock yourself**; a rejection changes only on the user's say-so.
+
+Two **dev-only** installs are exempt even from the rejection check being reached: a scoped companion of an approved package (`@testing-library/react` is on the table, so `-D @testing-library/user-event` needs no row of its own) and `@types/*`.
 
 ## API Response Envelope
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.79",
+    "version": "0.19.81",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -42,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "354c269e4457"
+    "etnaFingerprint": "798dd0b4e94c"
 }