@nurix/etna 0.19.90 → 0.19.91

package/data/harnesses/code/hooks/lib/repo.mjs

@@ -0,0 +1,68 @@
+// harness/code/hooks/lib/repo.mjs — the shared floor every hook module stands on: safe reads,
+// path normalization, git, session ids, and the one definition of "source file". Each of these
+// existed as 2–5 diverging private copies before being hoisted here.
+
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+export function readSafe(file) {
+  try {
+    return fs.readFileSync(file, "utf8");
+  } catch (e) {
+    return "";
+  }
+}
+
+// Repo-relative /-separated path, or null when the target lies outside the project.
+export function relIfInside(projectDir, filePath) {
+  if (!filePath) return null;
+  const rel = path.relative(projectDir, path.resolve(projectDir, filePath));
+  if (rel.startsWith("..") || path.isAbsolute(rel)) return null;
+  return rel.split(path.sep).join("/");
+}
+
+export function git(cwd, args) {
+  const res = spawnSync("git", args, { cwd, encoding: "utf8", timeout: 5000 });
+  return res.status === 0 ? (res.stdout || "").trim() : null;
+}
+
+export const today = () => new Date().toISOString().slice(0, 10);
+
+export function sid8(sessionId) {
+  return String(sessionId || "unknown").replace(/[^a-zA-Z0-9-]/g, "").slice(0, 8) || "unknown";
+}
+
+// One definition of "source file" — the plan gate and the drift detector must agree on it.
+export const SOURCE_EXT = /\.(m?[jt]sx?|py|rs|go|rb|java|kt|swift|c|h|cpp|hpp|cs|sh|sql|css|scss|vue|svelte)$/;
+
+// Space-free backticked tokens in a markdown chunk, `./` prefix stripped — the shared grammar
+// for path-carrying prose (protected lists, plan scopes).
+export function backtickTokens(text) {
+  const out = [];
+  for (const m of String(text || "").matchAll(/`([^`\n]+)`/g)) {
+    const candidate = m[1].trim().replace(/^\.\//, "");
+    if (candidate && !candidate.includes(" ")) out.push(candidate);
+  }
+  return out;
+}
+
+// The repo a Bash command acts on: an explicit `cd <dir>` in the command wins, then the
+// payload's cwd, then the session's home project — a session may operate across repos
+// (forge + consumer), and gating a commit against the wrong repo blocks or passes falsely.
+// A candidate is normalized to its git toplevel so a subdirectory cwd still resolves to the
+// repo root. Claim and release both route here — two private copies of this rule once
+// disagreed, and the divergence leaked stale claims.
+export function commandRoot(projectDir, payload, command) {
+  const cdMatch = /(?:^|\n|&&|;)\s*cd\s+"?([^"\s;&]+)"?/.exec(command || "");
+  for (const candidate of [cdMatch && cdMatch[1], payload && payload.cwd]) {
+    if (!candidate || !path.isAbsolute(candidate)) continue;
+    try {
+      if (!fs.statSync(candidate).isDirectory()) continue;
+    } catch (e) {
+      continue;
+    }
+    return git(candidate, ["rev-parse", "--show-toplevel"]) || candidate;
+  }
+  return projectDir;
+}

package/data/harnesses/code/hooks/lib/session-log.mjs

@@ -1,6 +1,6 @@
 // harness/code/hooks/lib/session-log.mjs — the per-session gate log: enforcement state, not a record.
 // It lives in .claude/state/sessions/ (machine-local, self-ignored) because its load-bearing role
-// is synchronous: machinery appends `denied` and `hook-crash` events, the session appends
+// is synchronous: machinery appends `denied` events, the session appends
 // `resolved` lines, and the walls read PAIRS — a `denied` with no later `resolved` for the same
 // gate·target is an open failure, and silence about it is what the Stop and commit walls refuse.
 // Within a session resolution appends rather than deletes (the retry story is what the walls
@@ -10,10 +10,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { stateDir } from "./state.mjs";
-
-function sid8(sessionId) {
-  return String(sessionId || "unknown").replace(/[^a-zA-Z0-9-]/g, "").slice(0, 8) || "unknown";
-}
+import { sid8 } from "./repo.mjs";
 
 export function sessionLogPath(projectDir, sessionId) {
   const dir = path.join(stateDir(projectDir), "sessions");

package/data/harnesses/code/hooks/lib/state.mjs

@@ -219,18 +219,26 @@ export function resolveRows(projectDir, predicate) {
   return res.result;
 }
 
+export function waiverExpiry(row) {
+  return (/expires=(\d{4}-\d{2}-\d{2})/.exec(row.body) || [])[1] || null;
+}
+
 // Unexpired waived rows for a finding kind (the dead-glob allowlist CI honors).
-// A waived row covers a glob when its body names it verbatim.
 export function unexpiredWaivers(rows, kind, today) {
   return rows.filter((row) => {
     if (row.kind !== "waived") return false;
     if (kind && !row.body.includes(kind)) return false;
-    const expires = (/expires=(\d{4}-\d{2}-\d{2})/.exec(row.body) || [])[1];
-    if (!expires) return false;
-    return expires >= today;
+    const expires = waiverExpiry(row);
+    return !!expires && expires >= today;
   });
 }
 
+// True when an unexpired waiver of `kind` names the finding's subject. The subject is matched
+// BACKTICKED — a bare substring match let a waiver for `src/dead1.ts` silently cover `src/dead`.
+export function waiverCovers(rows, kind, subject, today) {
+  return unexpiredWaivers(rows, kind, today).some((w) => w.body.includes(`\`${subject}\``));
+}
+
 // Ensure .claude/state/ exists and is self-ignoring (a `*` .gitignore inside it),
 // so consumers never see machine-local state as untracked noise. Returns the dir.
 export function stateDir(projectDir) {

package/data/harnesses/code/skills/documentation/templates/bookkeeping.md

@@ -15,4 +15,4 @@ The shared work queue keeping documentation and code in sync — a queue, never
 - waived: YYYY-MM-DD · {what is deferred} · reason: {why} → expires=YYYY-MM-DD
 ```
 
-Finding kinds for `auto:`: `dead-glob` · `doc-implicated` · `doc-lint` · `header-missing` · `index-row-missing` · `boundary-scan-suggested` · `doc-placement`.
+Finding kinds for `auto:`: `dead-glob` · `doc-implicated` · `doc-lint` · `header-missing` · `index-row-missing` · `package-rejected` · `frozen-record-edited`.

package/data/harnesses/delivery/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "delivery",
   "name": "delivery",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "a11ca1e20bd4"
+  "digest": "7358b638bff2"
 }

package/data/harnesses/delivery/skills/documentation/templates/bookkeeping.md

@@ -15,4 +15,4 @@ The shared work queue keeping documentation and code in sync — a queue, never
 - waived: YYYY-MM-DD · {what is deferred} · reason: {why} → expires=YYYY-MM-DD
 ```
 
-Finding kinds for `auto:`: `dead-glob` · `doc-implicated` · `doc-lint` · `header-missing` · `index-row-missing` · `boundary-scan-suggested` · `doc-placement`.
+Finding kinds for `auto:`: `dead-glob` · `doc-implicated` · `doc-lint` · `header-missing` · `index-row-missing` · `package-rejected` · `frozen-record-edited`.

package/data/harnesses/etna/harness.json

@@ -1,12 +1,12 @@
 {
   "harness": "etna",
   "name": "etna",
-  "version": "1.5.7",
+  "version": "1.5.8",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
     ".vscode/settings.json"
   ],
   "seeds": [],
-  "digest": "5843b3511178"
+  "digest": "f2edee92fac2"
 }

package/data/harnesses/etna/skills/documentation/templates/bookkeeping.md

@@ -15,4 +15,4 @@ The shared work queue keeping documentation and code in sync — a queue, never
 - waived: YYYY-MM-DD · {what is deferred} · reason: {why} → expires=YYYY-MM-DD
 ```
 
-Finding kinds for `auto:`: `dead-glob` · `doc-implicated` · `doc-lint` · `header-missing` · `index-row-missing` · `boundary-scan-suggested` · `doc-placement`.
+Finding kinds for `auto:`: `dead-glob` · `doc-implicated` · `doc-lint` · `header-missing` · `index-row-missing` · `package-rejected` · `frozen-record-edited`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/etna",
-  "version": "0.19.90",
+  "version": "0.19.91",
   "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
   "type": "module",
   "bin": {
@@ -42,5 +42,5 @@
     "agent",
     "plugin"
   ],
-  "etnaFingerprint": "8d6f9b80d64d"
+  "etnaFingerprint": "b52694cf6295"
 }