@nurix/etna 0.20.47 → 0.20.49

package/data/harnesses/code/hooks/hooks.json

@@ -14,7 +14,7 @@
       { "matcher": "Edit|Write|MultiEdit|Bash", "hooks": [ { "type": "command", "command": "f=\"$CLAUDE_PROJECT_DIR/.claude/hooks/awareness.mjs\"; [ -f \"$f\" ] || exit 0; node \"$f\"", "timeout": 10 }, { "type": "command", "command": "f=\"$CLAUDE_PROJECT_DIR/.claude/hooks/build-graph.mjs\"; [ -f \"$f\" ] || exit 0; node \"$f\"", "timeout": 10 } ] }
     ],
     "PreToolUse": [
-      { "matcher": "Edit|Write|MultiEdit|Bash", "hooks": [ { "type": "command", "command": "f=\"$CLAUDE_PROJECT_DIR/.claude/hooks/compliance.mjs\"; [ -f \"$f\" ] || exit 0; node \"$f\"", "timeout": 10 } ] }
+      { "matcher": "Edit|Write|MultiEdit|Bash", "hooks": [ { "type": "command", "command": "f=\"$CLAUDE_PROJECT_DIR/.claude/hooks/compliance.mjs\"; [ -f \"$f\" ] || exit 0; node \"$f\"", "timeout": 10 }, { "type": "command", "command": "f=\"$CLAUDE_PROJECT_DIR/.claude/hooks/protection.mjs\"; [ -f \"$f\" ] || exit 0; node \"$f\"", "timeout": 10, "onFailure": "block" } ] }
     ],
     "Stop": [
       { "matcher": "", "hooks": [ { "type": "command", "command": "f=\"$CLAUDE_PROJECT_DIR/.claude/hooks/compliance.mjs\"; [ -f \"$f\" ] || exit 0; node \"$f\"", "timeout": 15 } ] }

package/data/harnesses/code/hooks/lib/backlog-detector.mjs

@@ -1,7 +1,9 @@
 // harness/code/hooks/lib/backlog-detector.mjs — rows added to or removed from the backlog since the
 // last observation, emitted through the records door as `backlog` and `backlog.remove`. The last
 // observation lives in .claude/state/backlog-seen.json; an unchanged mtime and size, or an unchanged
-// hash, skips the parse. The row grammar mirrors NuStack's backlogRow.ts, anchor included.
+// hash, skips the parse. A row counts as seen only once the door took it: with no `nustack` the
+// detector observes nothing, and a failed emit keeps the prior rows and backs off before retrying.
+// The row grammar mirrors NuStack's backlogRow.ts, anchor included.
 // Fuller account: docs/harness/code/hooks.md § lib/backlog-detector.mjs.
 
 import fs from "node:fs";
@@ -9,7 +11,11 @@ import path from "node:path";
 import { createHash } from "node:crypto";
 import { docsRoot } from "./repo.mjs";
 import { stateDir } from "./state.mjs";
-import { emitRecord } from "./records-door.mjs";
+import { emitRecord, onPath } from "./records-door.mjs";
+
+// How long a failed emit waits before the detector parses and offers the rows again — a hanging CLI
+// otherwise costs the emit's spawn timeout on every PostToolUse.
+export const BACKLOG_RETRY_MS = 300000;
 
 // FNV-1a 64 over UTF-16 code units, first 8 hex — the same anchor NuStack's parser gives a row.
 export function anchorOf(text) {
@@ -45,8 +51,15 @@ export function backlogFile(projectDir) {
 }
 
 // Diffs the backlog against the last observation and emits the difference. Returns { added, removed }
-// (null when the file was unchanged and not parsed).
-export function detectBacklog(projectDir, { emit = emitRecord, parse = parseBacklog } = {}) {
+// (null when no CLI is on the PATH, the retry window is open, or the file was unchanged and not parsed).
+// `available` probes for the CLI; tests inject it so they stay hermetic.
+export function detectBacklog(
+  projectDir,
+  { emit = emitRecord, parse = parseBacklog, available = () => Boolean(onPath("nustack", process.env.PATH || "")) } = {}
+) {
+  // No CLI: observe nothing, so the first observation after it arrives offers every row — the door's
+  // idempotency key absorbs the ones it already holds.
+  if (!available()) return null;
   const file = backlogFile(projectDir);
   let stat;
   try {
@@ -61,13 +74,14 @@ export function detectBacklog(projectDir, { emit = emitRecord, parse = parseBack
   } catch (e) {
     seen = null;
   }
+  // A failed emit nulls mtimeMs, size and hash, so once the window closes the file is re-parsed.
+  if (seen && typeof seen.retryAfterMs === "number" && Date.now() < seen.retryAfterMs) return null;
   if (seen && seen.mtimeMs === stat.mtimeMs && seen.size === stat.size) return null;
   const text = fs.readFileSync(file, "utf8");
   const hash = createHash("sha256").update(text).digest("hex");
-  const write = (rows) =>
-    fs.writeFileSync(seenFile, JSON.stringify({ mtimeMs: stat.mtimeMs, size: stat.size, hash, rows }) + "\n");
+  const write = (observation) => fs.writeFileSync(seenFile, JSON.stringify(observation) + "\n");
   if (seen && seen.hash === hash) {
-    write(seen.rows || {});
+    write({ mtimeMs: stat.mtimeMs, size: stat.size, hash, rows: seen.rows || {} });
     return null;
   }
   const now = {};
@@ -75,8 +89,14 @@ export function detectBacklog(projectDir, { emit = emitRecord, parse = parseBack
   const prior = (seen && seen.rows) || {};
   const added = Object.keys(now).filter((anchor) => !prior[anchor]).map((anchor) => now[anchor]);
   const removed = Object.keys(prior).filter((anchor) => !now[anchor]).map((anchor) => prior[anchor]);
-  if (added.length) emit("backlog", added, { projectDir });
-  if (removed.length) emit("backlog.remove", removed, { projectDir });
-  write(now);
+  // Each kind lands or fails on its own: a landed kind moves the observation, a failed one keeps the
+  // prior rows for that kind, so the next attempt offers the same difference again.
+  const addedLanded = added.length === 0 || emit("backlog", added, { projectDir }) === "door";
+  const removedLanded = removed.length === 0 || emit("backlog.remove", removed, { projectDir }) === "door";
+  const rows = {};
+  for (const anchor of Object.keys(now)) if (prior[anchor] || addedLanded) rows[anchor] = now[anchor];
+  if (!removedLanded) for (const row of removed) rows[row.anchor] = row;
+  if (addedLanded && removedLanded) write({ mtimeMs: stat.mtimeMs, size: stat.size, hash, rows });
+  else write({ mtimeMs: null, size: null, hash: null, rows, retryAfterMs: Date.now() + BACKLOG_RETRY_MS });
   return { added, removed };
 }

package/data/harnesses/code/hooks/lib/frozen.mjs

@@ -3,6 +3,9 @@
 // Abandoned, an outcome-stamped migration runbook. Immutability begins at commit for changelog
 // entries (a draft in the working tree is meant to be edited), at the status flip for plans, and
 // at the Executed stamp for runbooks. Every check fails open: no git, unreadable file ⇒ not frozen.
+// Each predicate takes `{ timeoutMs }`, a wall-clock budget its git calls share (default 5000); a
+// spent budget or a timed-out call reads as not frozen, so a fail-closed caller never blocks on a
+// slow git.
 
 import fs from "node:fs";
 import path from "node:path";
@@ -13,11 +16,18 @@ function relPosix(projectDir, filePath) {
   return path.relative(projectDir, path.resolve(projectDir, filePath)).split(path.sep).join("/");
 }
 
-// True when git tracks the file at HEAD (i.e. it has been committed at least once).
-export function isCommitted(projectDir, filePath) {
+const DEFAULT_TIMEOUT_MS = 5000;
+
+// Milliseconds left before `deadline`, or 0 once it has passed.
+const remaining = (deadline) => Math.max(0, Math.floor(deadline - Date.now()));
+
+// True when git tracks the file at HEAD (i.e. it has been committed at least once). A timeout or a
+// spent budget answers false.
+export function isCommitted(projectDir, filePath, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  if (!(timeoutMs > 0)) return false;
   const rel = relPosix(projectDir, filePath);
-  const res = spawnSync("git", ["cat-file", "-e", `HEAD:${rel}`], { cwd: projectDir, stdio: "ignore" });
-  return res.status === 0;
+  const res = spawnSync("git", ["cat-file", "-e", `HEAD:${rel}`], { cwd: projectDir, stdio: "ignore", timeout: timeoutMs });
+  return !res.error && !res.signal && res.status === 0;
 }
 
 function readSafe(projectDir, filePath) {
@@ -29,14 +39,14 @@ function readSafe(projectDir, filePath) {
 }
 
 // The predicate. Returns { frozen: boolean, reason?: string }.
-export function frozenStatus(projectDir, filePath) {
+export function frozenStatus(projectDir, filePath, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   const rel = relPosix(projectDir, filePath);
   const root = docsRoot(projectDir);
   // *.bkp.* siblings are install-time backups, not records — the maintenance fold edits and
   // deletes them, which a frozen verdict would forbid.
   if (rel.includes(".bkp.")) return { frozen: false };
   if (rel.startsWith(`${root}/history/changelog/`) && rel.endsWith(".md")) {
-    if (isCommitted(projectDir, rel)) {
+    if (isCommitted(projectDir, rel, { timeoutMs })) {
       return { frozen: true, reason: "committed changelog entry — immutability begins at commit" };
     }
     return { frozen: false };
@@ -62,16 +72,23 @@ export function frozenStatus(projectDir, filePath) {
 // predicate: a record frozen only in the worktree is a freeze born in the current edit (a plan
 // legitimately flipping to Complete), and flagging it walls the completion ceremony itself.
 // Only an edit to something HEAD already froze is an evasion.
-export function frozenStatusAtHead(projectDir, filePath) {
+// A git call that errors or times out answers not frozen at once; only a real non-zero `rev-parse`
+// (no repository) falls to the worktree predicate.
+export function frozenStatusAtHead(projectDir, filePath, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  const deadline = Date.now() + timeoutMs;
   const rel = relPosix(projectDir, filePath);
   const root = docsRoot(projectDir);
   if (rel.includes(".bkp.")) return { frozen: false };
   if (rel.startsWith(`${root}/history/changelog/`) && rel.endsWith(".md")) {
-    return frozenStatus(projectDir, filePath); // already keyed on isCommitted
+    return frozenStatus(projectDir, filePath, { timeoutMs: remaining(deadline) }); // already keyed on isCommitted
   }
-  const inRepo = spawnSync("git", ["rev-parse", "--git-dir"], { cwd: projectDir, stdio: "ignore", timeout: 5000 });
-  if (inRepo.status !== 0) return frozenStatus(projectDir, filePath); // gitless — the worktree is all there is
-  const res = spawnSync("git", ["show", `HEAD:${rel}`], { cwd: projectDir, encoding: "utf8", timeout: 5000 });
+  if (!(remaining(deadline) > 0)) return { frozen: false };
+  const inRepo = spawnSync("git", ["rev-parse", "--git-dir"], { cwd: projectDir, stdio: "ignore", timeout: remaining(deadline) });
+  if (inRepo.error || inRepo.signal) return { frozen: false }; // git absent or timed out — never a gate
+  if (inRepo.status !== 0) return frozenStatus(projectDir, filePath, { timeoutMs: remaining(deadline) }); // gitless — the worktree is all there is
+  if (!(remaining(deadline) > 0)) return { frozen: false };
+  const res = spawnSync("git", ["show", `HEAD:${rel}`], { cwd: projectDir, encoding: "utf8", timeout: remaining(deadline) });
+  if (res.error || res.signal) return { frozen: false };
   const headText = res.status === 0 ? res.stdout || "" : "";
   if (!headText) return { frozen: false }; // never committed — a freeze born in this worktree is a ceremony, not an evasion
   if (rel.startsWith(`${root}/history/plans/`) && /^\*\*Status:\*\*\s*(Complete|Abandoned)\b/m.test(headText)) {