@polymorphism-tech/morph-spec 8.15.0 → 8.16.0

package/framework/hooks/shared/state-writer.js

@@ -12,6 +12,7 @@
 
 import { readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';
+import { clearStateCache } from './state-reader.js';
 
 const STATE_FILE = '.morph/state.json';
 const STATE_VERSION = '5.0.0';
@@ -73,6 +74,21 @@ export function persistFeature(featureName, feature, projectPath) {
     root.metadata = root.metadata || {};
     root.metadata.totalFeatures = Object.keys(root.features).length;
     atomicWriteJson(statePath, root);
+
+    // R1's loadState() memoizes per projectPath for the lifetime of the
+    // process. That was always safe when every hook was its own short-lived
+    // process (README history), but core/chain.js now runs multiple hooks
+    // — e.g. state-sync then gate-guard — IN ONE process. Without this,
+    // a loadState() call earlier in that same process (state-sync's
+    // handleWriteEdit reads via loadState before this write) would leave a
+    // stale snapshot cached, and gate-guard's loadState() right after this
+    // write would silently read the PRE-write state instead of what was
+    // just persisted — inverting the "gate-guard runs after state-sync so it
+    // sees the gate state-sync just recorded" ordering guarantee the
+    // registry comment documents. Invalidating here (the one place
+    // feature.json/state.json are actually written) covers every current
+    // and future caller, not just this one chain.
+    clearStateCache();
     return true;
   } catch {
     return false;

package/framework/skills/core/create-umbraco-lp/SKILL.md

@@ -4,7 +4,7 @@ description: Guia a criação de uma landing page nova ponta-a-ponta a partir do
 version: core
 when-to-invoke: ao iniciar um novo projeto de LP com o template Umbraco genérico
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # create-umbraco-lp

package/framework/skills/core/migrate-lp-to-umbraco/SKILL.md

@@ -4,7 +4,7 @@ description: Migra uma landing page existente (React/Vite, Next.js estático ou
 version: core
 when-to-invoke: ao receber instrução "use /migrate-lp-to-umbraco {projeto}" do usuário, ou quando o usuário descrever necessidade de migrar uma LP para Umbraco
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # migrate-lp-to-umbraco

package/framework/skills/core/morph-apply/SKILL.md

@@ -4,7 +4,7 @@ description: Orquestra a execução autônoma de tasks de uma feature morph-spec
 version: core
 when-to-invoke: após Gate 2 aprovado, ao receber instrução "use /morph-apply" ou "implementar feature"
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-apply

package/framework/skills/core/morph-brainstorming/SKILL.md

@@ -4,7 +4,7 @@ description: Entende o negócio, os usuários e a arquitetura antes de qualquer
 version: core
 when-to-invoke: ao receber um novo request de feature, antes de morph-plan
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-brainstorming

package/framework/skills/core/morph-eval/SKILL.md

@@ -4,7 +4,7 @@ description: Avalia a qualidade de uma tarefa ou fase com rubricas graduadas 0-1
 version: core
 when-to-invoke: ao completar uma tarefa ou ao finalizar uma fase de implementação
 user-invokable: false
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-eval

package/framework/skills/core/morph-hotfix/SKILL.md

@@ -4,7 +4,7 @@ description: ADW cirúrgico de hotfix — resolve uma queda/bug crítico de prod
 version: core
 when-to-invoke: ao receber "/morph-hotfix {feature}", quando a morph-proposal classifica o pedido como workType hotfix (Passo 0), ou o usuário diz "produção caiu / hotfix / urgente"
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-hotfix

package/framework/skills/core/morph-implement/SKILL.md

@@ -4,7 +4,7 @@ description: Guia a execução de cada tarefa de implementação com standard e
 version: core
 when-to-invoke: ao iniciar cada task de implementação listada em tasks.json
 user-invokable: false
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-implement

package/framework/skills/core/morph-plan/SKILL.md

@@ -4,7 +4,7 @@ description: Guia a produção dos artefatos de planejamento de uma feature (use
 version: core
 when-to-invoke: ao iniciar a fase plan de uma feature, após o Gate 1 (proposal aprovado)
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-plan

package/framework/skills/core/morph-proposal/SKILL.md

@@ -4,7 +4,7 @@ description: Orquestra a fase de proposta+plano de uma feature morph-spec. Encad
 version: core
 when-to-invoke: ao receber instrução "use /morph-proposal" do usuário, ou ao iniciar uma nova feature
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-proposal

package/framework/skills/core/morph-review/SKILL.md

@@ -4,7 +4,7 @@ description: Conduz a fase de revisão e produz o review-report.md para o Gate 3
 version: core
 when-to-invoke: ao iniciar a fase review, após todas as tasks de tasks.json estarem com status `done`
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-review

package/framework/skills/core/morph-stack-scan/SKILL.md

@@ -4,7 +4,7 @@ description: Varre o codebase existente, detecta stack atual, compara com o stac
 version: core
 when-to-invoke: ao iniciar uma feature em projeto brownfield (codebase já existente)
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-stack-scan

package/framework/skills/core/morph-standards/SKILL.md

@@ -4,7 +4,7 @@ description: Localiza e carrega um standard específico do STANDARDS.json sob de
 version: core
 when-to-invoke: quando precisar consultar um standard específico durante a implementação
 user-invokable: true
-cliVersion: "8.15.0"
+cliVersion: "8.16.0"
 ---
 
 # morph-standards

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polymorphism-tech/morph-spec",
-  "version": "8.15.0",
+  "version": "8.16.0",
   "description": "MORPH-SPEC: NLH (Natural Language Harness) for spec-driven development with Claude Code",
   "keywords": [
     "claude-code",

package/src/commands/observability/cost.js

@@ -0,0 +1,137 @@
+/**
+ * `morph-spec cost [feature] [--by task|phase] [--json]`
+ *
+ * A cost-facing view over the same harness event stream `telemetry` reads
+ * (.morph/logs/events.jsonl): how much wall-clock time was spent inside
+ * measured tasks (TaskStart→TaskEnd), how many context bytes were
+ * re-ingested (grouped by kind: rubric/standard/skill/agents/plan-artifact/
+ * code), and how many sub-agent dispatches happened (with total prompt
+ * chars).
+ *
+ * IMPORTANT: bytes re-ingested is a DETERMINISTIC PROXY for cost, not a
+ * token count. Hooks only see what tools read off disk — never the model's
+ * actual token usage — so this measures re-ingestion pressure, not spend.
+ *
+ * Read-only, always exits 0 on a normal (even empty) run — fail-open, an
+ * empty stream is an answer, not an error. Only `--by` with an unknown value
+ * is a usage error (exit 1).
+ */
+
+import chalk from 'chalk';
+import { loadTelemetry, aggregateCost } from '../../lib/telemetry/telemetry-reader.js';
+
+const BYTES_CAVEAT =
+  'Bytes re-ingeridos são um PROXY determinístico de custo (o que as ferramentas leram do disco) — NÃO são tokens reais. Hooks não enxergam o uso real de tokens do modelo.';
+
+const BY_MODES = ['task', 'phase'];
+
+function fmtBytes(n) {
+  if (!n) return '0 B';
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}
+
+function fmtDuration(s) {
+  if (s === null || s === undefined) return '-';
+  if (s < 60) return `${s.toFixed(1)}s`;
+  const m = Math.floor(s / 60);
+  const rem = Math.round(s % 60);
+  return `${m}m${rem}s`;
+}
+
+function printBytesByKind(bytesByKind) {
+  const entries = Object.entries(bytesByKind);
+  if (!entries.length) {
+    console.log(chalk.gray('    (0 bytes re-ingeridos — nenhum Read com bytes/kind neste escopo)'));
+    return;
+  }
+  for (const [kind, bytes] of entries.sort((a, b) => b[1] - a[1])) {
+    console.log(`    ${chalk.yellow(kind.padEnd(14))} ${fmtBytes(bytes)}`);
+  }
+}
+
+function printTasks(tasks) {
+  if (!tasks.length) {
+    console.log(chalk.gray('\nNenhuma task com TaskStart/TaskEnd capturada.'));
+    return;
+  }
+  for (const t of tasks) {
+    const status = t.open ? chalk.yellow('[em aberto]') : (t.status || '-');
+    console.log('\n' + chalk.white.bold(`Task ${t.task}`) + chalk.gray(` · ${t.feature ?? '(sem feature)'}`) + ` · ${status}`);
+    console.log(`  duração: ${fmtDuration(t.durationSeconds)}`);
+    console.log(`  dispatches: ${t.dispatches.count} (${t.dispatches.promptChars} chars de prompt)`);
+    console.log('  bytes re-ingeridos por kind:');
+    printBytesByKind(t.bytesByKind);
+  }
+}
+
+function printPhases(phases) {
+  if (!phases.length) {
+    console.log(chalk.gray('\nNenhum byte de Read com phase capturado.'));
+    return;
+  }
+  for (const p of phases) {
+    console.log('\n' + chalk.white.bold(`Fase ${p.phase}`) + chalk.gray(` · ${fmtBytes(p.bytesTotal)} total`));
+    printBytesByKind(p.bytesByKind);
+  }
+}
+
+function printSummary(summary) {
+  console.log(`\n  duração dentro de tasks medidas: ${fmtDuration(summary.taskDurationSeconds)}`);
+  console.log(`  dispatches: ${summary.dispatches.count} (${summary.dispatches.promptChars} chars de prompt)`);
+
+  console.log('\n' + chalk.white.bold('Bytes re-ingeridos por kind') + ` (${fmtBytes(summary.bytesTotal)} total)`);
+  printBytesByKind(summary.bytesByKind);
+
+  if (summary.tools.length) {
+    console.log('\n' + chalk.white.bold('Mix de tools'));
+    for (const t of summary.tools) console.log(`  ${t.name.padEnd(16)} ${t.count}`);
+  }
+}
+
+/**
+ * @param {string} [feature] - narrow to a single feature
+ * @param {{ json?: boolean, by?: 'task'|'phase', cwd?: string }} [options]
+ */
+export function costCommand(feature, options = {}) {
+  if (options.by && !BY_MODES.includes(options.by)) {
+    console.error(chalk.red(`\n❌ Invalid --by: "${options.by}"`));
+    console.error(chalk.gray(`Valid modes: ${BY_MODES.join(', ')}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  const events = loadTelemetry(options.cwd || process.cwd());
+  const summary = aggregateCost(events, { feature });
+
+  if (options.json) {
+    // No forced process.exit() here: on Windows a piped stdout write is
+    // async, and exit()ing right after a large console.log can race the
+    // flush and truncate output. Letting the event loop drain naturally
+    // (nothing else keeps it alive in this command) exits 0 without risk.
+    console.log(JSON.stringify(summary));
+    return;
+  }
+
+  if (summary.total === 0) {
+    const scope = feature ? ` para a feature "${feature}"` : '';
+    console.log(chalk.gray(`Telemetria vazia${scope} — nenhum evento capturado ainda em .morph/logs/events.jsonl.`));
+    return;
+  }
+
+  const scope = feature ? chalk.cyan(` · feature ${feature}`) : '';
+  console.log(chalk.white.bold(`Custo do harness (proxy determinística) — ${summary.total} eventos${scope}`));
+  console.log(chalk.gray(`⚠ ${BYTES_CAVEAT}`));
+  if (summary.features.length) {
+    console.log(chalk.gray(`Features: ${summary.features.join(', ')}`));
+  }
+
+  if (options.by === 'task') {
+    printTasks(summary.tasks);
+  } else if (options.by === 'phase') {
+    printPhases(summary.phases);
+  } else {
+    printSummary(summary);
+  }
+}

package/src/commands/project/doctor.js

@@ -991,7 +991,34 @@ export async function doctorCommand(options = {}) {
       check('context7 plugin', pluginStatus.context7, false,
         'Run: morph-spec install-plugin context7');
     } else {
-      checks.push({ name: '.claude/', status: 'warn', msg: 'incomplete structure' });
+      // `.claude/` exists but lacks commands/ and/or skills/ — ranges from a
+      // partial install to the full-wipe incident this command exists to catch
+      // (folder survives, 0 items — doctor used to shrug this off as a vague
+      // warning with no fix). Count what IS still there: near-total loss is an
+      // ERROR with the actionable command, not a warning that reads as optional.
+      const pieces = ['agents', 'rules', 'skills', 'commands'];
+      const present = [];
+      for (const piece of pieces) {
+        if (await pathExists(join(claudePath, piece))) present.push(piece);
+      }
+      if (await pathExists(join(claudePath, 'CLAUDE.md'))) present.push('CLAUDE.md');
+      if (await pathExists(join(claudePath, 'settings.local.json'))) present.push('settings.local.json');
+
+      if (present.length <= 1) {
+        checks.push({
+          name: '.claude/',
+          status: 'error',
+          msg: `severely damaged — only ${present.length ? present.join(', ') : 'nothing'} present (expected agents/, rules/, skills/, commands/, CLAUDE.md, settings.local.json) — run 'morph-spec setup-infra' (NOT --reinstall, which only covers stack-aware assets) to fully restore`,
+        });
+        hasErrors = true;
+      } else {
+        checks.push({
+          name: '.claude/',
+          status: 'warn',
+          msg: `incomplete structure — present: ${present.join(', ')} — run 'morph-spec setup-infra' to restore the rest`,
+        });
+        hasWarnings = true;
+      }
     }
   } else {
     checks.push({ name: '.claude/', status: 'missing' });

package/src/commands/state/approve.js

@@ -283,17 +283,38 @@ export async function approveCommand(featureName, gateName, options = {}) {
 
     let selfAssessed = false;
     if (gateName === 'review') {
-      const evaluatorReport = join(process.cwd(), '.morph', 'features', featureName, '4-review', 'evaluator-report.md');
-      if (!existsSync(evaluatorReport)) {
-        if (!options.selfAssessed) {
-          console.error(chalk.red('\n❌ Gate 3 exige o avaliador independente — `4-review/evaluator-report.md` não existe.'));
-          console.error(chalk.gray('   O score composto da feature vem do avaliador (persona `evaluator`, contexto fresco)'));
-          console.error(chalk.gray('   despachado pela morph-review, nunca de auto-avaliação de quem implementou.'));
-          console.error(chalk.gray('   Se o dispatch for impossível nesta sessão, aprove com --self-assessed —'));
-          console.error(chalk.gray('   a degradação fica registrada no feature.json e aparece no `list`/`fleet`.\n'));
+      if (feature.workType === 'hotfix') {
+        // Hotfix Gate 3 does NOT require the independent evaluator: `morph-hotfix`
+        // (SKILL.md §7) never dispatches `morph-evaluator` — speed over ceremony
+        // is the point of a hotfix — and instead writes `4-review/review-report.md`
+        // (diff + real test evidence) before asking the human to approve. Requiring
+        // evaluator-report.md here made the skill's own documented flow unable to
+        // clear its own Gate 3 (the only escape was --self-assessed, which stamps
+        // a degradation for a report that was never supposed to exist). The human
+        // signature is already enforced above (line ~215) — this only checks the
+        // artifact the skill actually produces.
+        const reviewReport = join(process.cwd(), '.morph', 'features', featureName, '4-review', 'review-report.md');
+        if (!existsSync(reviewReport)) {
+          console.error(chalk.red('\n❌ Gate 3 de hotfix exige `4-review/review-report.md` — não existe.'));
+          console.error(chalk.gray('   É o artefato que a `morph-hotfix` produz (diff do fix + evidência real de'));
+          console.error(chalk.gray('   teste do `morph-spec verify`), não o `evaluator-report.md` do avaliador'));
+          console.error(chalk.gray('   independente — hotfix nunca despacha o avaliador. Escreva o relatório antes'));
+          console.error(chalk.gray('   de aprovar; a assinatura humana já é exigida pelo backstop acima.\n'));
           process.exit(1);
         }
-        selfAssessed = true;
+      } else {
+        const evaluatorReport = join(process.cwd(), '.morph', 'features', featureName, '4-review', 'evaluator-report.md');
+        if (!existsSync(evaluatorReport)) {
+          if (!options.selfAssessed) {
+            console.error(chalk.red('\n❌ Gate 3 exige o avaliador independente — `4-review/evaluator-report.md` não existe.'));
+            console.error(chalk.gray('   O score composto da feature vem do avaliador (persona `evaluator`, contexto fresco)'));
+            console.error(chalk.gray('   despachado pela morph-review, nunca de auto-avaliação de quem implementou.'));
+            console.error(chalk.gray('   Se o dispatch for impossível nesta sessão, aprove com --self-assessed —'));
+            console.error(chalk.gray('   a degradação fica registrada no feature.json e aparece no `list`/`fleet`.\n'));
+            process.exit(1);
+          }
+          selfAssessed = true;
+        }
       }
     }
 

package/src/commands/state/archive.js

@@ -1,8 +1,18 @@
 import chalk from 'chalk';
 import { existsSync, renameSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { join } from 'path';
+import { join, resolve, sep } from 'path';
 import { execFileSync } from 'child_process';
 import { promoteUseCases, SPECS_USECASES_PATHSPEC } from '../../lib/specs/usecase-promoter.js';
+import { isValidFeatureName } from '../project/worktree.js';
+
+/** Refuse a move whose resolved target escapes `scopeDir`. */
+function assertContained(scopeDir, name, target) {
+  const scopeAbs = resolve(scopeDir) + sep;
+  const targetAbs = resolve(target);
+  if (targetAbs !== resolve(scopeDir) && !(targetAbs + sep).startsWith(scopeAbs)) {
+    throw new Error(`recusado: "${name}" resolve para fora de ${scopeDir}`);
+  }
+}
 
 /**
  * `morph-spec archive <feature>` — atomic, git-aware archive of a completed
@@ -57,9 +67,22 @@ function readReviewApproved(fjPath) {
  */
 export function runArchive(feature, opts = {}) {
   const cwd = opts.cwd || process.cwd();
-  const featuresPath = join(cwd, '.morph', 'features', feature);
+
+  // Gate 0: valid kebab name — refuses BEFORE any path is built from it. Same
+  // gate `finish` already applies upstream (defense-in-depth here); the
+  // standalone `archiveCommand` has no other gate at all, so without this an
+  // unvalidated `feature` reaches `renameSync` and can MOVE a directory outside
+  // .morph/features/ (`../../.claude` resolves to `cwd/.claude`).
+  if (!isValidFeatureName(feature)) {
+    return { ok: false, error: 'invalid-feature-name' };
+  }
+
+  const featuresDir = join(cwd, '.morph', 'features');
   const archiveDir = join(cwd, '.morph', 'archive');
+  const featuresPath = join(featuresDir, feature);
   const archivePath = join(archiveDir, feature);
+  assertContained(featuresDir, feature, featuresPath);
+  assertContained(archiveDir, feature, archivePath);
   const featPathspec = join('.morph', 'features', feature);
   const archivePathspec = join('.morph', 'archive', feature);
 
@@ -197,7 +220,10 @@ export async function archiveCommand(featureName, options = {}) {
     });
 
     if (!result.ok) {
-      if (result.error === 'feature-folder-not-found') {
+      if (result.error === 'invalid-feature-name') {
+        console.error(chalk.red(`\n❌ Invalid feature name: "${featureName}"`));
+        console.error(chalk.gray('Use kebab-case: lowercase letters, digits and hyphens (e.g. "user-onboarding")\n'));
+      } else if (result.error === 'feature-folder-not-found') {
         console.error(chalk.red(`\n❌ Feature folder not found: .morph/features/${featureName}\n`));
       } else if (result.error === 'review-not-approved') {
         console.error(chalk.red(`\n❌ Gate 3 (review) is not approved for "${featureName}".`));

package/src/commands/state/delete.js

@@ -1,7 +1,8 @@
 import chalk from 'chalk';
 import { existsSync, rmSync, renameSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { join } from 'path';
+import { join, resolve, sep } from 'path';
 import { execSync } from 'child_process';
+import { isValidFeatureName } from '../project/worktree.js';
 
 /**
  * `morph-spec delete <feature>` — remove a feature. Hard by default (folder is
@@ -17,8 +18,27 @@ import { execSync } from 'child_process';
  *
  * Refuses when any gate is approved (real work, not a dead shell), unless
  * `--force`.
+ *
+ * SECURITY: `featureName` is an unsanitized CLI argument that flows straight
+ * into `rmSync(..., { recursive: true })` — the same class of bug the worktree
+ * teardown guards against, but here the danger is path TRAVERSAL rather than a
+ * followed symlink. `join(cwd, '.morph', 'features', '../../.claude')`
+ * resolves to `cwd/.claude`, so an unvalidated name can point the hard-delete
+ * at the shared `.claude/` install (or anything else relative to cwd). Gated
+ * by `isValidFeatureName` (same kebab-slug rule `create` stamps at birth) PLUS
+ * a resolved-path containment assert — validated by path, not by the
+ * convention that a real feature name never contains `..`.
  */
 
+/** Refuse a delete/archive whose resolved target escapes `.morph/features/{scope}/{name}`. */
+function assertContained(scopeDir, name, target) {
+  const scopeAbs = resolve(scopeDir) + sep;
+  const targetAbs = resolve(target);
+  if (targetAbs !== resolve(scopeDir) && !(targetAbs + sep).startsWith(scopeAbs)) {
+    throw new Error(`recusado: "${name}" resolve para fora de ${scopeDir}`);
+  }
+}
+
 function isGitRepo(cwd) {
   try {
     execSync('git rev-parse --is-inside-work-tree', { cwd, stdio: 'pipe' });
@@ -53,7 +73,21 @@ function dropFromIndex(cwd, featureName) {
 export async function deleteCommand(featureName, options = {}) {
   try {
     const cwd = options.cwd || process.cwd();
-    const featuresPath = join(cwd, '.morph', 'features', featureName);
+
+    // Gate 0: valid kebab name — refuses BEFORE any path is built from it, so a
+    // traversal attempt (`../../.claude`) never reaches existsSync/rmSync. Same
+    // gate `create` stamps at birth and `finish` re-checks; unlike those two,
+    // delete/archive take a FRESH argument every invocation, so this cannot rely
+    // on "every real feature folder is already a valid slug".
+    if (!isValidFeatureName(featureName)) {
+      console.error(chalk.red(`\n❌ Invalid feature name: "${featureName}"`));
+      console.error(chalk.gray('Use kebab-case: lowercase letters, digits and hyphens (e.g. "user-onboarding")\n'));
+      process.exit(1);
+    }
+
+    const featuresDir = join(cwd, '.morph', 'features');
+    const featuresPath = join(featuresDir, featureName);
+    assertContained(featuresDir, featureName, featuresPath);
     const fjPath = join(featuresPath, 'feature.json');
 
     if (!existsSync(featuresPath)) {

package/src/dashboard/scanner/hooks-scanner.js

@@ -63,8 +63,17 @@ export function hookRegistrations(definitions = getHookDefinitions()) {
     for (const h of def.hooks || []) {
       const file = basename(String(h.command || '').trim());
       if (!file.endsWith('.js')) continue;
-      if (!byFile.has(file)) byFile.set(file, []);
-      byFile.get(file).push({ event: key, rawEvent: def.event, matcher: def.matcher || null });
+      // Grupos consolidados apontam para chain.js com os hooks reais em
+      // `args` (base names, na ordem de execução) — registre cada elo, não o
+      // runner: é o elo que o Inspector precisa mostrar. chain.js em si não é
+      // um hook de domínio e ficaria como nó fantasma em todo evento.
+      const files = file === 'chain.js' && Array.isArray(h.args) && h.args.length
+        ? h.args.map(a => `${a}.js`)
+        : [file];
+      for (const f of files) {
+        if (!byFile.has(f)) byFile.set(f, []);
+        byFile.get(f).push({ event: key, rawEvent: def.event, matcher: def.matcher || null });
+      }
     }
   }
   return byFile;

package/src/lib/installers/memory-installer.js

@@ -87,7 +87,7 @@ metadata:
 - \`.morph/framework/schemas/tasks.schema.json\` — tasks.json schema reference
 - \`.morph/framework/phases.json\` — phase folder mapping and skill associations
 - \`.morph/framework/agents.json\` — domain persona definitions (dotnet-senior, ef-modeler, etc.)
-- \`.morph/framework/rubrics/\` — eval rubrics for morph-eval scoring
+- \`.morph/framework/evals/rubrics/\` — eval rubrics for morph-eval scoring (architecture/contracts/code-quality/test-coverage)
 `;
 
 /**